Edit tour

Windows Analysis Report
stealer.jar

Overview

General Information

Sample name:	stealer.jar
Analysis ID:	1576991
MD5:	04355af832d9de466eeccb977222e3b8
SHA1:	54dc82c0d8d7affc31de7181edd6801082679c54
SHA256:	06bdd2aa3540a9b2dabe9a827fcb79a2019982075937376f67de0f755d55eaf8
Tags:	jaruser-smica83
Infos:

Detection

Can Stealer

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Yara detected Can Stealer

AI detected suspicious sample

Exploit detected, runtime environment dropped PE file

Exploit detected, runtime environment starts unknown processes

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Sigma detected: Suspicious Processes Spawned by Java.EXE

Tries to harvest and steal browser information (history, passwords, etc)

Uses the Telegram API (likely for C&C communication)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

IP address seen in connection with other malware

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Browser Execution In Headless Mode

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

7za.exe (PID: 3376 cmdline: 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\stealer.jar" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

java.exe (PID: 180 cmdline: java.exe -jar "C:\Users\user\Desktop\stealer.jar" 0.0.0.1 MD5: 9DAA53BAB2ECB33DC0D9CA51552701FA)

conhost.exe (PID: 2452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 1292 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 2072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6200 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

conhost.exe (PID: 5776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5556 cmdline: taskkill /F /IM msedge.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msedge.exe (PID: 2684 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=1920 --field-trial-handle=2148,i,12070127069624648540,5385592187411481147,262144 --disable-features=PaintHolding /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

taskkill.exe (PID: 8188 cmdline: taskkill /F /IM msedge.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7480 cmdline: taskkill /F /IM chrome.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 616 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory=Default MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2068 --field-trial-handle=2016,i,11737991082838628297,17630950509741582629,262144 --disable-features=PaintHolding /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

taskkill.exe (PID: 8452 cmdline: taskkill /F /IM brave.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 8596 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 8604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 8656 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 8664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 8704 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 8712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 8752 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 8760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 8812 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 8820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 8872 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 8880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 8972 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 8980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 9020 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 9028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 9068 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 9088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 9172 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 9188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7616 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 7212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7712 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 5880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 4708 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 7172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7220 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

HOSTNAME.EXE (PID: 528 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 5136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7284 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 7668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7640 cmdline: wmic path win32_VideoController get name MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 8008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1492 cmdline: wmic cpu get name MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8264 cmdline: wmic os get Caption /value MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 3876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 8384 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 8364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 8380 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 8312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msedge.exe (PID: 5308 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --noerrdialogs --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7220 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2100 --field-trial-handle=1984,i,12352310552584826445,11484031828242325861,262144 --disable-features=PaintHolding /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

conhost.exe (PID: 5568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: java.exe PID: 180	JoeSecurity_CanStealer	Yara detected Can Stealer	Joe Security
Process Memory Space: java.exe PID: 180	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default, CommandLine: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default, CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, NewProcessName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, OriginalFileName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ParentCommandLine: java.exe -jar "C:\Users\user\Desktop\stealer.jar" 0.0.0.1, ParentImage: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, ParentProcessId: 180, ParentProcessName: java.exe, ProcessCommandLine: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default, ProcessId: 2684, ProcessName: msedge.exe

Sigma detected: Suspicious Processes Spawned by Java.EXE

Source: Process started

Author: Andreas Hunkeler (@Karneades), Florian Roth: Data: Command: wmic path win32_VideoController get name, CommandLine: wmic path win32_VideoController get name, CommandLine|base64offset|contains: h, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: java.exe -jar "C:\Users\user\Desktop\stealer.jar" 0.0.0.1, ParentImage: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, ParentProcessId: 180, ParentProcessName: java.exe, ProcessCommandLine: wmic path win32_VideoController get name, ProcessId: 7640, ProcessName: WMIC.exe

Sigma detected: Browser Execution In Headless Mode

Source: Process started

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default, CommandLine: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default, CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, NewProcessName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, OriginalFileName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ParentCommandLine: java.exe -jar "C:\Users\user\Desktop\stealer.jar" 0.0.0.1, ParentImage: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, ParentProcessId: 180, ParentProcessName: java.exe, ProcessCommandLine: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default, ProcessId: 2684, ProcessName: msedge.exe

Sigma detected: Suspicious Execution of Hostname

Source: Process started

Author: frack113: Data: Command: hostname, CommandLine: hostname, CommandLine|base64offset|contains: -, Image: C:\Windows\SysWOW64\HOSTNAME.EXE, NewProcessName: C:\Windows\SysWOW64\HOSTNAME.EXE, OriginalFileName: C:\Windows\SysWOW64\HOSTNAME.EXE, ParentCommandLine: java.exe -jar "C:\Users\user\Desktop\stealer.jar" 0.0.0.1, ParentImage: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, ParentProcessId: 180, ParentProcessName: java.exe, ProcessCommandLine: hostname, ProcessId: 8596, ProcessName: HOSTNAME.EXE

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://canstealer.com/micrort2s	Avira URL Cloud: Label: malware
Source: https://canstealer.com/micrort2	Avira URL Cloud: Label: malware
Source: https://canstealer.com	Avira URL Cloud: Label: malware
Source: https://canstealer.com/micrort2sD	Avira URL Cloud: Label: malware
Source: https://canstealer.com/	Avira URL Cloud: Label: malware

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 93.6% probability

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\AppData\Local\Temp\jna--1415050503\jna7562946210787205297.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\AppData\Local\Temp\jna--1415050503\	Jump to behavior

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\System32\conhost.exe

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: Joe Sandbox View	IP Address: 185.199.111.133 185.199.111.133
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.gofile.io
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: canstealer.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 925sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: java.exe, 00000003.00000002.2479550233.000000000996F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
Source: java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2313975627.000000000A400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2313975627.000000000A400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt
Source: java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2313975627.000000000A400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2313975627.000000000A400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crtC
Source: java.exe, 00000003.00000002.2479550233.0000000009D91000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: java.exe, 00000003.00000002.2488698906.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2332384045.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2384939482.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009DF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: java.exe, 00000003.00000002.2479550233.0000000009D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: java.exe, 00000003.00000002.2488698906.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2332384045.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2384939482.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009DF0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: java.exe, 00000003.00000002.2488698906.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2332384045.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2384939482.0000000016570000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificatP
Source: java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: java.exe, 00000003.00000002.2479550233.0000000009EFC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: java.exe, 00000003.00000002.2479550233.0000000009D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: java.exe, 00000003.00000002.2479550233.0000000009D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: java.exe, 00000003.00000002.2488698906.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2332384045.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2384939482.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009DF0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
Source: java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2313975627.000000000A400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl;K
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crlC
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl
Source: java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2313975627.000000000A400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crlc
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2313975627.000000000A400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crlKP
Source: java.exe, 00000003.00000002.2479550233.0000000009975000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.oracle.com/
Source: pom.xml.0.dr	String found in binary or memory: http://maven.apache.org/POM/4.0.0
Source: java.exe, 00000003.00000002.2479550233.0000000009D10000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2385067589.0000000015A3C000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2332575147.0000000015A74000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2385410293.0000000015A74000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2332631485.0000000015AA3000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2487111809.0000000015A7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/
Source: java.exe, 00000003.00000003.2385067589.0000000015A3C000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2332575147.0000000015A74000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2385410293.0000000015A74000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2332631485.0000000015AA3000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2487111809.0000000015A7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/B
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2313975627.000000000A400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2313975627.000000000A400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2313975627.000000000A400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com;5
Source: java.exe, 00000003.00000002.2479550233.000000000A334000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comsF
Source: java.exe, 00000003.00000002.2479550233.0000000009D91000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com
Source: java.exe, 00000003.00000002.2488698906.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2332384045.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2384939482.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009DF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: java.exe, 00000003.00000002.2479550233.0000000009D91000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: java.exe, 00000003.00000002.2488698906.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2332384045.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009EFC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2384939482.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009DF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: package.html1.0.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: ash_hebrew_common.txt.0.dr, ash_rules_any.txt.0.dr, sep_languages.txt.0.dr, gen_approx_russian.txt.0.dr, gen_approx_romanian.txt.0.dr, ash_approx_russian.txt.0.dr, ash_rules_romanian.txt.0.dr, ash_exact_cyrillic.txt.0.dr, ash_approx_spanish.txt.0.dr, gen_approx_portuguese.txt.0.dr, gen_approx_french.txt.0.dr, ash_approx_hungarian.txt.0.dr, gen_rules_dutch.txt.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org
Source: java.exe, 00000003.00000002.2488698906.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2332384045.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2384939482.0000000016570000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009DF0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: package.html1.0.dr	String found in binary or memory: http://www.gnu.org/licenses/licenses.html
Source: java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm
Source: java.exe, 00000003.00000002.2479550233.0000000009DF0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: java.exe, 00000003.00000002.2479550233.0000000009EFC000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: java.exe, 00000003.00000002.2479550233.0000000009B36000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2313975627.000000000A400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/servers
Source: java.exe, 00000003.00000003.2313975627.000000000A400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/servers;
Source: java.exe, 00000003.00000002.2473743427.0000000004848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: java.exe, 00000003.00000002.2473743427.000000000460A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/
Source: java.exe, 00000003.00000002.2473743427.0000000004855000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: java.exe, 00000003.00000002.2473743427.0000000004848000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2473743427.0000000004543000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7771186573:AAHGj8VtumJ9kjTUYRUQm886fmn2UiPGXSk
Source: java.exe, 00000003.00000002.2473743427.0000000004543000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7771186573:AAHGj8VtumJ9kjTUYRUQm886fmn2UiPGXSk/sendDocument
Source: java.exe, 00000003.00000002.2473743427.0000000004855000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7771186573:AAHGj8VtumJ9kjTUYRUQm886fmn2UiPGXSk/sendMessage
Source: java.exe, 00000003.00000002.2473743427.0000000004848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7771186573:AAHGj8VtumJ9kjTUYRUQm886fmn2UiPGXSk/sendMessagek
Source: java.exe, 00000003.00000002.2473743427.0000000004543000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/sg
Source: java.exe, 00000003.00000002.2473743427.0000000004855000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canstealer.com
Source: java.exe, 00000003.00000002.2473743427.0000000004400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canstealer.com/
Source: java.exe, 00000003.00000002.2473743427.0000000004855000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2473743427.0000000004880000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canstealer.com/micrort2
Source: java.exe, 00000003.00000002.2473743427.00000000047ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canstealer.com/micrort2s
Source: java.exe, 00000003.00000002.2473743427.00000000047ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canstealer.com/micrort2sD
Source: java.exe, 00000003.00000003.2386400459.0000000014AB0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333669646.0000000014AB0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2485697547.0000000014AAF000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230241743.0000000014AD4000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333807033.0000000014AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/TooTallNate/Java-WebSocket/wiki/Lost-connection-detection
Source: pom.xml.0.dr	String found in binary or memory: https://github.com/eclipse-m2e/m2e-core/issues/393
Source: pom.xml.0.dr	String found in binary or memory: https://github.com/moditect/moditect#adding-module-descriptors-to-existing-jar-files
Source: kotlin-stdlib.kotlin_module.0.dr	String found in binary or memory: https://kotlinlang.org/docs/native-migration-guide.html
Source: 000003.log.14.dr	String found in binary or memory: https://ntp.msn.com/
Source: java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: java.exe, 00000003.00000002.2479550233.0000000009DF0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: java.exe, 00000003.00000002.2473743427.00000000044BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: java.exe, 00000003.00000002.2473743427.00000000044BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/sonriseclient/micrort-startup-9170/main/Java.jar
Source: java.exe, 00000003.00000002.2479550233.0000000009D91000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu
Source: java.exe, 00000003.00000002.2479550233.0000000009DF0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.0000000009E3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu0
Source: pom.xml.0.dr	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0.txt
Source: java.exe, 00000003.00000003.2386116401.0000000014F3F000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2485998485.0000000014F46000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333508822.0000000014F1F000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230342663.0000000014F2D000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.00000000099F9000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230465145.0000000014F36000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2334058402.0000000014F3F000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2229455839.0000000014F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html
Source: java.exe, 00000003.00000003.2230597536.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2386116401.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230465145.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230630449.0000000014F85000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2485998485.0000000014F02000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230292297.0000000014ED3000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2229455839.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.00000000099F9000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333508822.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2386357338.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2334058402.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2485998485.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333508822.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#ignoredBindings
Source: java.exe, 00000003.00000003.2333508822.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#loggerNameMismatch
Source: java.exe, 00000003.00000003.2230597536.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2485998485.0000000014F02000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230292297.0000000014ED3000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2386357338.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333508822.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#loggerNameMismatch%
Source: java.exe, 00000003.00000003.2333508822.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#multiple_bindings
Source: java.exe, 00000003.00000003.2230597536.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2485998485.0000000014F02000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230292297.0000000014ED3000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2386357338.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333508822.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#multiple_bindings8a
Source: java.exe, 00000003.00000002.2479550233.00000000099F9000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333508822.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2334058402.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2485998485.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#noProviders
Source: java.exe, 00000003.00000003.2230597536.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2485998485.0000000014F02000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230292297.0000000014ED3000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2386357338.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333508822.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#noProviders-
Source: java.exe, 00000003.00000003.2386544171.0000000014FA7000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2386116401.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230126094.0000000014FCF000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.00000000099F9000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2228710493.0000000014FB7000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2485998485.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333454197.0000000014FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#replay
Source: java.exe, 00000003.00000003.2386116401.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230465145.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230630449.0000000014F85000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2229455839.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333508822.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2334058402.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2485998485.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#replay/h
Source: java.exe, java.exe, 00000003.00000003.2230597536.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2386544171.0000000014FA7000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2386116401.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230126094.0000000014FCF000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2485998485.0000000014F02000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230292297.0000000014ED3000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2479550233.00000000099F9000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.2228710493.0000000014FB7000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2386357338.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2485998485.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333454197.0000000014FC7000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333508822.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#substituteLogger
Source: java.exe, 00000003.00000003.2386544171.0000000014FA7000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2386116401.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2230126094.0000000014FCF000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2228710493.0000000014FB7000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2485998485.0000000014F6A000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2333454197.0000000014FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#substituteLoggerS
Source: java.exe, 00000003.00000003.2333508822.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#unsuccessfulInit
Source: java.exe, 00000003.00000003.2333508822.0000000014EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#version_mismatch

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1634F70D	3_3_1634F70D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1634F70D	3_3_1634F70D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_16349749	3_3_16349749
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_16349749	3_3_16349749
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_163475CF	3_3_163475CF
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1634F70D	3_3_1634F70D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1634F70D	3_3_1634F70D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_16349749	3_3_16349749
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_16349749	3_3_16349749
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_163475CF	3_3_163475CF
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_2_65B3E5F9	3_2_65B3E5F9
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_2_65B88520	3_2_65B88520
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_2_65B4A4B0	3_2_65B4A4B0
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_2_65B2C4D0	3_2_65B2C4D0

Source: sqlitejdbc.dll0.0.dr

Static PE information: Number of sections : 11 > 10

Source: classification engine

Classification label: mal92.troj.spyw.expl.winJAR@138/682@15/11

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8712:120:WilError_03
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8460:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7736:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8312:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6612:120:WilError_03

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user

Jump to behavior

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "brave.exe")
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR

Source: C:\Windows\System32\7za.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: java.exe, java.exe, 00000003.00000002.2489583873.0000000065BC4000.00000002.00000001.01000000.00000009.sdmp, sqlitejdbc.dll.0.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: java.exe, 00000003.00000002.2489583873.0000000065BC4000.00000002.00000001.01000000.00000009.sdmp, sqlitejdbc.dll.0.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: java.exe, java.exe, 00000003.00000002.2489583873.0000000065BC4000.00000002.00000001.01000000.00000009.sdmp, sqlitejdbc.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: java.exe, java.exe, 00000003.00000002.2489583873.0000000065BC4000.00000002.00000001.01000000.00000009.sdmp, sqlitejdbc.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: java.exe, java.exe, 00000003.00000002.2489583873.0000000065BC4000.00000002.00000001.01000000.00000009.sdmp, sqlitejdbc.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: java.exe, java.exe, 00000003.00000002.2489583873.0000000065BC4000.00000002.00000001.01000000.00000009.sdmp, sqlitejdbc.dll.0.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: java.exe, java.exe, 00000003.00000002.2489583873.0000000065BC4000.00000002.00000001.01000000.00000009.sdmp, sqlitejdbc.dll.0.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: java.exe	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zerobl
Source: java.exe, java.exe, 00000003.00000002.2489583873.0000000065BC4000.00000002.00000001.01000000.00000009.sdmp, sqlitejdbc.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: java.exe, 00000003.00000002.2489583873.0000000065BC4000.00000002.00000001.01000000.00000009.sdmp, sqlitejdbc.dll.0.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: java.exe, 00000003.00000003.2297881452.0000000015C1D000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.2297356430.0000000015C1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\stealer.jar"
Source: C:\Windows\System32\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe java.exe -jar "C:\Users\user\Desktop\stealer.jar" 0.0.0.1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=1920 --field-trial-handle=2148,i,12070127069624648540,5385592187411481147,262144 --disable-features=PaintHolding /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --noerrdialogs --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2100 --field-trial-handle=1984,i,12352310552584826445,11484031828242325861,262144 --disable-features=PaintHolding /prefetch:3
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory=Default
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2068 --field-trial-handle=2016,i,11737991082838628297,17630950509741582629,262144 --disable-features=PaintHolding /prefetch:8
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption /value
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory=Default	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2100 --field-trial-handle=1984,i,12352310552584826445,11484031828242325861,262144 --disable-features=PaintHolding /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption /value	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory=Default
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=1920 --field-trial-handle=2148,i,12070127069624648540,5385592187411481147,262144 --disable-features=PaintHolding /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2100 --field-trial-handle=1984,i,12352310552584826445,11484031828242325861,262144 --disable-features=PaintHolding /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2068 --field-trial-handle=2016,i,11737991082838628297,17630950509741582629,262144 --disable-features=PaintHolding /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Windows\System32\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: opengl32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: glu32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll

Source: C:\Windows\SysWOW64\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Google Drive.lnk.25.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.25.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.25.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.25.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.25.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.25.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: stealer.jar

Static file information: File size 14451944 > 1048576

Source: sqlitejdbc.dll0.0.dr

Static PE information: 0xA488A460 [Fri Jun 22 06:53:20 2057 UTC]

Source: sqlitejdbc.dll0.0.dr	Static PE information: section name: .xdata
Source: jnidispatch.dll1.0.dr	Static PE information: section name: _RDATA

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1634C105 push 00000010h; ret	3_3_1634C10C
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1634C105 push 00000010h; ret	3_3_1634C10C
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1634C173 push 00000010h; ret	3_3_1634C188
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1634C173 push 00000010h; ret	3_3_1634C188
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1504A670 push eax; retf	3_3_1504A671
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1504A670 push eax; retf	3_3_1504A671
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1504B298 push edi; iretd	3_3_1504B299
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1504B298 push edi; iretd	3_3_1504B299
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_14F263EF push dword ptr [eax+3Ch]; ret	3_3_14F263F6
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1504A670 push eax; retf	3_3_1504A671
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1504A670 push eax; retf	3_3_1504A671
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1504B298 push edi; iretd	3_3_1504B299
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1504B298 push edi; iretd	3_3_1504B299
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1634C105 push 00000010h; ret	3_3_1634C10C
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1634C105 push 00000010h; ret	3_3_1634C10C
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1634C173 push 00000010h; ret	3_3_1634C188
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_1634C173 push 00000010h; ret	3_3_1634C188
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 3_3_14FAC338 push eax; ret	3_3_14FAC339

Persistence and Installation Behavior

Exploit detected, runtime environment dropped PE file

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

File created: jna7562946210787205297.dll.3.dr

Jump to dropped file

Source: C:\Windows\System32\7za.exe	File created: C:\jar\com\sun\jna\win32-x86\jnidispatch.dll	Jump to dropped file
Source: C:\Windows\System32\7za.exe	File created: C:\jar\org\sqlite\native\Windows\x86_64\sqlitejdbc.dll	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File created: C:\Users\user\AppData\Local\Temp\jna--1415050503\jna7562946210787205297.dll	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File created: C:\Users\user\AppData\Local\Temp\sqlite-3.20.1-d81bd20b-11da-4deb-8d5d-417baa2dfede-sqlitejdbc.dll	Jump to dropped file
Source: C:\Windows\System32\7za.exe	File created: C:\jar\org\sqlite\native\Windows\x86\sqlitejdbc.dll	Jump to dropped file
Source: C:\Windows\System32\7za.exe	File created: C:\jar\com\sun\jna\win32-aarch64\jnidispatch.dll	Jump to dropped file
Source: C:\Windows\System32\7za.exe	File created: C:\jar\com\sun\jna\win32-x86-64\jnidispatch.dll	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\7za.exe	Dropped PE file which has not been started: C:\jar\com\sun\jna\win32-x86\jnidispatch.dll	Jump to dropped file
Source: C:\Windows\System32\7za.exe	Dropped PE file which has not been started: C:\jar\org\sqlite\native\Windows\x86_64\sqlitejdbc.dll	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\jna--1415050503\jna7562946210787205297.dll	Jump to dropped file
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sqlite-3.20.1-d81bd20b-11da-4deb-8d5d-417baa2dfede-sqlitejdbc.dll	Jump to dropped file
Source: C:\Windows\System32\7za.exe	Dropped PE file which has not been started: C:\jar\org\sqlite\native\Windows\x86\sqlitejdbc.dll	Jump to dropped file
Source: C:\Windows\System32\7za.exe	Dropped PE file which has not been started: C:\jar\com\sun\jna\win32-aarch64\jnidispatch.dll	Jump to dropped file
Source: C:\Windows\System32\7za.exe	Dropped PE file which has not been started: C:\jar\com\sun\jna\win32-x86-64\jnidispatch.dll	Jump to dropped file

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

API coverage: 4.1 %

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Code function: 3_2_65B23730 GetSystemInfo,

3_2_65B23730

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\AppData\Local\Temp\jna--1415050503\jna7562946210787205297.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\AppData\Local\Temp\jna--1415050503\	Jump to behavior

Source: edge_tempfile.db.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: edge_tempfile.db.3.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: edge_tempfile.db.3.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: HOSTNAME.EXE, 0000001F.00000002.2304755060.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllww\|c
Source: edge_tempfile.db.3.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: java.exe, 00000003.00000002.2472532885.000000000097B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: edge_tempfile.db.3.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: java.exe, 00000003.00000003.2176258185.0000000014867000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: edge_tempfile.db.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: java.exe, 00000003.00000002.2472532885.000000000097B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cjava/lang/VirtualMachineError
Source: edge_tempfile.db.3.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: edge_tempfile.db.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: edge_tempfile.db.3.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: java.exe, 00000003.00000003.2176258185.0000000014867000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK
Source: edge_tempfile.db.3.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: HOSTNAME.EXE, 00000025.00000002.2308243827.0000000002B80000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000031.00000002.2365166868.00000000027A0000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000045.00000002.2422140658.00000000032D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll`
Source: edge_tempfile.db.3.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: edge_tempfile.db.3.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: edge_tempfile.db.3.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: edge_tempfile.db.3.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: edge_tempfile.db.3.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: java.exe, 00000003.00000002.2472532885.000000000097B000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 0000001D.00000002.2299203059.0000000002C1B000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000021.00000002.2305325031.000000000314B000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000023.00000002.2306540848.00000000030C8000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000027.00000002.2311148836.000000000297B000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000029.00000002.2359437177.0000000002D9B000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 0000002B.00000002.2363319880.000000000329B000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 0000002D.00000002.2362449705.0000000003498000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000033.00000002.2365525974.00000000027AB000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000035.00000002.2366420257.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, HOSTNAME.EXE, 00000037.00000002.2367171322.00000000033A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: HOSTNAME.EXE, 0000002F.00000002.2364034491.0000000003108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllww
Source: edge_tempfile.db.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: edge_tempfile.db.3.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: edge_tempfile.db.3.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: edge_tempfile.db.3.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: java.exe, 00000003.00000003.2176258185.0000000014867000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: edge_tempfile.db.3.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: edge_tempfile.db.3.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: java.exe, 00000003.00000003.2176258185.0000000014867000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: edge_tempfile.db.3.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: edge_tempfile.db.3.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: edge_tempfile.db.3.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: edge_tempfile.db.3.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: edge_tempfile.db.3.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: edge_tempfile.db.3.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: edge_tempfile.db.3.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: edge_tempfile.db.3.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: edge_tempfile.db.3.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: edge_tempfile.db.3.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\7za.exe

File opened: C:\jar\com\sun\jna\platform\FileMonitor$Holder.class

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Code function: 3_3_14F1F6CA LdrInitializeThunk,LdrInitializeThunk,

3_3_14F1F6CA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory=Default	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2100 --field-trial-handle=1984,i,12352310552584826445,11484031828242325861,262144 --disable-features=PaintHolding /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption /value	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\180 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\edgecookies.txt VolumeInformation	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Can Stealer

Source: Yara match

File source: Process Memory Space: java.exe PID: 180, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Source: Yara match

File source: Process Memory Space: java.exe PID: 180, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Exploitation for Client Execution	1 Services File Permissions Weakness	1 Registry Run Keys / Startup Folder	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Services File Permissions Weakness	11 Disable or Modify Tools	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	14 System Information Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Services File Permissions Weakness	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	4 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\jna--1415050503\jna7562946210787205297.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\sqlite-3.20.1-d81bd20b-11da-4deb-8d5d-417baa2dfede-sqlitejdbc.dll	0%	ReversingLabs
C:\jar\com\sun\jna\aix-ppc64\libjnidispatch.a	0%	ReversingLabs
C:\jar\com\sun\jna\aix-ppc\libjnidispatch.a	0%	ReversingLabs
C:\jar\com\sun\jna\win32-aarch64\jnidispatch.dll	0%	ReversingLabs
C:\jar\com\sun\jna\win32-x86-64\jnidispatch.dll	0%	ReversingLabs
C:\jar\com\sun\jna\win32-x86\jnidispatch.dll	0%	ReversingLabs
C:\jar\org\sqlite\native\Windows\x86\sqlitejdbc.dll	0%	ReversingLabs
C:\jar\org\sqlite\native\Windows\x86_64\sqlitejdbc.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.chambersign.org/chambersroot.crl0	0%	Avira URL Cloud	safe
https://canstealer.com/micrort2s	100%	Avira URL Cloud	malware
https://repository.luxtrust.lu	0%	Avira URL Cloud	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	Avira URL Cloud	safe
http://policy.camerfirma.com0	0%	Avira URL Cloud	safe
https://canstealer.com/micrort2	100%	Avira URL Cloud	malware
http://www.chambersign.org	0%	Avira URL Cloud	safe
https://canstealer.com	100%	Avira URL Cloud	malware
http://policy.camerfirma.com	0%	Avira URL Cloud	safe
https://ocsp.quovadisoffshore.com0	0%	Avira URL Cloud	safe
https://canstealer.com/micrort2sD	100%	Avira URL Cloud	malware
https://canstealer.com/	100%	Avira URL Cloud	malware
http://cps.chambersign.org/cps/chambersroot.html	0%	Avira URL Cloud	safe
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
http://crl.chambersign.org/chambersroot.crl	0%	Avira URL Cloud	safe
http://www.quovadis.bm	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
canstealer.com	172.67.191.110	true	false	unknown
plus.l.google.com	172.217.17.46	true	false	high
play.google.com	172.217.19.206	true	false	high
raw.githubusercontent.com	185.199.111.133	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
www.google.com	142.250.181.132	true	false	high
api.telegram.org	149.154.167.220	true	false	high
api.gofile.io	45.112.123.126	true	false	high
bzib.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.206	play.google.com	United States	15169	GOOGLEUS	false
172.67.191.110	canstealer.com	United States	13335	CLOUDFLARENETUS	false
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
185.199.111.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
45.112.123.126	api.gofile.io	Singapore	16509	AMAZON-02US	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576991
Start date and time:	2024-12-17 20:39:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsfilecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Without Tracing
Number of analysed new started processes analysed:	71
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	stealer.jar
Detection:	MAL
Classification:	mal92.troj.spyw.expl.winJAR@138/682@15/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 5 Number of non-executed functions: 24
Cookbook Comments:	Found application associated with file extension: .jar

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	dP5z8RpEyQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Ls4O6Pmixd.exe	Get hash	malicious	Phemedrone Stealer	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
239.255.255.250	Remit_Advice_SMKT_84655.htm	Get hash	malicious	Unknown	Browse
	https://ce4.ajax.a8b.co/get?redir=1&id=d4vCW7zizPl1mo0GYx0ELgo+CCIybH9/c4qC7CeWEuI=&uri=//the-western-fire-chiefs-association.jimdosite.com	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	Payment_Failure_Notice_Office365_sdf_[53487].html	Get hash	malicious	HTMLPhisher	Browse
	http://kmaybelsrka.sbs:6793/bab.zip	Get hash	malicious	Unknown	Browse
	https://garfieldthecat.tech/Receipt.html	Get hash	malicious	WinSearchAbuse	Browse
	https://gddesign.joydigitalhost.com/dcs/ms_doc.html	Get hash	malicious	Unknown	Browse
	http://login.precisestripngllc.com	Get hash	malicious	Unknown	Browse
	http://sharefileon.com	Get hash	malicious	Unknown	Browse
185.199.111.133	cr_asm2.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	mjjt5kTb4o.lnk	Get hash	malicious	Unknown	Browse	185.199.108.133
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	185.199.108.133
	uZgbejeJkT.bat	Get hash	malicious	Unknown	Browse	185.199.108.133
	ni2OwV1y9u.bat	Get hash	malicious	Unknown	Browse	185.199.108.133
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	185.199.109.133
	GdGXG0bnxH.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	LaRHzSijsq.exe	Get hash	malicious	DCRat	Browse	185.199.109.133
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	185.199.109.133
	c56uoWlDXp.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
canstealer.com	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse	104.21.76.84
canstealer.com	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse	104.21.76.84
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	IIC0XbKFjS.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	873406390.bat	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	0J3fAc6cHO.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	69633f.msi	Get hash	malicious	Vidar	Browse	94.245.104.56
	cey4VIyGKh.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	dZKPE9gotO.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	nB52P46OJD.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	94.245.104.56
plus.l.google.com	https://6movies.stream/series/cobra-kai-80711/6-4/	Get hash	malicious	Unknown	Browse	142.250.181.78
	https://flusoprano.com/f/4/0/f24b0aaf975ee65a83aae9b19316ec90.js	Get hash	malicious	Unknown	Browse	172.217.17.46
	V65xPrgEHH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.46
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	172.217.17.46
	FINAL000035745873695487KHFKA.pdf	Get hash	malicious	HTMLPhisher	Browse	172.217.17.46
	https://qrs.ly/gggdyxx	Get hash	malicious	Unknown	Browse	142.250.181.78
	https://iwr.soundestlink.com/ce/c/676002d8893d08b60d0548a9/67600e317a8dc234ff2c418f/67600e4e1033e9cdafe04236?signature=d71ee5ef2af4c3905acd300a8f3b595d0164d440b8def5e7254a839fa6b579a9	Get hash	malicious	Unknown	Browse	142.250.181.78
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	172.217.17.46
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.46
	http://minimalfreaks.co	Get hash	malicious	HTMLPhisher	Browse	142.250.181.78

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.842186055004734
Encrypted:	false
SSDEEP:	3:oFj4I5vpm4USURRyT:oJ5bIRyT
MD5:	E95F960AFD4B6DAD8B12FA94CAADB538
SHA1:	2EAB9AB403F8EDB954382AA660009D42A6394523
SHA-256:	CEDA01B66BBD550BB82779963D12BC9AE75EDEC8DB5D1D156548802FA3E8EEB9
SHA-512:	4180308EB59B8DEA5F9961E9A4543A5B71F7F0E0C5B76D81E5322DB85C7B9EE4B0FDC6AF227BE6FC505F6F28B2CE7E70C08E8E8318CB065BF46C92C493D9C242
Malicious:	false
Preview:	C:\Program Files (x86)\Java\jre-1.8..1734464445038..

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090761167976063
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMiwuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEY6Ntbz8hu3VlXr4CRo1
MD5:	3DB54B305A3A178758FE81C2C9CA98B8
SHA1:	07DF02FB6FB5C4C84DCDB6EF318D11F544E142A4
SHA-256:	681B7D868806D5E6796516B52373C797B909021FE84DDB53283D4EFBBEF39FBA
SHA-512:	27BA2F160A3886B1C1A1157FBADDD3897505539448A2AECC88F746F3A6F98B4631C72F790D0A2321F55A7F406AC48BDFFADE4694509C5B0C4CDE73C2D572171A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 18:40:55 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2821
Entropy (8bit):	3.976601014069965
Encrypted:	false
SSDEEP:	48:8adBTpxSH8idAKZdA9Nmee3ehwiZUklqeh+y+3:8M3hNmhy
MD5:	2917A78C65EF3DB450398FC248677D21
SHA1:	8C0C7BC8F8ADE51ED5BE4D0658CEDCEB526003FE
SHA-256:	7E72163481C69313CCBDD05931A0DA4B532408343115902609D55ABDBD257B00
SHA-512:	55AEDFA5C278A072E07EC9385FC8D9957E1E1A7E7F2FB5595D442C490E9F66D4358061BD91FD86CE68FC269ED344C82E37A4FEC8BC56E513F0A1C3F5DE045A14
Malicious:	false
Preview:	L..................F.@.. ...$+.,....2..P..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............{D.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n..

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10174
Entropy (8bit):	4.3908324771089084
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
MD5:	2EE41112A44FE7014DCE33E26468BA93
SHA1:	598F87F072F66E2269DD6919292B2934DBB20492
SHA-256:	0D542E0C8804E39AA7F37EB00DA5A762149DC682D7829451287E11B938E94594
SHA-512:	27B8C0252EAE50CA3CE02AB7C5670664C0C824E03EB3DA1089F3F0A00D23E648A956BCB9F53645C6D79674A87C4CC86D1085DC335911BE0210D691336B121857
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

File type:	Java archive data (JAR)
Entropy (8bit):	7.976075943741411
TrID:	Java Archive (13504/1) 62.80% ZIP compressed archive (8000/1) 37.20%
File name:	stealer.jar
File size:	14'451'944 bytes
MD5:	04355af832d9de466eeccb977222e3b8
SHA1:	54dc82c0d8d7affc31de7181edd6801082679c54
SHA256:	06bdd2aa3540a9b2dabe9a827fcb79a2019982075937376f67de0f755d55eaf8
SHA512:	d1e377b7c93c024bc2d842b71da2391f66f9808c2e67d20dcaebaac6cbc6b414bcba3e4fa5313012e08c9afb900d0d8de8d05000ccfef7218bf004ac37946583
SSDEEP:	393216:RiRuh4V2jiPZ1AWxTqVsJ+aUTyliJl44UkIXDYvdnYdgsH:RiTVuiB1zpuE+abI44hvdnoZ
TLSH:	62E61222AE99C82DFE9764B261D28552E03B16DAC803E06F46B057D6DEF2D450353FEC
File Content Preview:	PK........\H.Y............2...org/apache/commons/codec/language/bm/Rule$1.class/.....TmO.`.=W...l....S...(( :@e.N.1bP?..@M.6.F4..d........G......!..nI..g=......_...L.H.....:...+.]*.V....).jmT..]Y+)...>0.....,.....h.........uA.....`.j.0..M.,.......T\....7.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 20:40:50.397041082 CET	54446	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:40:50.398196936 CET	55191	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:40:50.539503098 CET	53	55191	1.1.1.1	192.168.2.5
Dec 17, 2024 20:40:52.683304071 CET	52681	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:40:52.683442116 CET	64081	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:40:54.682446957 CET	53	56733	1.1.1.1	192.168.2.5
Dec 17, 2024 20:40:54.779352903 CET	53	60307	1.1.1.1	192.168.2.5
Dec 17, 2024 20:40:54.860518932 CET	49359	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:40:54.860671043 CET	53934	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:40:54.997363091 CET	53	49359	1.1.1.1	192.168.2.5
Dec 17, 2024 20:40:54.998155117 CET	53	53934	1.1.1.1	192.168.2.5
Dec 17, 2024 20:40:57.519475937 CET	53	60520	1.1.1.1	192.168.2.5
Dec 17, 2024 20:40:58.494338036 CET	53	56015	1.1.1.1	192.168.2.5
Dec 17, 2024 20:40:59.752329111 CET	53	62979	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:00.347029924 CET	61609	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:41:00.485066891 CET	53	61609	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:01.665932894 CET	52675	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:41:01.666083097 CET	59725	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:41:01.804259062 CET	53	52675	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:01.804745913 CET	53	57642	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:01.806468964 CET	53	59725	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:02.688769102 CET	59392	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:41:02.688925982 CET	49227	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:41:02.826663971 CET	53	59392	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:02.827470064 CET	53	49227	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:02.959247112 CET	56635	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:41:03.097170115 CET	53	56635	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:12.858499050 CET	59143	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:41:13.003802061 CET	53	59143	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:14.351546049 CET	50628	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:41:14.490170956 CET	53	50628	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:14.683013916 CET	53	53167	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:29.616076946 CET	52142	53	192.168.2.5	1.1.1.1
Dec 17, 2024 20:41:29.755105972 CET	53	52142	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:33.550976992 CET	53	57325	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:54.541073084 CET	53	60391	1.1.1.1	192.168.2.5
Dec 17, 2024 20:41:56.626483917 CET	53	62383	1.1.1.1	192.168.2.5
Dec 17, 2024 20:42:27.058741093 CET	53	55485	1.1.1.1	192.168.2.5

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 20:40:50.534257889 CET	1.1.1.1	192.168.2.5	0xf596	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 20:40:50.539503098 CET	1.1.1.1	192.168.2.5	0x6673	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 20:40:50.858591080 CET	1.1.1.1	192.168.2.5	0x2b41	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 20:40:50.858591080 CET	1.1.1.1	192.168.2.5	0x2b41	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:40:51.088232994 CET	1.1.1.1	192.168.2.5	0x4f16	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 20:40:52.913459063 CET	1.1.1.1	192.168.2.5	0x8897	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 20:40:52.914994001 CET	1.1.1.1	192.168.2.5	0xa712	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 20:40:54.997363091 CET	1.1.1.1	192.168.2.5	0x4acf	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:40:54.998155117 CET	1.1.1.1	192.168.2.5	0x28a9	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 17, 2024 20:41:00.485066891 CET	1.1.1.1	192.168.2.5	0x9858	No error (0)	api.gofile.io		45.112.123.126	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:41:01.804259062 CET	1.1.1.1	192.168.2.5	0xabd4	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 20:41:01.804259062 CET	1.1.1.1	192.168.2.5	0xabd4	No error (0)	plus.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:41:01.806468964 CET	1.1.1.1	192.168.2.5	0xaf54	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 20:41:02.826663971 CET	1.1.1.1	192.168.2.5	0x93a9	No error (0)	play.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:41:03.097170115 CET	1.1.1.1	192.168.2.5	0x4bd4	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:41:13.003802061 CET	1.1.1.1	192.168.2.5	0xa3b0	No error (0)	canstealer.com		172.67.191.110	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:41:13.003802061 CET	1.1.1.1	192.168.2.5	0xa3b0	No error (0)	canstealer.com		104.21.76.84	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:41:14.490170956 CET	1.1.1.1	192.168.2.5	0x2525	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:41:14.490170956 CET	1.1.1.1	192.168.2.5	0x2525	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:41:14.490170956 CET	1.1.1.1	192.168.2.5	0x2525	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:41:14.490170956 CET	1.1.1.1	192.168.2.5	0x2525	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:41:29.755105972 CET	1.1.1.1	192.168.2.5	0xeb18	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:41:29.755105972 CET	1.1.1.1	192.168.2.5	0xeb18	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:41:29.755105972 CET	1.1.1.1	192.168.2.5	0xeb18	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 17, 2024 20:41:29.755105972 CET	1.1.1.1	192.168.2.5	0xeb18	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-17 19:40:56 UTC	623	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 19:40:57 UTC	1219	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 19:40:57 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-QQjNZIm7oOJpZ2IOWH0l4A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/web Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/web"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-17 19:40:57 UTC	171	IN	Data Raw: 61 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 5d 2c 5b 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 65 76 65 6e 74 69 64 22 3a 36 37 33 32 35 39 37 39 32 32 34 38 31 33 31 36 32 33 34 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: a5)]}'["",[],[],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggesteventid":6732597922481316234,"google:suggesttype":[],"google:verbatimrelevance":851}]
2024-12-17 19:40:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-12-17 19:40:56 UTC	526	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 19:40:57 UTC	973	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 17 Dec 2024 19:40:57 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-17 19:40:57 UTC	417	IN	Data Raw: 32 39 35 34 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2954)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-17 19:40:57 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 33 20 31 38 68 31 38 76 2d 32 48 33 76 32 7a 6d 30 2d 35 68 31 38 76 2d 32 48 33 76 32 7a 6d 30 2d 37 76 32 68 31 38 Data Ascii: ss\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18
2024-12-17 19:40:57 UTC	1390	IN	Data Raw: 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 41 64 20 67 62 5f 6c 64 20 67 62 5f 4b 65 20 67 62 5f 46 65 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 Data Ascii: e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_Ad gb_ld gb_Ke gb_Fe\"\u003e\u003c
2024-12-17 19:40:57 UTC	1390	IN	Data Raw: 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 38 2e 35 2d 32 31 2e 35 54 33 35 30 2d 38 34 30 68 32 36 30 71 31 33 20 30 20 32 31 2e 35 20 38 2e 35 54 36 34 30 2d 38 31 30 71 30 20 Data Ascii: ght\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13 8.5-21.5T350-840h260q13 0 21.5 8.5T640-810q0
2024-12-17 19:40:57 UTC	1390	IN	Data Raw: 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 5c 22 5c 75 30 30 Data Ascii: ,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2z\"\u00
2024-12-17 19:40:57 UTC	1390	IN	Data Raw: 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 32 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 2c 31 30 32 32 37 38 32 30 38 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f 2e 78 64 5c 75 30 30 33 64 66 75 6e 63 74 69 Data Ascii: eriment_id":[3700312,3701384,102278205,102278208],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis;\ntry{\n_.xd\u003dfuncti
2024-12-17 19:40:57 UTC	1390	IN	Data Raw: 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 46 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 48 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 49 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d Data Ascii: d++)c[d]\u003da[d];return c}return[]};Gd\u003dfunction(a){return new _.Fd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Hd\u003dglobalThis.trustedTypes;_.Id\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}
2024-12-17 19:40:57 UTC	1390	IN	Data Raw: 69 6f 6e 28 61 29 7b 69 66 28 57 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 59 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 58 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e Data Ascii: ion(a){if(Wd.test(a))return a};_.Yd\u003dfunction(a){if(a instanceof _.Id)if(a instanceof _.Id)a\u003da.i;else throw Error(\"F\");else a\u003d_.Xd(a);return a};_.Zd\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.documen
2024-12-17 19:40:57 UTC	441	IN	Data Raw: 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 79 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c Data Ascii: 003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.ke\u003dfunction(a,b){_.yb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\
2024-12-17 19:40:57 UTC	289	IN	Data Raw: 31 31 61 0d 0a 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 78 4c 65 6e 67 74 68 5c 22 2c 6e 6f 6e 63 65 3a 5c 22 6e 6f 6e 63 65 5c 22 2c 72 6f 6c 65 3a 5c 22 72 6f 6c 65 5c 22 2c 72 6f 77 73 70 61 6e 3a 5c 22 72 6f 77 53 70 61 6e 5c 22 2c 74 79 70 65 3a 5c 22 74 79 70 65 5c 22 2c 75 73 65 6d 61 70 3a 5c 22 75 73 65 4d 61 70 5c 22 2c 76 61 6c 69 67 6e 3a 5c 22 76 41 6c 69 67 6e 5c 22 2c 77 69 64 74 68 3a 5c 22 77 69 64 74 68 5c 22 7d 3b 5c 6e 5f 2e 6c 65 5c 75 30 30 33 64 66 75 6e Data Ascii: 11acellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"maxLength\",nonce:\"nonce\",role:\"role\",rowspan:\"rowSpan\",type:\"type\",usemap:\"useMap\",valign:\"vAlign\",width:\"width\"};\n_.le\u003dfun

Timestamp	Bytes transferred	Direction	Data
2024-12-17 19:40:56 UTC	361	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 19:40:57 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 17 Dec 2024 19:40:57 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-17 19:40:57 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-17 19:40:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-12-17 19:41:04 UTC	734	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 925 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 19:41:04 UTC	925	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 34 34 36 34 34 36 30 32 31 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1734464460212",null,null,null,
2024-12-17 19:41:05 UTC	918	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=520=ZTkugL_meSlznipJOcs0BMUBC5JapHPfn_RNKyGmUXwdooBTE9jZ9G6JjdjyRmUj0Tc-WsdSSIkRXY6hR7FeEa0iX9nDGTQz2Ava60xwJryi9yNYj4Ztufu92XrB5XPtVNsE2fH5l9QFPxoMlR0dKQT1CBA8ADJu8xuzjo3Uej9s5wTeC21FQaQ; expires=Wed, 18-Jun-2025 19:41:04 GMT; path=/; domain=.google.com; HttpOnly P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 17 Dec 2024 19:41:04 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 17 Dec 2024 19:41:04 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-12-17 19:41:05 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-17 19:41:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report stealer.jar

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

C:\Users\user\AppData\Local\Microsoft\675052.zip

C:\Users\user\AppData\Local\Microsoft\675052\Game\craftrise.txt

C:\Users\user\AppData\Local\Microsoft\675052\Game\sonoyuncu.txt

C:\Users\user\AppData\Local\Microsoft\675052\screenshot.png

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\27c9ff8e-77b0-48cc-89cf-a645a913dbde.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6761D3BE-14BC.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\21fd9954-0ff1-4958-bc04-53cbbd69ee97.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Windows Analysis Report
stealer.jar

Timestamp	Bytes transferred	Direction	Data
2024-12-17 19:41:09 UTC	935	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 931 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=ZTkugL_meSlznipJOcs0BMUBC5JapHPfn_RNKyGmUXwdooBTE9jZ9G6JjdjyRmUj0Tc-WsdSSIkRXY6hR7FeEa0iX9nDGTQz2Ava60xwJryi9yNYj4Ztufu92XrB5XPtVNsE2fH5l9QFPxoMlR0dKQT1CBA8ADJu8xuzjo3Uej9s5wTeC21FQaQ
2024-12-17 19:41:09 UTC	931	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 34 34 36 34 34 36 35 34 38 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1734464465482",null,null,null,
2024-12-17 19:41:10 UTC	926	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=520=L7ekwYXfQyjUY9qh7C3yYyDo_JDuUeo_lGhtoN0_U4rl-SB2NK3gc6AyWBxIckONE_7hz-SFyob3u4uN-mDqggbnOEfv3E2L6jpwX0RCMyC2GsV-ztJUdSGY9pqu_nYZsrt5XVkzIVxT12qpY_KG1JofuGfCKq-9gGqrYNAyrz98KDH5EjUo36eJVznVXH4; expires=Wed, 18-Jun-2025 19:41:10 GMT; path=/; domain=.google.com; HttpOnly P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 17 Dec 2024 19:41:10 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 17 Dec 2024 19:41:10 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-12-17 19:41:10 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-17 19:41:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:40:36
Start date:	17/12/2024
Path:	C:\Windows\System32\7za.exe
Wow64 process (32bit):	true
Commandline:	7za.exe x -y -oC:\jar "C:\Users\user\Desktop\stealer.jar"
Imagebase:	0xce0000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	14:40:37
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	14:40:44
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
Wow64 process (32bit):	true
Commandline:	java.exe -jar "C:\Users\user\Desktop\stealer.jar" 0.0.0.1
Imagebase:	0x10000
File size:	257'664 bytes
MD5 hash:	9DAA53BAB2ECB33DC0D9CA51552701FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	14:40:45
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Imagebase:	0xba0000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	14:40:46
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	14:40:47
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2100 --field-trial-handle=1984,i,12352310552584826445,11484031828242325861,262144 --disable-features=PaintHolding /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	14:40:51
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe
Imagebase:	0x8f0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	25
Start time:	14:40:52
Start date:	17/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory=Default
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	27
Start time:	14:40:56
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe
Imagebase:	0x8f0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true