File name:

maksrat (2).jar

Full analysis: https://app.any.run/tasks/26685d7f-c9e0-48f4-8ad4-3b2eac87fa24
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 07:57:15
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
java
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

F569F7259861C2E3658A6CC97C690E5A

SHA1:

233886AFB093C0D2C8CF94728DD61868205CC3C5

SHA256:

75F180E255169F8305CF52C75D5769AA8015419B9D5E8074F558D63DED75CA21

SSDEEP:

384:VAnLm88v66XW2rAn/W+2UBLRY1Y6X/gqWoFYmAOmZuucaTdswyOnA/0yNr0:Vqj2c2UBLRL2/j6uuLWwyOnA804

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • java.exe (PID: 2096)

    • Steals credentials from Web Browsers

      • java.exe (PID: 2096)

    • Suspicious browser debugging (Possible cookie theft)

      • chrome.exe (PID: 6080)
      • msedge.exe (PID: 1660)

  • SUSPICIOUS

    • Connects to unusual port

      • javaw.exe (PID: 4892)
      • java.exe (PID: 2096)

    • Uses TASKKILL.EXE to kill Browsers

      • cmd.exe (PID: 5328)
      • java.exe (PID: 2096)
      • cmd.exe (PID: 4188)
      • cmd.exe (PID: 4988)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4180)
      • cmd.exe (PID: 4944)
      • cmd.exe (PID: 1056)

    • Starts CMD.EXE for commands execution

      • java.exe (PID: 2096)

    • Executable content was dropped or overwritten

      • java.exe (PID: 2096)

  • INFO

    • Checks supported languages

      • javaw.exe (PID: 4892)
      • java.exe (PID: 2096)

    • Application based on Java

      • javaw.exe (PID: 4892)

    • Reads the machine GUID from the registry

      • javaw.exe (PID: 4892)
      • java.exe (PID: 2096)

    • Creates files or folders in the user directory

      • javaw.exe (PID: 4892)
      • java.exe (PID: 2096)

    • Create files in a temporary directory

      • javaw.exe (PID: 4892)
      • java.exe (PID: 2096)

    • Creates files in the program directory

      • javaw.exe (PID: 4892)

    • Reads the computer name

      • java.exe (PID: 2096)
      • javaw.exe (PID: 4892)

    • Application launched itself

      • chrome.exe (PID: 6080)
      • msedge.exe (PID: 1660)

    • Checks proxy server information

      • slui.exe (PID: 3784)

    • Reads the software policy settings

      • slui.exe (PID: 3300)
      • slui.exe (PID: 3784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jar | Java Archive (78.3)
.zip | ZIP compressed archive (21.6)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0x00000000
ZipCompressedSize: 2
ZipUncompressedSize: -
ZipFileName: META-INF/
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
185
Monitored processes
48
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe icacls.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe java.exe conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe no specs taskkill.exe no specs chrome.exe no specs chrome.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs taskkill.exe no specs conhost.exe no specs slui.exe ucpdmgr.exe no specs conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
668"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
780"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --mojo-platform-channel-handle=1416 --field-trial-handle=1420,i,5021146451999806585,1474596333450710967,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
896\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1020TASKKILL /F /IM msedge.exeC:\Windows\System32\taskkill.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1056cmd.exe /c "taskkill /IM vivaldi.exe /F"C:\Windows\System32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1128taskkill /IM vivaldi.exe /FC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1452\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1600"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x224,0x228,0x22c,0x20c,0x230,0x7ffc895adc40,0x7ffc895adc4c,0x7ffc895adc58C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1660"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session --remote-debugging-port=9222 --headless --remote-allow-origins=* "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1672\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
13 179
Read events
13 173
Write events
6
Delete events
0

Modification events

(PID) Process:(6080) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6080) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6080) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1660) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1660) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1660) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
Executable files
4
Suspicious files
14
Text files
36
Unknown types
0

Dropped files

PID
Process
Filename
Type
6080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF110bc5.TMP —
MD5:—
SHA256:—
6080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
4892javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\config\gson-2.10.1.jarcompressed
MD5:DF6097815738CB31FC56391553210843
SHA256:4241C14A7727C34FEEA6507EC801318A3D4A90F070E4525681079FB94EE4C593
4892javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\83aa4cc77f591dfc2374580bbd95f6ba_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
6080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RF110bc5.TMPtext
MD5:F96D0EF8D63094D714514A441F8CD3FB
SHA256:2083625CA1E32D366F0B664D9B87B591791EF2EA2B770F4FA6ABE13FECA01196
2096java.exeC:\Users\admin\AppData\Roaming\sqlite-jdbc-3.23.1.jarcompressed
MD5:76C9C25DE0F8603E5706ADAB1CC18009
SHA256:D570AF636A2BE99E20BE9510FB615AA819B2059857B2DD625AECBFF774766331
2096java.exeC:\Users\admin\AppData\Local\Temp\temp_history.dbbinary
MD5:FDDE63730E15DD2E18C540BA52B6A945
SHA256:40740EAABD14FC0E08D3B5EE340C1E1B372E158F61EF58AEED1EE4B3A3F4492E
6080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:FC81892AC822DCBB09441D3B58B47125
SHA256:FB077C966296D02D50CCBF7F761D2A3311A206A784A7496F331C2B0D6AD205C8
2096java.exeC:\Users\admin\AppData\Local\Temp\TempGui8288800405278931720\ilr-admin\screenshit.pngbinary
MD5:244AB0D1AA48A2DC4B53DB22C1ABC819
SHA256:87FEC1F77F051B7E779AB9F93E90EEC31E7D4E414E614E5440E6A668278E8E88
2096java.exeC:\Users\admin\AppData\Local\Temp\sqlite-3.23.1-95de065d-c45f-40e0-a165-a265e167f00b-sqlitejdbc.dllexecutable
MD5:5C1142470DAEC9631A71B589A2E17D7B
SHA256:FEC0F3E20C210DA38AB477253389FD32AB80799A127315C2EF66527D6B6B84C3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
45
DNS requests
21
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.129:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.129:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6240
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6240
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.164.129:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.129:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4892
javaw.exe
199.232.192.209:443
repo1.maven.org
FASTLY
US
whitelisted
4892
javaw.exe
145.223.100.21:4024
www.makslove.xyz
Koninklijke Cooperatieve Bloemenveiling FloraHolland U.A.
NL
malicious
4892
javaw.exe
145.223.100.21:4025
www.makslove.xyz
Koninklijke Cooperatieve Bloemenveiling FloraHolland U.A.
NL
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 2.16.164.129
  • 2.16.164.82
  • 2.16.164.74
  • 2.16.164.10
  • 2.16.164.75
  • 2.16.164.131
  • 2.16.164.91
  • 2.16.164.130
  • 2.16.164.73
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
repo1.maven.org
  • 199.232.192.209
  • 199.232.196.209
whitelisted
www.makslove.xyz
  • 145.223.100.21
malicious
login.live.com
  • 40.126.32.134
  • 40.126.32.136
  • 20.190.160.17
  • 40.126.32.72
  • 20.190.160.5
  • 20.190.160.64
  • 20.190.160.22
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted

Threats

PID
Process
Class
Message
4892
javaw.exe
Misc activity
ET HUNTING ZIP file download over raw TCP
4892
javaw.exe
Misc activity
ET HUNTING ZIP file download over raw TCP
4892
javaw.exe
Misc activity
ET HUNTING ZIP file download over raw TCP
4892
javaw.exe
Misc activity
ET HUNTING ZIP file download over raw TCP
4892
javaw.exe
Misc activity
ET HUNTING ZIP file download over raw TCP
4892
javaw.exe
Misc activity
ET HUNTING ZIP file download over raw TCP
4892
javaw.exe
Misc activity
ET HUNTING ZIP file download over raw TCP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
maksrat (2).jar