File name:

11.1.jar

Full analysis: https://app.any.run/tasks/f49d869e-91ae-4c39-ba63-59bc24b5a8e9
Verdict: Malicious activity
Analysis date: February 25, 2020, 13:00:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

5505EC151916D81CE0B065926DFE8005

SHA1:

FFC51A2A73F0C230856BCA0BE0E3675652EF3E92

SHA256:

63D05D8545F0604EC104DFF8E07F889D1A15CCFEF10A3C65B1A7C73DF02FF8EA

SSDEEP:

6144:FQu7BUkU8Xwat1+OIiYid4yaqM4z5li2NXocOKU95SNWpw8OFHVZfWAoynHv+Edb:ZtrUmzt1ZI3mq4zPi2BRUCWpwzF1Eynl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 3368)
      • svchost.exe (PID: 796)
      • explorer.exe (PID: 372)
      • SearchProtocolHost.exe (PID: 3548)

    • Changes Image File Execution Options

      • reg.exe (PID: 3052)
      • reg.exe (PID: 1712)
      • reg.exe (PID: 2592)
      • reg.exe (PID: 3424)
      • reg.exe (PID: 2540)
      • reg.exe (PID: 576)
      • reg.exe (PID: 2580)
      • reg.exe (PID: 3528)
      • reg.exe (PID: 3316)
      • reg.exe (PID: 3332)

    • Application was dropped or rewritten from another process

      • javaw.exe (PID: 3368)

    • Disables Windows Defender

      • reg.exe (PID: 1836)
      • reg.exe (PID: 4040)
      • reg.exe (PID: 3848)
      • reg.exe (PID: 4068)

    • Runs app for hidden code execution

      • javaw.exe (PID: 3368)

    • Changes the autorun value in the registry

      • javaw.exe (PID: 3368)

  • SUSPICIOUS

    • Executes JAVA applets

      • explorer.exe (PID: 372)

    • Uses WMIC.EXE to obtain a list of Firewalls

      • cmd.exe (PID: 2836)

    • Uses WMIC.EXE to obtain a list of AntiViruses

      • cmd.exe (PID: 2876)

    • Uses WMIC.EXE to obtain a system information

      • cmd.exe (PID: 2876)
      • cmd.exe (PID: 3800)
      • cmd.exe (PID: 2836)

    • Executable content was dropped or overwritten

      • javaw.exe (PID: 3368)

    • Creates files in the user directory

      • javaw.exe (PID: 3368)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3556)
      • cmd.exe (PID: 4052)
      • cmd.exe (PID: 2824)
      • cmd.exe (PID: 3740)
      • cmd.exe (PID: 2828)
      • cmd.exe (PID: 3044)
      • cmd.exe (PID: 1352)
      • javaw.exe (PID: 3368)
      • cmd.exe (PID: 3872)
      • cmd.exe (PID: 3804)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 3304)
      • cmd.exe (PID: 3744)
      • cmd.exe (PID: 4080)
      • cmd.exe (PID: 4036)
      • cmd.exe (PID: 3852)
      • cmd.exe (PID: 2500)
      • cmd.exe (PID: 3220)
      • cmd.exe (PID: 2132)
      • cmd.exe (PID: 3356)
      • cmd.exe (PID: 1888)
      • cmd.exe (PID: 2064)
      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 3832)
      • cmd.exe (PID: 2740)
      • cmd.exe (PID: 2560)
      • cmd.exe (PID: 1500)
      • cmd.exe (PID: 2856)
      • cmd.exe (PID: 2424)
      • cmd.exe (PID: 1084)
      • cmd.exe (PID: 3428)
      • cmd.exe (PID: 3144)
      • cmd.exe (PID: 576)
      • cmd.exe (PID: 3576)
      • cmd.exe (PID: 3472)
      • cmd.exe (PID: 1136)
      • cmd.exe (PID: 3104)
      • cmd.exe (PID: 2660)
      • cmd.exe (PID: 4008)
      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 3816)
      • cmd.exe (PID: 3200)
      • cmd.exe (PID: 3284)
      • cmd.exe (PID: 2488)
      • cmd.exe (PID: 3296)
      • cmd.exe (PID: 3272)
      • cmd.exe (PID: 3588)
      • cmd.exe (PID: 1944)
      • cmd.exe (PID: 3248)
      • cmd.exe (PID: 3876)
      • cmd.exe (PID: 3608)
      • cmd.exe (PID: 3992)
      • cmd.exe (PID: 1740)
      • cmd.exe (PID: 1876)
      • cmd.exe (PID: 540)
      • cmd.exe (PID: 3820)
      • cmd.exe (PID: 3484)
      • cmd.exe (PID: 2956)
      • cmd.exe (PID: 2636)
      • cmd.exe (PID: 3100)
      • cmd.exe (PID: 564)
      • cmd.exe (PID: 3292)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 3968)
      • cmd.exe (PID: 1688)
      • cmd.exe (PID: 2892)
      • cmd.exe (PID: 2072)
      • cmd.exe (PID: 3452)
      • cmd.exe (PID: 2720)
      • cmd.exe (PID: 3088)
      • cmd.exe (PID: 3008)
      • cmd.exe (PID: 3840)
      • cmd.exe (PID: 3264)
      • cmd.exe (PID: 2288)
      • cmd.exe (PID: 3732)
      • cmd.exe (PID: 1024)
      • cmd.exe (PID: 2772)
      • cmd.exe (PID: 2732)
      • cmd.exe (PID: 1156)
      • cmd.exe (PID: 2688)
      • cmd.exe (PID: 3452)
      • cmd.exe (PID: 2340)
      • cmd.exe (PID: 2724)
      • cmd.exe (PID: 3488)
      • cmd.exe (PID: 340)
      • cmd.exe (PID: 2436)
      • cmd.exe (PID: 3344)
      • cmd.exe (PID: 2576)
      • cmd.exe (PID: 4020)
      • cmd.exe (PID: 3992)
      • cmd.exe (PID: 952)
      • cmd.exe (PID: 3360)
      • cmd.exe (PID: 1536)
      • cmd.exe (PID: 2128)
      • cmd.exe (PID: 2796)
      • cmd.exe (PID: 1912)
      • cmd.exe (PID: 3312)
      • cmd.exe (PID: 3068)
      • cmd.exe (PID: 2436)
      • cmd.exe (PID: 2756)
      • cmd.exe (PID: 3040)
      • cmd.exe (PID: 2728)
      • cmd.exe (PID: 2572)
      • cmd.exe (PID: 3076)
      • cmd.exe (PID: 3460)
      • cmd.exe (PID: 3888)
      • cmd.exe (PID: 3376)
      • cmd.exe (PID: 2452)
      • cmd.exe (PID: 660)
      • cmd.exe (PID: 3752)
      • cmd.exe (PID: 1256)
      • cmd.exe (PID: 1692)
      • cmd.exe (PID: 2940)
      • cmd.exe (PID: 3976)
      • cmd.exe (PID: 1744)
      • cmd.exe (PID: 2752)
      • cmd.exe (PID: 3972)
      • cmd.exe (PID: 2568)
      • cmd.exe (PID: 912)
      • cmd.exe (PID: 3020)
      • cmd.exe (PID: 620)
      • cmd.exe (PID: 3916)
      • cmd.exe (PID: 2244)
      • cmd.exe (PID: 3384)
      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 3580)
      • cmd.exe (PID: 2496)
      • cmd.exe (PID: 1832)
      • cmd.exe (PID: 3164)
      • cmd.exe (PID: 2348)
      • cmd.exe (PID: 2728)
      • cmd.exe (PID: 3456)
      • cmd.exe (PID: 1504)
      • cmd.exe (PID: 2588)
      • cmd.exe (PID: 1748)
      • cmd.exe (PID: 2484)
      • cmd.exe (PID: 2548)
      • cmd.exe (PID: 2336)
      • cmd.exe (PID: 2608)
      • cmd.exe (PID: 4840)
      • cmd.exe (PID: 5748)
      • cmd.exe (PID: 2120)
      • cmd.exe (PID: 5104)
      • cmd.exe (PID: 5936)
      • cmd.exe (PID: 4576)
      • cmd.exe (PID: 2184)
      • cmd.exe (PID: 5192)
      • cmd.exe (PID: 5044)
      • cmd.exe (PID: 5124)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 5552)
      • cmd.exe (PID: 4304)
      • cmd.exe (PID: 5580)
      • cmd.exe (PID: 5544)
      • cmd.exe (PID: 4684)
      • cmd.exe (PID: 4156)
      • cmd.exe (PID: 6036)
      • cmd.exe (PID: 5324)
      • cmd.exe (PID: 2884)
      • cmd.exe (PID: 4972)
      • cmd.exe (PID: 6008)
      • cmd.exe (PID: 4912)
      • cmd.exe (PID: 4232)
      • cmd.exe (PID: 3664)
      • cmd.exe (PID: 4328)
      • cmd.exe (PID: 4484)
      • cmd.exe (PID: 5744)
      • cmd.exe (PID: 5376)
      • cmd.exe (PID: 1156)
      • cmd.exe (PID: 2600)
      • cmd.exe (PID: 5128)

    • Connects to unusual port

      • javaw.exe (PID: 3368)

    • Searches for installed software

      • reg.exe (PID: 3872)
      • reg.exe (PID: 2692)
      • reg.exe (PID: 2988)
      • reg.exe (PID: 1488)
      • reg.exe (PID: 2356)
      • reg.exe (PID: 1488)
      • reg.exe (PID: 3884)
      • reg.exe (PID: 3200)
      • reg.exe (PID: 3276)
      • reg.exe (PID: 3012)
      • reg.exe (PID: 1504)
      • reg.exe (PID: 3316)
      • reg.exe (PID: 2580)
      • reg.exe (PID: 3300)
      • reg.exe (PID: 3600)
      • reg.exe (PID: 2056)
      • reg.exe (PID: 3984)
      • reg.exe (PID: 3484)
      • reg.exe (PID: 3488)
      • reg.exe (PID: 3584)
      • reg.exe (PID: 3400)
      • reg.exe (PID: 1844)
      • reg.exe (PID: 3576)
      • reg.exe (PID: 3820)
      • reg.exe (PID: 1928)
      • reg.exe (PID: 3776)
      • reg.exe (PID: 4056)
      • reg.exe (PID: 3068)
      • reg.exe (PID: 956)
      • reg.exe (PID: 2744)
      • reg.exe (PID: 2428)
      • reg.exe (PID: 2708)
      • reg.exe (PID: 772)
      • reg.exe (PID: 332)
      • reg.exe (PID: 2492)
      • reg.exe (PID: 3084)
      • reg.exe (PID: 2464)
      • reg.exe (PID: 3916)
      • reg.exe (PID: 2388)
      • reg.exe (PID: 2720)
      • reg.exe (PID: 3716)
      • reg.exe (PID: 2596)
      • reg.exe (PID: 1524)
      • reg.exe (PID: 3308)
      • reg.exe (PID: 3624)
      • reg.exe (PID: 2716)
      • reg.exe (PID: 4092)
      • reg.exe (PID: 1092)
      • reg.exe (PID: 3860)
      • reg.exe (PID: 2944)
      • reg.exe (PID: 3308)
      • reg.exe (PID: 272)
      • reg.exe (PID: 3756)
      • reg.exe (PID: 3100)
      • reg.exe (PID: 620)
      • reg.exe (PID: 3960)
      • reg.exe (PID: 1692)
      • reg.exe (PID: 2120)
      • reg.exe (PID: 3968)
      • reg.exe (PID: 3860)
      • reg.exe (PID: 2348)
      • reg.exe (PID: 3076)
      • reg.exe (PID: 2076)
      • reg.exe (PID: 2960)
      • reg.exe (PID: 3976)
      • reg.exe (PID: 3756)
      • reg.exe (PID: 2320)
      • reg.exe (PID: 2140)
      • reg.exe (PID: 3460)
      • reg.exe (PID: 3824)
      • reg.exe (PID: 956)
      • reg.exe (PID: 1536)
      • reg.exe (PID: 3420)
      • reg.exe (PID: 2880)
      • reg.exe (PID: 2564)
      • reg.exe (PID: 2904)
      • reg.exe (PID: 3384)
      • reg.exe (PID: 2904)
      • reg.exe (PID: 1748)
      • reg.exe (PID: 4092)
      • reg.exe (PID: 2716)
      • reg.exe (PID: 3728)
      • reg.exe (PID: 3344)
      • reg.exe (PID: 3456)
      • reg.exe (PID: 3932)
      • reg.exe (PID: 1092)
      • reg.exe (PID: 3880)
      • reg.exe (PID: 2880)
      • reg.exe (PID: 2388)
      • reg.exe (PID: 308)
      • reg.exe (PID: 3424)
      • reg.exe (PID: 2864)
      • reg.exe (PID: 1520)
      • reg.exe (PID: 3580)
      • reg.exe (PID: 2944)
      • reg.exe (PID: 872)
      • reg.exe (PID: 3636)
      • reg.exe (PID: 772)
      • reg.exe (PID: 3972)
      • reg.exe (PID: 1740)
      • reg.exe (PID: 2948)
      • reg.exe (PID: 2604)
      • reg.exe (PID: 1832)
      • reg.exe (PID: 308)
      • reg.exe (PID: 2548)
      • reg.exe (PID: 3120)
      • reg.exe (PID: 2816)
      • reg.exe (PID: 3084)
      • reg.exe (PID: 820)
      • reg.exe (PID: 3664)
      • reg.exe (PID: 2948)
      • reg.exe (PID: 2448)
      • reg.exe (PID: 3192)
      • reg.exe (PID: 3596)
      • reg.exe (PID: 4480)
      • reg.exe (PID: 5176)
      • reg.exe (PID: 5312)
      • reg.exe (PID: 3160)
      • reg.exe (PID: 820)
      • reg.exe (PID: 5580)
      • reg.exe (PID: 4324)
      • reg.exe (PID: 5140)
      • reg.exe (PID: 6036)
      • reg.exe (PID: 2076)
      • reg.exe (PID: 2872)
      • reg.exe (PID: 5568)
      • reg.exe (PID: 6020)
      • reg.exe (PID: 5484)
      • reg.exe (PID: 6020)
      • reg.exe (PID: 5184)
      • reg.exe (PID: 3792)
      • reg.exe (PID: 4580)
      • reg.exe (PID: 5684)
      • reg.exe (PID: 4428)
      • reg.exe (PID: 4168)
      • reg.exe (PID: 4580)
      • reg.exe (PID: 4632)
      • reg.exe (PID: 5876)
      • reg.exe (PID: 5564)
      • reg.exe (PID: 4792)

    • Uses TASKKILL.EXE to kill process

      • javaw.exe (PID: 3368)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 3368)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • javaw.exe (PID: 3368)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 3368)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2020:02:25 19:51:23
ZipCRC: 0x8af85fba
ZipCompressedSize: 395
ZipUncompressedSize: 512
ZipFileName: META-INF/MANIFEST.MF
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
652
Monitored processes
386
Malicious processes
5
Suspicious processes
14

Behavior graph

Click at the process to see the details
start javaw.exe cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs wmic.exe no specs cmd.exe no specs reg.exe taskkill.exe reg.exe reg.exe no specs cmd.exe no specs explorer.exe no specs svchost.exe no specs searchprotocolhost.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs taskkill.exe reg.exe no specs cmd.exe no specs reg.exe reg.exe reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs taskkill.exe reg.exe reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe reg.exe reg.exe no specs cmd.exe no specs taskkill.exe reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs taskkill.exe cmd.exe no specs reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs taskkill.exe reg.exe no specs reg.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs taskkill.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs taskkill.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs taskkill.exe reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs taskkill.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0017-0411-0000-0000000FF1CE}"C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\systemroot\system32\ntdll.dll
c:\windows\system32\reg.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
308reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-0000-0000000FF1CE}"C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
308reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-0000-0000000FF1CE}"C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\imm32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\systemroot\system32\ntdll.dll
c:\windows\system32\reg.exe
c:\windows\system32\kernel32.dll
332reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0410-0000-0000000FF1CE}"C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
340cmd.exeC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\systemroot\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
372C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
376"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /FC:\Windows\System32\taskkill.exe
javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\conhost.exe
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
540cmd.exeC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
548WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:ListC:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
564cmd.exeC:\Windows\system32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 284
Read events
2 245
Write events
39
Delete events
0

Modification events

(PID) Process:(3548) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3548) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@C:\Windows\System32\ieframe.dll,-912
Value:
HTML Document
(PID) Process:(3548) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(372) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(372) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@C:\Windows\System32\display.dll,-4
Value:
S&creen resolution
(PID) Process:(372) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@C:\Program Files\Windows Sidebar\sidebar.exe,-11100
Value:
&Gadgets
(PID) Process:(372) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@C:\Windows\system32\themecpl.dll,-10
Value:
Pe&rsonalize
(PID) Process:(3368) javaw.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:ZlUNqYe
Value:
"C:\Users\admin\Oracle\bin\javaw.exe" -jar "C:\Users\admin\IueMc\tIKhw.class.txt"
(PID) Process:(3368) javaw.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZlUNqYe
Value:
"C:\Users\admin\Oracle\bin\javaw.exe" -jar "C:\Users\admin\IueMc\tIKhw.class.txt"
(PID) Process:(3368) javaw.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
108
Suspicious files
10
Text files
65
Unknown types
15

Dropped files

PID
Process
Filename
Type
3368javaw.exeC:\Users\admin\Oracle\bin\client\classes.jsa —
MD5:—
SHA256:—
3368javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:—
SHA256:—
3368javaw.exeC:\Users\admin\Oracle\bin\awt.dllexecutable
MD5:775D4B37E0DDBFA0EB56DB38126FB444
SHA256:E5D4FC7D47A38A389884AF1EA5F06F7C61C5CDE6AFC154A23A3CB5A127DA1E34
3368javaw.exeC:\Users\admin\Oracle\bin\bci.dllexecutable
MD5:6D8D8A26450EE4BA0BE405629EA0A511
SHA256:7945365A3CD40D043DAE47849E6645675166920958300E64DEA76A865BC479AF
3368javaw.exeC:\Users\admin\Oracle\bin\decora_sse.dllexecutable
MD5:94434B8739CB5CD184C63CEC209F06E2
SHA256:ADF4E9CE0866FF16A16F626CFC62355FB81212B1E7C95DD908E3644F88B77E91
3368javaw.exeC:\Users\admin\Oracle\bin\client\Xusage.txttext
MD5:B3174769A9E9E654812315468AE9C5FA
SHA256:37CF4E6CDC4357CEBB0EC8108D5CB0AD42611F675B926C819AE03B74CE990A08
3368javaw.exeC:\Users\admin\Oracle\bin\dtplugin\npdeployJava1.dllexecutable
MD5:D73A1252502A5F6218C916219B52139D
SHA256:62248D7AB742E200996BF87433B4E8478E4D8BCFBC0A2EE7CBE3A5A62F6268C3
3368javaw.exeC:\Users\admin\Oracle\bin\dtplugin\deployJava1.dllexecutable
MD5:CBABA29CE7925BAA5B0C45DC78C1A275
SHA256:ADAAA9037BE30C708865A6627DF9C0E43ACF93D100469E5FDF83F632D2FE1829
3368javaw.exeC:\Users\admin\Oracle\bin\deploy.dllexecutable
MD5:720EDC1469525DFCD3AE211E653D0241
SHA256:BFF79FB05667992CC2BDA9BAE6E5A301BAF553042F952203641CCD7E1FC4552D
3368javaw.exeC:\Users\admin\Oracle\bin\fontmanager.dllexecutable
MD5:412B97D96EA9384C78851938921EE44A
SHA256:20BEF5BCD523CFF21BAD585AF91D1C913D5535A6B20AC70F5F3D8DAFB2F90F25
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3368
javaw.exe
118.100.66.100:4424
dman20.ddns.net
TM Net, Internet Service Provider
MY
unknown

DNS requests

Domain
IP
Reputation
dman20.ddns.net
  • 118.100.66.100
unknown

Threats

PID
Process
Class
Message
1052
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
11.1.jar