Play interactive tour

Edit tour

Analysis Report INV 3326GHF- from Outriger General Importers Korea for acknowledgment.jar

Overview

General Information

Joe Sandbox Version:	24.0.0
Analysis ID:	749556
Start date:	30.12.2018
Start time:	12:42:02
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 5m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	INV 3326GHF- from Outriger General Importers Korea for acknowledgment.jar
Cookbook file name:	defaultwindowsfilecookbook.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40 1.8.0_191, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	EGA enabled GSI enabled (VBA) GSI enabled (Javascript) GSI enabled (Java)
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.troj.expl.evad.winJAR@129/267@5/2
Cookbook Comments:	Adjust boot time Found application associated with file extension: .jar
Warnings:	Show All Exclude process from analysis (whitelisted): conhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtQueryDirectoryFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtQueryVolumeInformationFile calls found. Report size getting too big, too many NtReadFile calls found. Report size getting too big, too many NtSetInformationFile calls found.

Detection

Strategy	Score	Range	Reporting	Whitelisted	Detection
Threshold	88	0 - 100	Report FP / FN	false

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control
Valid Accounts	Command-Line Interface1	Hidden Files and Directories1	Process Injection11	Masquerading1	Credential Dumping	Security Software Discovery121	Application Deployment Software	Data from Local System	Data Compressed	Uncommonly Used Port1
Replication Through Removable Media	Scripting1	Registry Run Keys / Start Folder21	Accessibility Features	Hidden Files and Directories1	Network Sniffing	Remote System Discovery1	Remote Services	Data from Removable Media	Exfiltration Over Other Network Medium	Remote Access Tools3
Drive-by Compromise	Exploitation for Client Execution1	Accessibility Features	Path Interception	Disabling Security Tools1	Input Capture	File and Directory Discovery1	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Standard Non-Application Layer Protocol1
Exploit Public-Facing Application	Scheduled Task	System Firmware	DLL Search Order Hijacking	Process Injection11	Credentials in Files	System Information Discovery1	Logon Scripts	Input Capture	Data Encrypted	Standard Application Layer Protocol1
Spearphishing Link	Command-Line Interface	Shortcut Modification	File System Permissions Weakness	Scripting1	Account Manipulation	Remote System Discovery	Shared Webroot	Data Staged	Scheduled Transfer	Standard Cryptographic Protocol

Signature Overview

Click to jump to signature section

AV Detection:

Yara signature match

Show sources

Source: C:\Users\user~1\AppData\Local\Temp\_0.63493269659919425532230313552172834.class, type: DROPPED	Matched rule: MAL_JRAT_Oct18_1 date = 2018-10-11, hash1 = ce190c37a6fdb2632f4bc5ea0bb613b3fbe697d04e68e126b41910a6831d3411, author = Florian Roth, description = Detects JRAT malware, reference = Internal Research
Source: C:\Users\user~1\AppData\Local\Temp\_0.259951839382067235585996733401964613.class, type: DROPPED	Matched rule: MAL_JRAT_Oct18_1 date = 2018-10-11, hash1 = ce190c37a6fdb2632f4bc5ea0bb613b3fbe697d04e68e126b41910a6831d3411, author = Florian Roth, description = Detects JRAT malware, reference = Internal Research
Source: C:\Users\user~1\AppData\Local\Temp\_0.27057588722335616152848481378506703.class, type: DROPPED	Matched rule: MAL_JRAT_Oct18_1 date = 2018-10-11, hash1 = ce190c37a6fdb2632f4bc5ea0bb613b3fbe697d04e68e126b41910a6831d3411, author = Florian Roth, description = Detects JRAT malware, reference = Internal Research

Spreading:

Enumerates the file system

Show sources

Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Oracle\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Oracle\lib\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Oracle\lib\ext\

Software Vulnerabilities:

Exploit detected, runtime environment starts unknown processes

Show sources

Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe

Process created: C:\Windows\System32\cmd.exe

Jump to behavior

Networking:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.1.16:49230 -> 185.244.30.124:6654

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: onyeka1.duckdns.org

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: onyeka1.duckdns.org

Urls found in memory or binary data

Show sources

Source: java.dll.19.dr	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.dll.19.dr	String found in binary or memory: http://bugreport.sun.com/bugreport/java.vendor.url.bughttp://java.oracle.com/java.vendor.urljava.ven
Source: gstreamer-lite.dll.19.dr	String found in binary or memory: http://bugzilla.gnome.org/enter_bug.cgi?product=GStreamer.
Source: gstreamer-lite.dll.19.dr	String found in binary or memory: http://bugzilla.gnome.org/enter_bug.cgi?product=GStreamer.GStreamer
Source: gstreamer-lite.dll.19.dr	String found in binary or memory: http://bugzilla.gnome.org/enter_bug.cgi?product=GStreamer.Internal
Source: gstreamer-lite.dll.19.dr	String found in binary or memory: http://bugzilla.gnome.org/enter_bug.cgi?product=GStreamer.Your
Source: THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr	String found in binary or memory: http://casper.beckman.uiuc.edu/~c-tsai4
Source: THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr	String found in binary or memory: http://chasen.aist-nara.ac.jp/chasen/distribution.html
Source: gstreamer-lite.dll.19.dr	String found in binary or memory: http://creativecommons.org/licenses/
Source: gstreamer-lite.dll.19.dr	String found in binary or memory: http://creativecommons.org/licenses/WOAFID3PrivateFramehttp://musicbrainz.org%d/%d%drxRemixcr
Source: Welcome.html.19.dr	String found in binary or memory: http://download.oracle.com/javase/7/docs/technotes/guides/plugin/
Source: jfxwebkit.dll.19.dr	String found in binary or memory: http://exslt.org/common
Source: jfxwebkit.dll.19.dr	String found in binary or memory: http://exslt.org/commonnode-set
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/tip/src/share/native/sun/security/ec/impl
Source: THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr	String found in binary or memory: http://hg.openjdk.java.net/openjfx/8u/rt
Source: java.dll.19.dr	String found in binary or memory: http://java.oracle.com/
Source: jdwp.dll.19.dr	String found in binary or memory: http://java.sun.com/products/jpda
Source: fxplugins.dll.19.dr	String found in binary or memory: http://javafx.com/
Source: fxplugins.dll.19.dr	String found in binary or memory: http://javafx.com/vp6decoderflvdemuxvideo/unsupportedvideo/x-vp6-flashvideo/x-vp6-alphaOn2
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: gstreamer-lite.dll.19.dr	String found in binary or memory: http://musicbrainz.org
Source: THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr	String found in binary or memory: http://opensource.org/licenses/bsd-license.php
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://relaxngcc.sf.net/).
Source: awt.dll.19.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: awt.dll.19.dr	String found in binary or memory: http://s.symcd.com06
Source: awt.dll.19.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: awt.dll.19.dr	String found in binary or memory: http://s2.symcb.com0
Source: awt.dll.19.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0W
Source: awt.dll.19.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: awt.dll.19.dr	String found in binary or memory: http://sv.symcd.com0&
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://tartarus.org/~martin/PorterStemmer
Source: jfxwebkit.dll.19.dr	String found in binary or memory: http://tools.ietf.org/html/rfc3986#section-2.1.
Source: jfxwebkit.dll.19.dr	String found in binary or memory: http://tools.ietf.org/html/rfc3986#section-2.1.The
Source: awt.dll.19.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: awt.dll.19.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: awt.dll.19.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://upx.sourceforge.net/upx-license.html.
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://upx.tsx.org
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://wildsau.idv.uni-linz.ac.at/mfx/upx.html
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.apache.org/).
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.ecma-international.org
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.ecma-international.org/memento/codeofconduct.htm
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.freebxml.org/
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.freebxml.org/).
Source: jfxwebkit.dll.19.dr	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
Source: jfxwebkit.dll.19.dr	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//w3c//dtd
Source: gstreamer-lite.dll.19.dr	String found in binary or memory: http://www.ifpi.org/isrc/
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.linuxnet.com
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.nexus.hu/upx
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.oracle.com/goto/opensourcecode/request
Source: Welcome.html.19.dr	String found in binary or memory: http://www.oracle.com/technetwork/java/javase/overview/
Source: awt.dll.19.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: awt.dll.19.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr, THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.unicode.org/Public/
Source: THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr, THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.unicode.org/Public/.
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.unicode.org/cldr/data/.
Source: THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr	String found in binary or memory: http://www.unicode.org/copyright.html.
Source: THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr, THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.unicode.org/reports/
Source: THIRDPARTYLICENSEREADME.txt.19.dr	String found in binary or memory: http://www.xfree86.org/)
Source: awt.dll.19.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: awt.dll.19.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: awt.dll.19.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr	String found in binary or memory: https://sourceforge.net/project/?group_id=1519

DDoS:

Too many similar processes found

Show sources

Source: unknown

Process created: 80

System Summary:

Creates files inside the system directory

Show sources

Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe

File created: C:\Windows\System32\test.txt

Jump to behavior

Reads the hosts file

Show sources

Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts

Uses reg.exe to modify the Windows registry

Show sources

Source: unknown

Process created: C:\Windows\System32\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v bJnYSNphoio /t REG_EXPAND_SZ /d '\'C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe\' -jar \'C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG\'' /f

Classification label

Show sources

Source: classification engine

Classification label: mal88.troj.expl.evad.winJAR@129/267@5/2

Creates files inside the user directory

Show sources

Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe

File created: C:\Users\user\KtXRptueuIB

Jump to behavior

Creates temporary files

Show sources

Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe

File created: C:\Users\user~1\AppData\Local\Temp\hsperfdata_user\3864

Jump to behavior

Executable is probably coded in java

Show sources

Source: C:\Windows\System32\cmd.exe

Section loaded: C:\Program Files\Java\jre1.8.0_191\bin\java.dll

Jump to behavior

Executes visual basic scripts

Show sources

Source: unknown

Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5438807271024442592.vbs

Queries process information (via WMI, Win32_Process)

Show sources

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Reads software policies

Show sources

Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

SQL strings found in memory and binary data

Show sources

Source: jfxwebkit.dll.19.dr	Binary or memory string: CREATE TABLE Origins (origin TEXT UNIQUE ON CONFLICT REPLACE, quota INTEGER NOT NULL ON CONFLICT FAIL);
Source: jfxwebkit.dll.19.dr	Binary or memory string: SELECT name FROM sqlite_master WHERE type='table';
Source: jfxwebkit.dll.19.dr	Binary or memory string: SELECT origin FROM Origins where origin=?;
Source: jfxwebkit.dll.19.dr	Binary or memory string: CREATE TABLE Databases (guid INTEGER PRIMARY KEY AUTOINCREMENT, origin TEXT, name TEXT, displayName TEXT, estimatedSize INTEGER, path TEXT);
Source: jfxwebkit.dll.19.dr	Binary or memory string: SELECT guid FROM Databases WHERE origin=? AND name=?;
Source: jfxwebkit.dll.19.dr	Binary or memory string: SELECT name FROM Databases where origin=?;
Source: jfxwebkit.dll.19.dr	Binary or memory string: INSERT INTO Databases (origin, name, path) VALUES (?, ?, ?);
Source: jfxwebkit.dll.19.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS CacheGroups (id INTEGER PRIMARY KEY AUTOINCREMENT, manifestHostHash INTEGER NOT NULL ON CONFLICT FAIL, manifestURL TEXT UNIQUE ON CONFLICT FAIL, newestCache INTEGER, origin TEXT)CREATE TABLE IF NOT EXISTS Caches (id INTEGER PRIMARY KEY AUTOINCREMENT, cacheGroup INTEGER, size INTEGER) was redirected.CREATE TABLE IF NOT EXISTS CacheWhitelistURLs (url TEXT NOT NULL ON CONFLICT FAIL, cache INTEGER NOT NULL ON CONFLICT FAIL)Application Cache update failed, because CREATE TABLE IF NOT EXISTS CacheAllowsAllNetworkRequests (wildcard INTEGER NOT NULL ON CONFLICT FAIL, cache INTEGER NOT NULL ON CONFLICT FAIL)CREATE TABLE IF NOT EXISTS FallbackURLs (namespace TEXT NOT NULL ON CONFLICT FAIL, fallbackURL TEXT NOT NULL ON CONFLICT FAIL, cache INTEGER NOT NULL ON CONFLICT FAIL)CREATE TABLE IF NOT EXISTS CacheEntries (cache INTEGER NOT NULL ON CONFLICT FAIL, type INTEGER, resource INTEGER NOT NULL)Application Cache update failed, because CREATE TABLE IF NOT EXISTS CacheResources (id INTEGER PRIMARY
Source: jfxwebkit.dll.19.dr	Binary or memory string: SELECT quota FROM Origins where origin=?;
Source: jfxwebkit.dll.19.dr	Binary or memory string: SELECT path FROM Databases WHERE origin=? AND name=?;
Source: jfxwebkit.dll.19.dr	Binary or memory string: CREATE TABLE Origins (origin TEXT UNIQUE ON CONFLICT REPLACE, path TEXT);

Spawns processes

Show sources

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\INV 3326GHF- from Outriger General Importers Korea for acknowledgment.jar'' >> C:\cmdlinestart.log 2>&1
Source: unknown	Process created: C:\Program Files\Java\jre1.8.0_191\bin\java.exe 'C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\INV 3326GHF- from Outriger General Importers Korea for acknowledgment.jar'
Source: unknown	Process created: C:\Windows\System32\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M
Source: unknown	Process created: C:\Program Files\Java\jre1.8.0_191\bin\java.exe 'C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar C:\Users\user~1\AppData\Local\Temp\_0.63493269659919425532230313552172834.class
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5438807271024442592.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5438807271024442592.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7307749898854467482.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7307749898854467482.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive2024933177882465042.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive2024933177882465042.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7530535289870207342.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7530535289870207342.vbs
Source: unknown	Process created: C:\Windows\System32\xcopy.exe xcopy 'C:\Program Files\Java\jre1.8.0_191' 'C:\Users\user\AppData\Roaming\Oracle\' /e
Source: unknown	Process created: C:\Windows\System32\xcopy.exe xcopy 'C:\Program Files\Java\jre1.8.0_191' 'C:\Users\user\AppData\Roaming\Oracle\' /e
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe
Source: unknown	Process created: C:\Windows\System32\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v bJnYSNphoio /t REG_EXPAND_SZ /d '\'C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe\' -jar \'C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG\'' /f
Source: unknown	Process created: C:\Windows\System32\attrib.exe attrib +h 'C:\Users\user\KtXRptueuIB\.'
Source: unknown	Process created: C:\Windows\System32\attrib.exe attrib +h 'C:\Users\user\KtXRptueuIB'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe 'C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe' -jar 'C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe C:\Users\user\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\user~1\AppData\Local\Temp\_0.27057588722335616152848481378506703.class
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7103461586894408784.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7103461586894408784.vbs
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3097055394604195664.vbs
Source: unknown	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3097055394604195664.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Java\jre1.8.0_191\bin\java.exe 'C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\INV 3326GHF- from Outriger General Importers Korea for acknowledgment.jar'	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Program Files\Java\jre1.8.0_191\bin\java.exe 'C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar C:\Users\user~1\AppData\Local\Temp\_0.63493269659919425532230313552172834.class	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5438807271024442592.vbs	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive2024933177882465042.vbs	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\xcopy.exe xcopy 'C:\Program Files\Java\jre1.8.0_191' 'C:\Users\user\AppData\Roaming\Oracle\' /e	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v bJnYSNphoio /t REG_EXPAND_SZ /d '\'C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe\' -jar \'C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG\'' /f	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\attrib.exe attrib +h 'C:\Users\user\KtXRptueuIB\.'	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\attrib.exe attrib +h 'C:\Users\user\KtXRptueuIB'	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7307749898854467482.vbs	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7530535289870207342.vbs	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\xcopy.exe xcopy 'C:\Program Files\Java\jre1.8.0_191' 'C:\Users\user\AppData\Roaming\Oracle\' /e	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5438807271024442592.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7307749898854467482.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive2024933177882465042.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7530535289870207342.vbs	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3097055394604195664.vbs
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe C:\Users\user\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\user~1\AppData\Local\Temp\_0.27057588722335616152848481378506703.class
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7103461586894408784.vbs
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3097055394604195664.vbs
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7103461586894408784.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3097055394604195664.vbs

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Windows\System32\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe

File opened: C:\Program Files\Java\jre1.8.0_191\bin\msvcr100.dll

Jump to behavior

Binary contains paths to debug symbols

Show sources

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libjava\java.pdb source: java.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\deploy\jre-image\bin\deploy.pdb ^m source: deploy.dll.19.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.19.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: api-ms-win-core-memory-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: api-ms-win-core-debug-l1-1-0.dll.19.dr
Source:	Binary string: concrt140.i386.pdbGCTL source: concrt140.dll.19.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\deploy\tmp\eula\obj\eula.pdb source: eula.dll.19.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libhprof_jvmti\hprof.pdb source: hprof.dll.19.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\deploy\tmp\javacpl\obj\javacpl.pdb source: javacpl.cpl.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libjava\java.pdbG* source: java.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libjfr\jfr.pdb source: jfr.dll.19.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libjaas\jaas_nt.pdb source: jaas_nt.dll.19.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: api-ms-win-crt-environment-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\deploy\tmp\javacplexec\obj\javacpl.pdb source: javacpl.exe.19.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: api-ms-win-core-errorhandling-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: api-ms-win-core-processthreads-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: api-ms-win-core-console-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: api-ms-win-core-file-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: api-ms-win-crt-private-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libdcpr\dcpr.pdb source: dcpr.dll.19.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\java-rmi_objs\java-rmi.pdb source: java-rmi.exe.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libj2pkcs11\j2pkcs11.pdb source: j2pkcs11.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb0 source: javaw.exe.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libawt\awt.pdb source: awt.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libjfr\jfr.pdby+ source: jfr.dll.19.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: api-ms-win-core-handle-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\java_objs\java.pdb source: java.exe.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libjava_crw_demo\java_crw_demo.pdb98 source: java_crw_demo.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libfontmanager\fontmanager.pdb source: fontmanager.dll.19.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\deploy\tmp\javacpl\obj\javacpl.pdb< source: javacpl.cpl.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libjava_crw_demo\java_crw_demo.pdb source: java_crw_demo.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\deploy\tmp\eula\obj\eula.pdb0 source: eula.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libinstrument\instrument.pdbp source: instrument.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libdt_socket\dt_socket.pdb source: dt_socket.dll.19.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: api-ms-win-core-processenvironment-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libjawtaccessbridge\JAWTAccessBridge.pdb source: JAWTAccessBridge.dll.19.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: api-ms-win-core-datetime-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb source: javaw.exe.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libhprof_jvmti\hprof.pdbi source: hprof.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libj2pcsc\j2pcsc.pdb source: j2pcsc.dll.19.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\jabswitch\jabswitch.pdb source: jabswitch.exe.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\deploy\tmp\javacplexec\obj\javacpl.pdb0 source: javacpl.exe.19.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libjawt\jawt.pdb source: jawt.dll.19.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libinstrument\instrument.pdb source: instrument.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libjavaaccessbridge\JavaAccessBridge.pdb source: JavaAccessBridge.dll.19.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: api-ms-win-crt-utility-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: api-ms-win-core-string-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: api-ms-win-core-file-l2-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: api-ms-win-core-libraryloader-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\deploy\jre-image\bin\deploy.pdb source: deploy.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libjdwp\jdwp.pdb source: jdwp.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libawt\awt.pdb8~ source: awt.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libdt_shmem\dt_shmem.pdb source: dt_shmem.dll.19.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libbci\bci.pdb source: bci.dll.19.dr
Source:	Binary string: concrt140.i386.pdb source: concrt140.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\deploy\jre-image\bin\javaws.pdb source: javaws.exe.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\jdk\objs\libfontmanager\fontmanager.pdb@ source: fontmanager.dll.19.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: api-ms-win-crt-heap-l1-1-0.dll.19.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll.19.dr
Source:	Binary string: c:\workspace\8-2-build-windows-i586-cygwin\jdk8u191\11896\build\windows-i586\deploy\jre-image\bin\javaws.pdb\| source: javaws.exe.19.dr

Data Obfuscation:

Launches a Java Jar file from a suspicious file location

Show sources

Source: Java tracing	Executes: java.lang.ProcessBuilder(java.lang.String[]) on c:\program files\java\jre1.8.0_191\bin\java.exe -javaagent:"c:\users\user~1\appdata\local\temp\jartracer.jar" -jar c:\users\user~1\appdata\local\temp\_0.63493269659919425532230313552172834.class
Source: Java tracing	Executes: java.lang.ProcessBuilder(java.lang.String[]) on reg add hkcu\software\microsoft\windows\currentversion\run /v bjnysnphoio /t reg_expand_sz /d \"c:\users\user\appdata\roaming\oracle\bin\javaw.exe\" -jar \"c:\users\user\ktxrptueuib\xszhgswuuvb.nxpnyg\" /f
Source: Java tracing	Executes: java.lang.ProcessBuilder(java.lang.String[]) on c:\users\user\appdata\roaming\oracle\bin\java.exe -javaagent:"c:\users\user~1\appdata\local\temp\jartracer.jar" -jar c:\users\user~1\appdata\local\temp\_0.259951839382067235585996733401964613.class

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\glass.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\kinit.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\nio.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\client\jvm.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\ssvagent.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\instrument.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\java_crw_demo.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\fontmanager.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dt_shmem.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\orbd.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\pack200.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\concrt140.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font_t2k.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\hprof.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\t2k.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\unpack200.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\WindowsAccessBridge.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\zip.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.cpl	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jp2ssv.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javaws.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\sunec.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\mlib_image.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jsdt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\net.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\prism_sw.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\ktab.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\verify.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\plugin2\npjp2.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\fxplugins.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\glib-lite.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\JAWTAccessBridge.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\rmid.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\prism_common.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jjs.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\awt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\management.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_iio.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jp2native.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\sunmscapi.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dt_socket.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\bci.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\ucrtbase.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dcpr.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\deployJava1.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jdwp.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\policytool.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\npdeployJava1.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jsound.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\decora_sse.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\splashscreen.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\j2pkcs11.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jp2iexp.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\j2pcsc.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\gstreamer-lite.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\java-rmi.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jabswitch.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\keytool.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\kcms.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\lcms.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jfxwebkit.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jaas_nt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\servertool.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jsoundds.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jfxmedia.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\msvcp140.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\w2k_lsa_auth.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\npt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\resource.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jpeg.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jfr.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jawt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\klist.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\jli.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\eula.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\unpack.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\wsdetect.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\plugin2\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\prism_d3d.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\tnameserv.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\java.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\JavaAccessBridge.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\deploy.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\ssv.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Show sources

Source: C:\Windows\System32\xcopy.exe

File created: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.cpl

Jump to dropped file

Creates license or readme file

Show sources

Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\README.txt
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME-JAVAFX.txt
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME-JAVAFX.txt
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME.txt
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME.txt

Boot Survival:

Creates autostart registry keys to launch java

Show sources

Source: C:\Windows\System32\reg.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run bJnYSNphoio "C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe" -jar "C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG"

Java Jar creates autostart registry key (Windows persistence behavior)

Show sources

Source: Java tracing

Java Jar creates autostart registry key: java.lang.ProcessBuilder(java.lang.String[]) on reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v bJnYSNphoio /t REG_EXPAND_SZ /d \"C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG\" /f

Creates an autostart registry key

Show sources

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run bJnYSNphoio
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run bJnYSNphoio

Hooking and other Techniques for Hiding and Protection:

Java Jar changes file attribute to hide it from user

Show sources

Source: Java tracing

Java Jar changes file attribute to hide it: java.lang.ProcessBuilder(java.lang.String[]) on attrib +h "C:\Users\user\KtXRptueuIB\*.*"

Uses cacls to modify the permissions of files

Show sources

Source: unknown

Process created: C:\Windows\System32\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Enumerates the file system

Show sources

Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Oracle\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Oracle\lib\
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	File opened: C:\Users\user\AppData\Roaming\Oracle\lib\ext\

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\glass.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\kinit.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\ssvagent.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\java_crw_demo.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\fontmanager.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dt_shmem.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\orbd.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\pack200.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\concrt140.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font_t2k.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\t2k.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\hprof.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\unpack200.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\WindowsAccessBridge.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.cpl	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jp2ssv.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javaws.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\mlib_image.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jsdt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\prism_sw.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\ktab.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\plugin2\npjp2.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\fxplugins.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\JAWTAccessBridge.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\glib-lite.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\rmid.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\prism_common.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jjs.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javafx_iio.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jp2native.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dt_socket.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\bci.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\ucrtbase.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dcpr.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\deployJava1.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jdwp.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\policytool.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\npdeployJava1.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jsound.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\decora_sse.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\splashscreen.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\j2pkcs11.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jp2iexp.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\j2pcsc.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\gstreamer-lite.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\java-rmi.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\keytool.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jabswitch.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\kcms.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\lcms.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jfxwebkit.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jaas_nt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\servertool.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jsoundds.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jfxmedia.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\msvcp140.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\w2k_lsa_auth.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\npt.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\resource.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jpeg.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jfr.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\klist.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\jli.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\eula.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\unpack.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\wsdetect.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\prism_d3d.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\tnameserv.exe	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\JavaAccessBridge.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\deploy.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\ssv.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Windows\System32\cscript.exe TID: 2216	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\cscript.exe TID: 808	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\cscript.exe TID: 1144	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\cscript.exe TID: 1868	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\cscript.exe TID: 1568	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\cscript.exe TID: 2960	Thread sleep time: -60000s >= -30000s

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: jdwp.dll.19.dr	Binary or memory string: JVM version %s (%s, %s)<unknown>VirtualMachineImpl.cRedefineClassesGetTopThreadGroupsJNI_FALSENewStringUTF;DeleteWeakGlobalRefsignature bagsignaturesclassTrack.cloaded classesclassTrack tableNewWeakGlobalRefsignatureKlassNodeAttempting to insert duplicate classloaded classes arraySetTagcommonRef.cDeleteGlobalRefFreeing %d (%x)
Source: jdwp.dll.19.dr	Binary or memory string: VirtualMachineImpl.c

Anti Debugging:

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe

Memory protected: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Show sources

Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Java\jre1.8.0_191\bin\java.exe 'C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\INV 3326GHF- from Outriger General Importers Korea for acknowledgment.jar'	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Program Files\Java\jre1.8.0_191\bin\java.exe 'C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar C:\Users\user~1\AppData\Local\Temp\_0.63493269659919425532230313552172834.class	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5438807271024442592.vbs	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive2024933177882465042.vbs	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\xcopy.exe xcopy 'C:\Program Files\Java\jre1.8.0_191' 'C:\Users\user\AppData\Roaming\Oracle\' /e	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\reg.exe reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v bJnYSNphoio /t REG_EXPAND_SZ /d '\'C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe\' -jar \'C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG\'' /f	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\attrib.exe attrib +h 'C:\Users\user\KtXRptueuIB\.'	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\attrib.exe attrib +h 'C:\Users\user\KtXRptueuIB'	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7307749898854467482.vbs	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7530535289870207342.vbs	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Process created: C:\Windows\System32\xcopy.exe xcopy 'C:\Program Files\Java\jre1.8.0_191' 'C:\Users\user\AppData\Roaming\Oracle\' /e	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5438807271024442592.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7307749898854467482.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive2024933177882465042.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7530535289870207342.vbs	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3097055394604195664.vbs
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe C:\Users\user\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\user~1\AppData\Local\Temp\_0.27057588722335616152848481378506703.class
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7103461586894408784.vbs
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3097055394604195664.vbs
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7103461586894408784.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3097055394604195664.vbs

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Show sources

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\INV 3326GHF- from Outriger General Importers Korea for acknowledgment.jar'' >> C:\cmdlinestart.log 2>&1

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: deploy.dll.19.dr

Binary or memory string: \mwndProcID was NULL in mainLoop()wndProc(JIJJ)JNULL != hIcon../../src/common/windows/native/WindowsJavaTrayIcon.cppTrayNotifyWndShell_TrayWndUnable to Start Java Plug-in Control Panel%s\javacpl.exeJava Sys Tray

Language, Device and Operating System Detection:

Queries the cryptographic machine GUID

Show sources

Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Show sources

Source: C:\Windows\System32\icacls.exe	WMI Queries: IWbemServices::ExecQuery - Select * from FirewallProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from AntiVirusProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from AntiVirusProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from FirewallProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from FirewallProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from AntiVirusProduct
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from AntiVirusProduct

Remote Access Functionality:

ADWIND Rat detected

Show sources

Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext	Jump to dropped file
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext	Jump to dropped file
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext	Jump to dropped file
Source: C:\Program Files\Java\jre1.8.0_191\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe	Dropped file: Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext	Jump to dropped file

Collects Antivirus and Firewall information (ADWIND Rat suspicion)

Show sources

Source: Java tracing	Executes: java.io.Writer.write(java.lang.String) on Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext
Source: Java tracing	Executes: java.io.Writer.write(java.lang.String) on Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext
Source: Java tracing	Executes: java.io.Writer.write(java.lang.String) on Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext
Source: Java tracing	Executes: java.io.Writer.write(java.lang.String) on Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext
Source: Java tracing	Executes: java.io.Writer.write(java.lang.String) on Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")For Each objItem in colItems With objItem WScript.Echo "{""AV"":""" & .displayName & """}" End WithNext
Source: Java tracing	Executes: java.io.Writer.write(java.lang.String) on Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")Set colItems = oWMI.ExecQuery("Select * from FirewallProduct")For Each objItem in colItems With objItem WScript.Echo "{""FIREWALL"":""" & .displayName & """}" End WithNext

Found Adwind RAT configuration as decrypted string

Show sources

Source: Java tracing

AdWind RAT configuration: {"NETWORK":[{"PORT":7777,"DNS":"127.0.0.1"}],"INSTALL":false,"MODULE_PATH":"zS/lq/BTk.GI","PLUGIN_FOLDER":"DdWDtpinxpf","JRE_FOLDER":"HSIROD","JAR_FOLDER":"fUTkALeaTxM","JAR_EXTENSION":"Vybgol","ENCRYPT_KEY":"cPFjgddXIBcXBCIseEuXTZjwi","DELAY_INSTALL":2,"NICKNAME":"User","VMWARE":false,"PLUGIN_EXTENSION":"DhjWU","WEBSITE_PROJECT":"https://jrat.io","JAR_NAME":"uiylKSALYJr","JAR_REGISTRY":"WLyQyhWoosi","DELAY_CONNECT":2,"VBOX":false}

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
12:43:57	API Interceptor	2x Sleep call for process: icacls.exe modified
12:43:57	API Interceptor	2026x Sleep call for process: cmd.exe modified
12:43:58	API Interceptor	3x Sleep call for process: java.exe modified
12:44:09	API Interceptor	12x Sleep call for process: cscript.exe modified
12:44:32	API Interceptor	1x Sleep call for process: reg.exe modified
12:44:33	API Interceptor	2x Sleep call for process: attrib.exe modified
12:44:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bJnYSNphoio "C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe" -jar "C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG"
12:44:37	API Interceptor	2x Sleep call for process: javaw.exe modified

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

Source	Rule	Description	Author
C:\Users\user~1\AppData\Local\Temp\_0.63493269659919425532230313552172834.class	MAL_JRAT_Oct18_1	Detects JRAT malware	Florian Roth
C:\Users\user~1\AppData\Local\Temp\_0.259951839382067235585996733401964613.class	MAL_JRAT_Oct18_1	Detects JRAT malware	Florian Roth
C:\Users\user~1\AppData\Local\Temp\_0.27057588722335616152848481378506703.class	MAL_JRAT_Oct18_1	Detects JRAT malware	Florian Roth

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Startup

System is w7_1

cmd.exe (PID: 4080 cmdline: C:\Windows\system32\cmd.exe /c ''C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\INV 3326GHF- from Outriger General Importers Korea for acknowledgment.jar'' >> C:\cmdlinestart.log 2>&1 MD5: AD7B9C14083B52BC532FBA5948342B98)

java.exe (PID: 3864 cmdline: 'C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\INV 3326GHF- from Outriger General Importers Korea for acknowledgment.jar' MD5: 1A4BAEBCD4466698D9FA846719405E92)

icacls.exe (PID: 1912 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M MD5: 1542A92D5C6F7E1E80613F3466C9CE7F)

java.exe (PID: 2056 cmdline: 'C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar C:\Users\user~1\AppData\Local\Temp\_0.63493269659919425532230313552172834.class MD5: 1A4BAEBCD4466698D9FA846719405E92)

cmd.exe (PID: 1948 cmdline: cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7307749898854467482.vbs MD5: AD7B9C14083B52BC532FBA5948342B98)

cscript.exe (PID: 3156 cmdline: cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7307749898854467482.vbs MD5: A3A35EE79C64A640152B3113E6E254E2)

cmd.exe (PID: 2296 cmdline: cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7530535289870207342.vbs MD5: AD7B9C14083B52BC532FBA5948342B98)

cscript.exe (PID: 2988 cmdline: cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7530535289870207342.vbs MD5: A3A35EE79C64A640152B3113E6E254E2)

xcopy.exe (PID: 2008 cmdline: xcopy 'C:\Program Files\Java\jre1.8.0_191' 'C:\Users\user\AppData\Roaming\Oracle\' /e MD5: 361D273773994ED11A6F1E51BBB4277E)

cmd.exe (PID: 3360 cmdline: cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5438807271024442592.vbs MD5: AD7B9C14083B52BC532FBA5948342B98)

cscript.exe (PID: 3596 cmdline: cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5438807271024442592.vbs MD5: A3A35EE79C64A640152B3113E6E254E2)

cmd.exe (PID: 2256 cmdline: cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive2024933177882465042.vbs MD5: AD7B9C14083B52BC532FBA5948342B98)

cscript.exe (PID: 3600 cmdline: cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive2024933177882465042.vbs MD5: A3A35EE79C64A640152B3113E6E254E2)

xcopy.exe (PID: 1908 cmdline: xcopy 'C:\Program Files\Java\jre1.8.0_191' 'C:\Users\user\AppData\Roaming\Oracle\' /e MD5: 361D273773994ED11A6F1E51BBB4277E)

cmd.exe (PID: 2816 cmdline: cmd.exe MD5: AD7B9C14083B52BC532FBA5948342B98)

reg.exe (PID: 1880 cmdline: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v bJnYSNphoio /t REG_EXPAND_SZ /d '\'C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe\' -jar \'C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG\'' /f MD5: D69A9ABBB0D795F21995C2F48C1EB560)

attrib.exe (PID: 272 cmdline: attrib +h 'C:\Users\user\KtXRptueuIB\*.*' MD5: 459A5755AFBB1CB3E67CA4C1296599E3)

attrib.exe (PID: 3664 cmdline: attrib +h 'C:\Users\user\KtXRptueuIB' MD5: 459A5755AFBB1CB3E67CA4C1296599E3)

javaw.exe (PID: 2524 cmdline: C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG MD5: 84C2540CEDB08C146D1AD06122E6CC12)

javaw.exe (PID: 2356 cmdline: 'C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe' -jar 'C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG' MD5: 84C2540CEDB08C146D1AD06122E6CC12)

java.exe (PID: 2864 cmdline: C:\Users\user\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\user~1\AppData\Local\Temp\_0.27057588722335616152848481378506703.class MD5: 1A4BAEBCD4466698D9FA846719405E92)

cmd.exe (PID: 2932 cmdline: cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3097055394604195664.vbs MD5: AD7B9C14083B52BC532FBA5948342B98)

cscript.exe (PID: 2288 cmdline: cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3097055394604195664.vbs MD5: A3A35EE79C64A640152B3113E6E254E2)

cmd.exe (PID: 856 cmdline: cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7103461586894408784.vbs MD5: AD7B9C14083B52BC532FBA5948342B98)

cscript.exe (PID: 1532 cmdline: cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7103461586894408784.vbs MD5: A3A35EE79C64A640152B3113E6E254E2)

cleanup

Created / dropped Files

C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c7cde.timestamp
Process:	C:\Program Files\Java\jre1.8.0_191\bin\java.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	51
Entropy (8bit):	4.782541459907691
Encrypted:	false
MD5:	288851B6A05E409CFC0B30704FC7AB8C
SHA1:	0809A0192EAF0CEC0CE0B863A079EDE758D46163
SHA-256:	4A8E5855D1B783A01BC4DA94E3383EC34688D9B0581736C450FB9AF5AF156FDB
SHA-512:	2258B327156FB86C27FC9994A68F24A2A7E4AF1462C7762FCB6793A346ECCB6506B6DE682DFDC3113FE2BB75DA4FE381BF72298A6982B54F32F8B995EB0DB71C
Malicious:	false
Reputation:	low

C:\ProgramData\Oracle\Java\.oracle_jre_usage\5aa636f3656fc02f.timestamp
Process:	C:\Users\user\AppData\Roaming\Oracle\bin\java.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	59
Entropy (8bit):	4.874440617914993
Encrypted:	false
MD5:	6C4BD2B5B307228057D82C84A327CA0C
SHA1:	8439246A0CBEE1E7B4705EFAAEFD39BCE9F74B51
SHA-256:	A121694C677208AE4F2618ADAB04BA3E15D0C4B418936E91C7C277AA569A8190
SHA-512:	66D58891E47B99D76219486418A4E773E4CE82FAE7CD60C9549448A4E5CDFC6C32960528EAD0A7BFD3501C86A10F01ED46B5F7052944E3E94A58D73C2D9C12D3
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\JDeYPIfBdF1937948184134835652.reg
Process:	C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	26405
Entropy (8bit):	5.327380832844874
Encrypted:	false
MD5:	A4C133612FCB6E3E26564594661C3338
SHA1:	D66C29ED684D6BCAA350475223F1723C4A151164
SHA-256:	280CE3F20B7AEC5FED72F96C5A26C6A99AFE5A5E041B507F92324D88DF24D46E
SHA-512:	FCDDF8291FE54FBF1630A766AD94B4E71B627B0A106EC817E4E2E555013E26A5C73A5A68FD5AF48562D00531D764FAED10308DC7EF12FDE034987A0639FC10F4
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\Retrive2024933177882465042.vbs
Process:	C:\Program Files\Java\jre1.8.0_191\bin\java.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	281
Entropy (8bit):	5.093300055314052
Encrypted:	false
MD5:	A32C109297ED1CA155598CD295C26611
SHA1:	DC4A1FDBAAD15DDD6FE22D3907C6B03727B71510
SHA-256:	45BFE34AA3EF932F75101246EB53D032F5E7CF6D1F5B4E495334955A255F32E7
SHA-512:	70372552DC86FE02ECE9FE3B7721463F80BE07A34126B2C75B41E30078CDA9E90744C7D644DF623F63D4FB985482E345B3351C4D3DA873162152C67FC6ECC887
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\Retrive3097055394604195664.vbs
Process:	C:\Users\user\AppData\Roaming\Oracle\bin\java.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	276
Entropy (8bit):	5.064973526456738
Encrypted:	false
MD5:	3BDFD33017806B85949B6FAA7D4B98E4
SHA1:	F92844FEE69EF98DB6E68931ADFAA9A0A0F8CE66
SHA-256:	9DA575DD2D5B7C1E9BAB8B51A16CDE457B3371C6DCDB0537356CF1497FA868F6
SHA-512:	AE5E5686AE71EDEF53E71CD842CB6799E4383B9C238A5C361B81647EFA128D2FEDF3BF464997771B5B0C47A058FECAE7829AEEDCD098C80A11008581E5781429
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\Retrive3836050317054246417.vbs
Process:	C:\Users\user\AppData\Roaming\Oracle\bin\java.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	281
Entropy (8bit):	5.093300055314052
Encrypted:	false
MD5:	A32C109297ED1CA155598CD295C26611
SHA1:	DC4A1FDBAAD15DDD6FE22D3907C6B03727B71510
SHA-256:	45BFE34AA3EF932F75101246EB53D032F5E7CF6D1F5B4E495334955A255F32E7
SHA-512:	70372552DC86FE02ECE9FE3B7721463F80BE07A34126B2C75B41E30078CDA9E90744C7D644DF623F63D4FB985482E345B3351C4D3DA873162152C67FC6ECC887
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\Retrive5143051978713924683.vbs
Process:	C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	281
Entropy (8bit):	5.093300055314052
Encrypted:	false
MD5:	A32C109297ED1CA155598CD295C26611
SHA1:	DC4A1FDBAAD15DDD6FE22D3907C6B03727B71510
SHA-256:	45BFE34AA3EF932F75101246EB53D032F5E7CF6D1F5B4E495334955A255F32E7
SHA-512:	70372552DC86FE02ECE9FE3B7721463F80BE07A34126B2C75B41E30078CDA9E90744C7D644DF623F63D4FB985482E345B3351C4D3DA873162152C67FC6ECC887
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\Retrive5438807271024442592.vbs
Process:	C:\Program Files\Java\jre1.8.0_191\bin\java.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	276
Entropy (8bit):	5.064973526456738
Encrypted:	false
MD5:	3BDFD33017806B85949B6FAA7D4B98E4
SHA1:	F92844FEE69EF98DB6E68931ADFAA9A0A0F8CE66
SHA-256:	9DA575DD2D5B7C1E9BAB8B51A16CDE457B3371C6DCDB0537356CF1497FA868F6
SHA-512:	AE5E5686AE71EDEF53E71CD842CB6799E4383B9C238A5C361B81647EFA128D2FEDF3BF464997771B5B0C47A058FECAE7829AEEDCD098C80A11008581E5781429
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\Retrive7103461586894408784.vbs
Process:	C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	276
Entropy (8bit):	5.064973526456738
Encrypted:	false
MD5:	3BDFD33017806B85949B6FAA7D4B98E4
SHA1:	F92844FEE69EF98DB6E68931ADFAA9A0A0F8CE66
SHA-256:	9DA575DD2D5B7C1E9BAB8B51A16CDE457B3371C6DCDB0537356CF1497FA868F6
SHA-512:	AE5E5686AE71EDEF53E71CD842CB6799E4383B9C238A5C361B81647EFA128D2FEDF3BF464997771B5B0C47A058FECAE7829AEEDCD098C80A11008581E5781429
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\Retrive7307749898854467482.vbs
Process:	C:\Program Files\Java\jre1.8.0_191\bin\java.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	276
Entropy (8bit):	5.064973526456738
Encrypted:	false
MD5:	3BDFD33017806B85949B6FAA7D4B98E4
SHA1:	F92844FEE69EF98DB6E68931ADFAA9A0A0F8CE66
SHA-256:	9DA575DD2D5B7C1E9BAB8B51A16CDE457B3371C6DCDB0537356CF1497FA868F6
SHA-512:	AE5E5686AE71EDEF53E71CD842CB6799E4383B9C238A5C361B81647EFA128D2FEDF3BF464997771B5B0C47A058FECAE7829AEEDCD098C80A11008581E5781429
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\Retrive7530535289870207342.vbs
Process:	C:\Program Files\Java\jre1.8.0_191\bin\java.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	281
Entropy (8bit):	5.093300055314052
Encrypted:	false
MD5:	A32C109297ED1CA155598CD295C26611
SHA1:	DC4A1FDBAAD15DDD6FE22D3907C6B03727B71510
SHA-256:	45BFE34AA3EF932F75101246EB53D032F5E7CF6D1F5B4E495334955A255F32E7
SHA-512:	70372552DC86FE02ECE9FE3B7721463F80BE07A34126B2C75B41E30078CDA9E90744C7D644DF623F63D4FB985482E345B3351C4D3DA873162152C67FC6ECC887
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\Retrive8871895609232326104.vbs
Process:	C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	276
Entropy (8bit):	5.064973526456738
Encrypted:	false
MD5:	3BDFD33017806B85949B6FAA7D4B98E4
SHA1:	F92844FEE69EF98DB6E68931ADFAA9A0A0F8CE66
SHA-256:	9DA575DD2D5B7C1E9BAB8B51A16CDE457B3371C6DCDB0537356CF1497FA868F6
SHA-512:	AE5E5686AE71EDEF53E71CD842CB6799E4383B9C238A5C361B81647EFA128D2FEDF3BF464997771B5B0C47A058FECAE7829AEEDCD098C80A11008581E5781429
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\Retrive964377326967163412.vbs
Process:	C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	281
Entropy (8bit):	5.093300055314052
Encrypted:	false
MD5:	A32C109297ED1CA155598CD295C26611
SHA1:	DC4A1FDBAAD15DDD6FE22D3907C6B03727B71510
SHA-256:	45BFE34AA3EF932F75101246EB53D032F5E7CF6D1F5B4E495334955A255F32E7
SHA-512:	70372552DC86FE02ECE9FE3B7721463F80BE07A34126B2C75B41E30078CDA9E90744C7D644DF623F63D4FB985482E345B3351C4D3DA873162152C67FC6ECC887
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\VcosuJYXVS8610624840901649984.reg
Process:	C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	26405
Entropy (8bit):	5.327380832844874
Encrypted:	false
MD5:	A4C133612FCB6E3E26564594661C3338
SHA1:	D66C29ED684D6BCAA350475223F1723C4A151164
SHA-256:	280CE3F20B7AEC5FED72F96C5A26C6A99AFE5A5E041B507F92324D88DF24D46E
SHA-512:	FCDDF8291FE54FBF1630A766AD94B4E71B627B0A106EC817E4E2E555013E26A5C73A5A68FD5AF48562D00531D764FAED10308DC7EF12FDE034987A0639FC10F4
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\_0.259951839382067235585996733401964613.class
Process:	C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	247088
Entropy (8bit):	7.977146417027946
Encrypted:	false
MD5:	781FB531354D6F291F1CCAB48DA6D39F
SHA1:	9CE4518EBCB5BE6D1F0B5477FA00C26860FE9A68
SHA-256:	97D585B6AFF62FB4E43E7E6A5F816DCD7A14BE11A88B109A9BA9E8CD4C456EB9
SHA-512:	3E6630F5FEB4A3EB1DAC7E9125CE14B1A2A45D7415CF44CEA42BC51B2A9AA37169EE4A4C36C888C8F2696E7D6E298E2AD7B2F4C22868AAA5948210EB7DB220D8
Malicious:	false
Yara Hits:	Rule: MAL_JRAT_Oct18_1, Description: Detects JRAT malware, Source: C:\Users\user~1\AppData\Local\Temp\_0.259951839382067235585996733401964613.class, Author: Florian Roth
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\_0.27057588722335616152848481378506703.class
Process:	C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	247088
Entropy (8bit):	7.977146417027946
Encrypted:	false
MD5:	781FB531354D6F291F1CCAB48DA6D39F
SHA1:	9CE4518EBCB5BE6D1F0B5477FA00C26860FE9A68
SHA-256:	97D585B6AFF62FB4E43E7E6A5F816DCD7A14BE11A88B109A9BA9E8CD4C456EB9
SHA-512:	3E6630F5FEB4A3EB1DAC7E9125CE14B1A2A45D7415CF44CEA42BC51B2A9AA37169EE4A4C36C888C8F2696E7D6E298E2AD7B2F4C22868AAA5948210EB7DB220D8
Malicious:	false
Yara Hits:	Rule: MAL_JRAT_Oct18_1, Description: Detects JRAT malware, Source: C:\Users\user~1\AppData\Local\Temp\_0.27057588722335616152848481378506703.class, Author: Florian Roth
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\_0.63493269659919425532230313552172834.class
Process:	C:\Program Files\Java\jre1.8.0_191\bin\java.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	247088
Entropy (8bit):	7.977146417027946
Encrypted:	false
MD5:	781FB531354D6F291F1CCAB48DA6D39F
SHA1:	9CE4518EBCB5BE6D1F0B5477FA00C26860FE9A68
SHA-256:	97D585B6AFF62FB4E43E7E6A5F816DCD7A14BE11A88B109A9BA9E8CD4C456EB9
SHA-512:	3E6630F5FEB4A3EB1DAC7E9125CE14B1A2A45D7415CF44CEA42BC51B2A9AA37169EE4A4C36C888C8F2696E7D6E298E2AD7B2F4C22868AAA5948210EB7DB220D8
Malicious:	false
Yara Hits:	Rule: MAL_JRAT_Oct18_1, Description: Detects JRAT malware, Source: C:\Users\user~1\AppData\Local\Temp\_0.63493269659919425532230313552172834.class, Author: Florian Roth
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\COPYRIGHT
Process:	C:\Windows\System32\xcopy.exe
File Type:	ISO-8859 English text
Size (bytes):	3244
Entropy (8bit):	4.504892344419146
Encrypted:	false
MD5:	A762796B2A8989B8952B653A178607A1
SHA1:	C725183C757011E7BA96C83C1E86EE7E8B516A2B
SHA-256:	79CCB53E0DBDB8EC16747A516EB77C3737C797E544AAA0A552B8A886A70EEF69
SHA-512:	9D88BD2910A0D7820732D498B11B4676A5A122F24093640D8F07D417E4D7077A3D411F5F3E96CC124483DBED9C940B9526CA8B19FBC7CE69CB294476FCAA6C91
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\LICENSE
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text
Size (bytes):	40
Entropy (8bit):	4.208694969562842
Encrypted:	false
MD5:	98F46AB6481D87C4D77E0E91A6DBC15F
SHA1:	3E86865DEEC0814C958BCF7FB87F790BCCC0E8BD
SHA-256:	23F9A5C12FA839650595A32872B7360B9E030C7213580FB27DD9185538A5828C
SHA-512:	AC2C14C56EEA2024FCF7E871D25BCC323A40A2D1D95059C67EC231BCD710ACB8B798A8C107AAD60AAA3F14A64AA0355769AB86A481141D9A185E22CE049A91B7
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\README.txt
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text
Size (bytes):	46
Entropy (8bit):	4.197049999347145
Encrypted:	false
MD5:	0F1123976B959AC5E8B89EB8C245C4BD
SHA1:	F90331DF1E5BADEADC501D8DD70714C62A920204
SHA-256:	963095CF8DB76FB8071FD19A3110718A42F2AB42B27A3ADFD9EC58981C3E88D2
SHA-512:	E9136FDF42A4958138732318DF0B4BA363655D97F8449703A3B3A40DDB40EEFF56363267D07939889086A500CB9C9AAF887B73EEAD06231269116110A0C0A693
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME-JAVAFX.txt
Process:	C:\Windows\System32\xcopy.exe
File Type:	UTF-8 Unicode (with BOM) English text
Size (bytes):	108062
Entropy (8bit):	4.811435820951014
Encrypted:	false
MD5:	52A7C0981FAC8E0F733CB1E30B51C956
SHA1:	7EE3A1AB81057CE7FC3630F6C91B4AAAC45A07C3
SHA-256:	A0D72CC94E484626258F47EB6FAD95FE55915D5BEA26C9226661C45E2111CD6B
SHA-512:	93759F34E810D594D9C705DAF38D74DAA1A8B6E50024E962521D4ACCF3521918C633BB731F324E13B5F1E6573878B7C7A08E395B8700C38714F615A32FA5D80C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME.txt
Process:	C:\Windows\System32\xcopy.exe
File Type:	UTF-8 Unicode English text
Size (bytes):	155003
Entropy (8bit):	5.026811075840244
Encrypted:	false
MD5:	4E3614950F0597935145ED586E1BBFF9
SHA1:	1DBD49BA8EF1233F1199E2F59C083ED0DF9B4501
SHA-256:	C92F827598A37B9DA45E5FA074D7949D54756344A68C47836EFEAC21551101F8
SHA-512:	8E7D118C7BE83AFEAD20BD4981E680861610BA4577F50588E1AB53312B4906247A5AAB06760C206820818E00E2DB9EC41D252A367CCC7C4CBBCA832B6CD5E0D5
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\Welcome.html
Process:	C:\Windows\System32\xcopy.exe
File Type:	HTML document text
Size (bytes):	955
Entropy (8bit):	5.096095653697231
Encrypted:	false
MD5:	810EF9BE9BDF09983D41E244A6179A20
SHA1:	D98AE54F03DAC87419ABC19B97E315830C2DA55F
SHA-256:	DB34008B34B4BC3177436E71BD01557D45D52E710699758AB227E5FEC7FFADB8
SHA-512:	3DA4DE8D7A7D037AA64F9A771C9AEB743D43839294ACB773CECB2BA9B0C869CF3D7F3E3BC41D803238F297647E85ABD43F596F1C2DF46579EC0A34263744E406
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\JAWTAccessBridge.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	15736
Entropy (8bit):	6.224305117035628
Encrypted:	false
MD5:	E1E243B45B9D03FD8B51E437FEFD8DF8
SHA1:	A5FA4FA3F43A61BDD59E39B84A15EA41D30957DC
SHA-256:	4C2A4EA81D4F60C6FBB75E24CE10A3CDF2B2FECB79C6F08C1A0A3619D5E8457C
SHA-512:	C96B9FCA0932E82FDAF6E1A93E4D8FE0BD1A115E8188A6BA272AE3A259764557E971C5651AA7ED494A8A946C79364E3AEF5860BACB73BC4E2CEA430BC0A89738
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\JavaAccessBridge.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	128376
Entropy (8bit):	6.424225586927584
Encrypted:	false
MD5:	D28AE18E362C0C0AF57AFA71AE443A07
SHA1:	1D088755E4527195DE9CF9FCE6F5B4F19FBD9239
SHA-256:	F7D97D1BB4601F459FF86F98D47D3391E015F7CBC33043CAFF2BF747F37DFF46
SHA-512:	25F53BCA9C9E205DF2E62C47BE7C69748676FCEFD5894731BE1BC47292E7C39EE6950418961C5C5331F6D8FEED130739580739B3A16D4944E64D5CD6AEFF8DE0
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\WindowsAccessBridge.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	96632
Entropy (8bit):	6.502606719923847
Encrypted:	false
MD5:	564068748BA60A2D5A1657296F9A9B28
SHA1:	17A764E3093280A1B15AE52572D7A24FC08AC241
SHA-256:	5A84A879B9352E6A24906FF61A46B0AB919F1E490A6CF4F8AFF41634CFDFA5A6
SHA-512:	47182C6F22111A1AFCAFD43B9289157BF28AEBE1422CD94C4309D64FDF3342546126B9000427A8D911FF237E8B5E038284D4513624D8479B46CEE1549290216D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-console-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18752
Entropy (8bit):	7.0810663289464895
Encrypted:	false
MD5:	F0D8A941B243DFA19440D0CE01566E14
SHA1:	868B89B3A8391125B397AF748F9A6B1650165708
SHA-256:	E80E97AE534151F473CF9538CC7677939C43098B78DE7881AD6731D33533FC52
SHA-512:	D6B6DFF31C0EF8D10DE330E6AAFE446824DAE02813CBF99CF41B93BA78113E2D603BA09A3E48E03283CE42A726313C131459A0315E19A969ACDCC05AB7109F6D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-datetime-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18240
Entropy (8bit):	7.091574260904302
Encrypted:	false
MD5:	E1A16C08F684C03DDBFA98578D5BF25D
SHA1:	D53C87CF5BBF4618873F79C08AE764583D99D2B3
SHA-256:	59F675DAA7D38C32252AC488EE4EA5472FCA891017A429E8F84C66B56AEA7D99
SHA-512:	C78092ACEDDA2EF5EAECD775D3039AE49DA643B3C35D93DEBEBB2FEADFAA169B554A90B1643CCFFDC1A4D84A2197DA35C023ECFB01AC30CC386C16781CAEEB27
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-debug-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18240
Entropy (8bit):	7.0967111096569475
Encrypted:	false
MD5:	4F65AF90C59D19B2167EEBD616562D4F
SHA1:	A8BE733B15F592BC7AC68C8ED166C6ECBA48360C
SHA-256:	94CD053637075439DBAFD70AF27A5B971E706E956EE200835F3D60B14906BFB6
SHA-512:	47B50FCF68D3BD3398D3D510DD6726A374DD993D619461B3E7A87C0EA142049254601946DCA2593DB454E0EEDCEB777206B2E454733C96011B176B63688BF3E1
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-errorhandling-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18240
Entropy (8bit):	7.130639173659144
Encrypted:	false
MD5:	E553577D0DD4686EDB488AD9A2BA0859
SHA1:	95F2F4DA9A36969F88CA5BED74DB4B4422F26406
SHA-256:	8A23E01FFB6B0D6B6A8674C427AC31EB4903A4B788B7F250D14574E71CC88E0B
SHA-512:	7CB0E8ACE710D70AD73B2AB24223AD08FE14FA04B6E657FE8A08DEEC35F275AA8770D0CA73D3C072514CD74C7B91AC1CAB5CC3E2067DED70A9A30593B78E195E
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-file-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	21824
Entropy (8bit):	7.012166534902136
Encrypted:	false
MD5:	941C4BA57CD6E0665A4758971F8CDE6F
SHA1:	A00D2E91EE3A1BABB4E8AB4A7D2D007E6BBFA5CE
SHA-256:	835CF5AEAB4E99B6448E5724C056678B42316EE36C48AB56CD263FD74096A2E9
SHA-512:	1E45A755FFBC5DA62903A539A0E6BAC058425FB1CA5DEAD16730AEEB941D24EF05FEBA2BC143DD8F574B7F593DB156D8F7AFB101E1F2A36A7CF090871525BAAA
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-file-l1-2-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18240
Entropy (8bit):	7.112778191239907
Encrypted:	false
MD5:	930E91E6D6194DB50733DCB57D4022A2
SHA1:	C425509067BA0DE9FB62FCB8E5FB420258E4E07E
SHA-256:	30F570E7FCA225CEFD7B9A0B40EC8D2AAD758931753964E02C447DF9281B4129
SHA-512:	0BEE7B032BDC3E130690069E5D00ED585E8AFAA82203E9DE2129ACB26A9F8164027B35CC2B15542AA318506C38E21F96E95FD7D32CABE8E6F1A238EFCC378AFD
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-file-l2-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18240
Entropy (8bit):	7.174391715585959
Encrypted:	false
MD5:	EE45077B01F50D5305B4298AF6252E6F
SHA1:	D2F934717D69B86C0C95DCDA63F4D4A1CBEEA6D3
SHA-256:	2D68465625D9230A2D9BD19E801FDCD10BD5AA9611B6F9BA282897415041BA77
SHA-512:	F9C74B594C7BB12EF56E1119FE004E40AD0A2BE7847BD44609BEAB45AF99CDC6763EC9B8D516F7650E808B33BE0CA74D1B1A475B983558F13033FCFBA1113E9E
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-handle-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18240
Entropy (8bit):	7.117400019336355
Encrypted:	false
MD5:	A368E277FEAAB198667188BA4E523A8C
SHA1:	8884362899CD4336FDDDE9678569F4F71357D044
SHA-256:	79F4E5EEB6C0B71435CB74C7FDC131C87982E6CC9597C5E474D3856D9DB9D0F9
SHA-512:	1EE62C842AB4EC8B3A9752A2DF828E0A0C9F62406883DB1F6A6A6785617F0A47EB0D43B50E6FC2AC3C727D21F5E315E1F73E917859FDCB6B3B6ACB4CA58120D2
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-heap-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18240
Entropy (8bit):	7.1760079881960435
Encrypted:	false
MD5:	BF2FB965E88041FAE28293D154B5B92C
SHA1:	85AA319150D5F546BEFE16739081964D117F8A8B
SHA-256:	2AC83374B0C20B493D615F52CEBA06A9220C4B96DF5DF92D73D2F940E4AEE12A
SHA-512:	B397D7A67E506D3CE4C0706F351868B110B3283E5F11EEBA1FD4249E8DB88967452130DBC73DFB994F06F0F643724DD2AFAF418E9C35C4486A33925DD02485EA
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-interlocked-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18752
Entropy (8bit):	7.0837886927647125
Encrypted:	false
MD5:	C25FEB9FF9CC47963A77DE4DF1FA3614
SHA1:	026928E2B449826C157D396C27BF0F3BA3ECA8EC
SHA-256:	8835BCBC977C06B037E85576924F0AEA75E00C9747D81851D6A8646E8C19D8A7
SHA-512:	B9B818B8F08C44E29D7A4B7ECE3F6D8FD55E240B6D1C6EB6AECCE36F2212243B45B5550121A21730C87B51175FC558DBD74ABE8130AAA439E33A0DEB0FF22838
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-libraryloader-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18752
Entropy (8bit):	7.133011342440724
Encrypted:	false
MD5:	D5AFBA750E9EA186D1715D556B204295
SHA1:	0B22635C34F005CBDC88053DB04C63A189044C47
SHA-256:	A0EFAB7054E736250B984EB224950D0830784C0FF84D49DD2C5E6B34A67D2042
SHA-512:	9F03D2E76BE13C2AB01F1EA1B159FF03E1476DBADAF28C97219C20BAAA5396BCFB68BB7D72219F69FDA95EAE57548D68C33E27B8A140B715E5A8540868C3F9FB
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-localization-l1-2-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	20792
Entropy (8bit):	7.092161163039827
Encrypted:	false
MD5:	713493BB9A62222C56138E6ED8D5E037
SHA1:	CBEDE8DB7E7123509CB64E6D926B9867724DAC7A
SHA-256:	53DE3B7081BF03DC2BEBE56573C621FF1D7EB5FECD18D7D88C5F3956388EB17A
SHA-512:	CDF29580E971341767E01F609892D0B062895A3E1DF18570CE0631699CE58A458FEE934BCB33F91334A66E2D8AC75401AB8E3E4C2D318459661F7F12A5B9DDA1
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-memory-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18752
Entropy (8bit):	7.101896448928625
Encrypted:	false
MD5:	8D621AD2223D44E2757836365128E13D
SHA1:	EA5388AE582ACA5A611EE9A4A36AB3E660C53DD4
SHA-256:	24C097ADAA5F30092E14423E8F9071EEE72A4C65F0C7D2EEB1221281B84B2E35
SHA-512:	4B031E2E8E7EF8FDBD52DDFBFEF445A37E8852A0060C4E0E76782B4F496A34ECC368CCD71BA76F1E94C1CC51E3335DEA1F810E62BF3F977A9A77C814FE603F2D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-namedpipe-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18240
Entropy (8bit):	7.160000452682858
Encrypted:	false
MD5:	4E93D5E74133E7B91802928A803B5B2F
SHA1:	8C69CB74CD044B7EA2E74F281889533C421F6E75
SHA-256:	FC697BE2C121FBA56C7AE93E5317AD0ECC1C0B00ABC4E737F6D370EF01604712
SHA-512:	5AD95C1B2584CE100B42B693B225B11D5063C00457CB1D07D9026130439AECC9C59538C122E825443EC10E0A6365783E69C036BDD1D1EC00F4FE9D4848950EE0
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-processenvironment-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	19264
Entropy (8bit):	7.072544635656073
Encrypted:	false
MD5:	B67042CD04B1A5F830A40A71E462CA2D
SHA1:	D2D04DC872704658FA18222BBDE14FB8EE302EEA
SHA-256:	3FDD14144406F7258A40268BB1BEFB83507D001ABAC73EA0BDAA018749849FE4
SHA-512:	78ADC0D84ACA7745239BC43A3282B36A6E19163EFAD5DB6EF6D8BDD9608A2441FC12614A04523413FBA82C6525C7305AC876692C0A54E15C4BC266E238048D22
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-processthreads-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	20288
Entropy (8bit):	7.094737794183928
Encrypted:	false
MD5:	57A4CA876C0EBD029E5E7927C68F62D6
SHA1:	9FF05995C27F44F88F1EFE1A634D64D2C2F9572D
SHA-256:	013BF69AEFBC32FDE69221284FFE32FBD598A42046D6BD23A2E8E94054363C4A
SHA-512:	0780E074ED7AC3DB8B7B0C592A98B247EB2C59F4F3CFB16CE771118F157AA4F9CF31210B093087B41DE1161AFF8F91BEA4861E3ABECD4BDD46884B8C4BC2E89A
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-processthreads-l1-1-1.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18752
Entropy (8bit):	7.114117715819674
Encrypted:	false
MD5:	1AC7C36FDE6F06C85F2286E6F2281448
SHA1:	20F83B9218AE13AE668B148CB2F75852EC08E121
SHA-256:	26FAF205E7CE1FEA1439122D25C91FF051EB1F4BF0D80ABD8B9AB8E8482214B9
SHA-512:	9DFFB74DB75601D75E8F456497EF8357858ACF26CEAB97D33828A02646BB33E6A7DAA5192DC69AFBABBAE95C6D7E692F2F840275CCD1CA03D7D88053D72A66B6
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-profile-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	17728
Entropy (8bit):	7.193731925061406
Encrypted:	false
MD5:	22DE9BBD143CEC58F2CDAA03B698C721
SHA1:	D5F312D2F008E5DA8FC4CCB6392729F8E8296508
SHA-256:	B20410F6214237DCBBDC1DA6EBD1E03CC6CEE33BD5C217BD4C1DA6D334C5D793
SHA-512:	5E92ABE5915F9879A4923B063151593D52976FE718C077E9040A75D8349560F1422560C6DA5DB7E630E578327BA952A7E6DE1570859756DEAB096E3B1AE8CA8D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	17728
Entropy (8bit):	7.194583217729442
Encrypted:	false
MD5:	4E73DCCB3130F2D825D2069BC143C9B8
SHA1:	0CBC704E90551FD117BE8BE4CAAF4865007DE00E
SHA-256:	BD2EDF7090299D85EA219C44FBDBA831A84261F1305F08358DBAAC2A0E500507
SHA-512:	27A43763441E788EE450FB6F0EE75A0457FA26D47A2EBB529B1BCD7EA36E9B185B53D8A7A61A3B25061A0C171666EC2E01682547CB4590372E0279987759115D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-string-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18240
Entropy (8bit):	7.13688521021941
Encrypted:	false
MD5:	508DF4E7A40A5CA910B5E6FA3DD877EF
SHA1:	27D75286193C8D91655D19C67D08C49E3438E8E2
SHA-256:	475CAA8E54DC93B933FCDCC6AFD9E35F75DC6D48D5F0C6FFAE8C885764901D93
SHA-512:	8A5BDEEDD354883AAB7820D617A646AFB6801C1FC4A134881E343FA3EC8E199C06523A4952541BBBC6B66F28A8B15D00B20D36773F1C6F635100A771700E164D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-synch-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	20288
Entropy (8bit):	7.050892252496667
Encrypted:	false
MD5:	F084D6115689B849AD3113D6D99D393E
SHA1:	6541381963B0BB3844AFED22AD4150E98AD087BD
SHA-256:	2B6C0B3A1395411977E25DB7CAA2B84EDD65C21E174C269499CF228FE36EB489
SHA-512:	124391A75C055E3CB545D2E73848BFACDB09DD8ACFD2EFACCABADBC16E405D6EA20BA1009025E1B3D12A999663CF275FCEB9964C766B364FC70B3E411A4B18AF
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-synch-l1-2-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18744
Entropy (8bit):	7.142013883114173
Encrypted:	false
MD5:	C3239F53C82DA5F4CDA8AF4A62150D4D
SHA1:	973C680B5D7FDF5BD856319F2E85890FF91A320D
SHA-256:	C72EC11B28990C61917D94E0F9AB7ACD9823D3073217AEE76C3FDDDB21C87476
SHA-512:	9061D8D5841A1EFC3BE9C8FBCDF57A6876FDCAE4EA2837D0FE304359783E99D5743CA86CA46D10EC68CE581B095C5B013542F0FF5424ADAD6B491DF8AB54EF71
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-sysinfo-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	19264
Entropy (8bit):	7.081326908256981
Encrypted:	false
MD5:	F899C0C2CA8D7EB1BC2AB9032DE9C683
SHA1:	2F0B6170C0D5DC1BEEADD0E5CE4B1A941B3AE40F
SHA-256:	BA5366936B00980D7AF18523A2881E030BC95DBB278AEA21BCFD041F33DA3176
SHA-512:	EB239A1817999EB78C4C088023E615688554A6B15E5E155ABB98722A6515B64FE85152CA2E41A740C59EC43F45AEE654CDBF08F3F65CC01A103A7524F652E984
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-timezone-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18240
Entropy (8bit):	7.174026198319426
Encrypted:	false
MD5:	22C9664D02CB3AE7EEDF856C8179BD47
SHA1:	7A528BB7E1C53F3C85D60EA70D585AFCDA368ED5
SHA-256:	F3423D639BC1EC08EA956972CD9DA00CD9F9D8DDC22C783246D0CD08F0524934
SHA-512:	A09A2FB6612AA8F2CE90D2FA4E6191F503BB0FDEDC9E42FC2DA5C11D25912E8654472A048918BE9181C1179008C5D31A6F05E94636591A707C0BB30EFBA0FBB2
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-core-util-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18240
Entropy (8bit):	7.097841151614963
Encrypted:	false
MD5:	1A0B16514AEA8B07DE1BC4718D46A943
SHA1:	C2C931F3BF6DA14F7CD6D843B64A5A567F2A414F
SHA-256:	78B28E036975C623615FC78041391A521854DDC8BCE63A4B6A99CA423F285F8E
SHA-512:	93C3F53970EE43D355CD6B3C624536CB40A54823CB204F96F60250735623CE834A04FBAE6CB2C4FD7A161D61154CA7C0F9F94EBC21515FEC3B4F13C14F804E52
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-conio-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	19264
Entropy (8bit):	7.093240064714721
Encrypted:	false
MD5:	7B8FA504E42525B47A6B9F5A9C18265D
SHA1:	5B8951A7EC59F8F20C60BEC8596FA51E1FFCA68A
SHA-256:	C9E0A88DFFDAE42CA07767711BD7B8BA830DE2A5E9F233332399DF1C3294B165
SHA-512:	EC3F101CF116F80BFF8377628321A5C18F437DC6AE144A6D3A4490C28D54B94E993BD6E104CB9364BE198BE7016A680DEF0C70CC19D13D3E7C54F07F9C950F62
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-convert-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	22336
Entropy (8bit):	6.926398692290261
Encrypted:	false
MD5:	2FE34AAEB7BCF84A4A26A2E69C0B2299
SHA1:	08C786ED7B820F6191A4EDA129C49A855DAEC492
SHA-256:	9D0499795E8943319F0E4F457A794308CC4EDB5C74BF046F5DD37700E3E841F2
SHA-512:	E15070904995C4ADB2CB82558206FF1D90B6882BCE371893582979382CD4AA961C173DE8D646AC7BBD0A66A7A8BFD91172FBE5BF4565B3BBCD09B21825B5E39C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-environment-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18752
Entropy (8bit):	7.085898690473
Encrypted:	false
MD5:	38968FE6D6B036D99EA428F68ED236AA
SHA1:	F37D0338EAF88459307E54855610D3C2EE049305
SHA-256:	C5CB9B055CAC1A0246BEA41ED367673EB4124F7F2C035199A27CEB3C28FFD490
SHA-512:	4B99B8EC1AAFF85FA077BD93EA0BBE0C0E1683BFB03A00D0AD98761B9227E08AA9222F617C97E331B0657B559EB59850ED1B46C34A6D3C0E677F3D6DC479724A
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-filesystem-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	20288
Entropy (8bit):	7.08841223030525
Encrypted:	false
MD5:	E9EABAA5120922A7B84CF86ADA0E518D
SHA1:	48E51D6DE2258E4E65124C5ED28630BDF50C243E
SHA-256:	9D747B8C54FC7226A2455102B0ADEEFB53ABA1B65C992BDFB9EDD6D7FEFA1169
SHA-512:	B42ABDBF3282018E267E5664463A49FB0AE48F4A0ACE05DB23BB682D99AF84187A19D81F233AED7352244DC33F0D5845153AD95C824D5C85FF2DFD4ECDC757FF
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-heap-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	19264
Entropy (8bit):	7.060316385841668
Encrypted:	false
MD5:	97FB42EF6AD5463B0DB6FB6E515E07D5
SHA1:	F39CA2E1597253567C80F2EE0387463D961ED0DD
SHA-256:	0E4F6C9A1E532A37A0701BC9AC67B86D5AF3D7FAA1D799196C93CCBD1D32E396
SHA-512:	0AFE948189145D0F3ABAA49DA324B7CACF07E6EBC133AEAD9D43D12A08BC6EC5EEE1280C64CE22E2061ACBD72AB05043B8B8271FC8B2440D6AE432AA74321C8E
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-locale-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18752
Entropy (8bit):	7.1374628698840885
Encrypted:	false
MD5:	5017D7F584EBD7E4A3A32A391349750B
SHA1:	5D112C0266E4AB9BBBC9CF7327979E646F3B09FE
SHA-256:	8CF7B2E3B8BF206EF93A8D446CAA445E9D79080B7F01102B12F34483BCCD7A39
SHA-512:	ED9FD988CBA4A958C522468AE617021F7FC27DC1EC5E5CB5F64694DF9AF351F99D07B3F01276B1D1401D3B8487032B41502AEE03CBDEC8A5F105C312A5F4F01C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-math-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	28984
Entropy (8bit):	6.670430031833862
Encrypted:	false
MD5:	DFD5F6FA90800C6FF99B340906320693
SHA1:	A33D770AED45DBBA8089E0DE762A362E19CE7A67
SHA-256:	15100C9758342DCB47E51346831132337142DDF3C586607D1300581A54E3B64D
SHA-512:	631155C84B186D3529914494E9AF617AD712AB8A8508022C19F0F899D315E13634587D69F67EBB440F38CF75F250CE6B6BB36BD50527270248FEC6F761D0E5D7
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-multibyte-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	26432
Entropy (8bit):	6.717994719296654
Encrypted:	false
MD5:	5FC8F2D2FEF6549A40C26D51335C27EA
SHA1:	69328A5AF001F010717B79E0A6F1E17145571DCC
SHA-256:	641B2B2174159A164A304550E7C7A79250364FA8864FA1C66BBD178D9E6F10BE
SHA-512:	C0165A2D9573956259DF536B53051367B3555A407F99706AFF16B08AE0A402B71CF601D03FA90A7BAF853257C78C9F498CE1AEDD0000B582C6B0D9052B2016AA
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-private-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	73024
Entropy (8bit):	5.840490876978267
Encrypted:	false
MD5:	D2BDB526869F2D61CE14BFC32F27BA71
SHA1:	F3F11161DB2B430ACFFD546C31BCCA779B5CC64B
SHA-256:	D4D9059BFA135447A3FED23064D73A09FB9643FA225C782A77237E31A4DDF6A4
SHA-512:	5562B8E94AFA96C60E2D07B2BE90FBA03EFC4AAAA9687418022BDDA41FCBDACC63E57397614DCD848FA6154CCD2283597BA3F7DD6B4397A079195972E5A4B723
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-process-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	19264
Entropy (8bit):	7.078008771927226
Encrypted:	false
MD5:	5A3338E7E23E6812AB77784A4EEC4308
SHA1:	7AAB32B6D72F3AC2C5F278EF636333FD5E461598
SHA-256:	9813EBB3F7103DBE9DB40D4C00CD5DA6045CE315542E7DE14F061E101644786A
SHA-512:	FC1ED672E6E88D978157CD0A456A819110149A7D4A3E3C77AFEA2607D021D32FD5DDDEB4C4D1058A0FD5D5857AE251A5DF6E629FF77CD149D201F707C6747CAB
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-runtime-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	22848
Entropy (8bit):	6.94607589285414
Encrypted:	false
MD5:	614D4EE35D5E0A38394DCAB2F7F3E062
SHA1:	5D6F9E2BE80057D3760BE90AEA540B8271A2E594
SHA-256:	756F21A051C771471C790F9BEDD859964C5723B92E7C9F857FEDCF359389533A
SHA-512:	23663A433D10BA2644F1180747920FCCD42F755C86AC44D2FE297722AE83C3DCFBFECF0109ED720946570B46DAD4A698342121ADC61C34A1481FCF1D80BC56F4
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-stdio-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	24384
Entropy (8bit):	6.873080612681595
Encrypted:	false
MD5:	97A0C21B7DA8D4000D8FD4A2DCB6636F
SHA1:	D5F3213DD7302013FB4AB3C37E3FE3D8296C7C2A
SHA-256:	1E609CACDF71C71C55868D4E2460C4082F5BBB1299C1DF110E6971CD460A80A1
SHA-512:	ACF4C73D936BFD1F08D4EE78A73F845EED5C9E8B01D5423F99CA9A85DAF9A4B214AF12F6D71872431F346A0C13CEE4DDCE7C85F55DC11912478912EEDD4BF65F
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-string-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	24384
Entropy (8bit):	6.869629112973116
Encrypted:	false
MD5:	24181BFED98C9EDE05A5B72330268D32
SHA1:	EA6C83FB3063271D98EE8713554644F7438D9DB6
SHA-256:	FB78D2CDD71F4A9762E9ED3621A3CE0CA9A5DA6807D52610D640D534469B5A29
SHA-512:	5426B3A33A8B0BE4E48C43683489D3CC32D6C3431EE869366726C804A0A2BD2AB4DFC1C6F84F11AF9EF632D43E5FD09EA67A4A31CDF160747CF71DF8D7FED7B2
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-time-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	20800
Entropy (8bit):	7.014068058168618
Encrypted:	false
MD5:	9F07488CA21FA3A49FCDABB750F1829E
SHA1:	988D6DC1BFD4EA3B91D14CF8BDEED623DF346430
SHA-256:	94C34991BECCB8981E1A14671F8441182191761205A2FEC622089162667DB4C2
SHA-512:	8D19086F6C1FE8EE9D0729221F58270C528084638D0A26186667916C6870ADC70F0B7739B0201371C297F9A4EF2619FE9E16867E23822E55F985B69E19D1449D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\api-ms-win-crt-utility-l1-1-0.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	18744
Entropy (8bit):	7.127060472316145
Encrypted:	false
MD5:	026AC640F7193E491BDCCAC1B3379C99
SHA1:	B233114C0DEBF4FC4574D544DDB6A7DD4AAB9436
SHA-256:	0D03BD0A77AEA1475E13D5A265B79CC56B731D99480F123C33A53592466E4683
SHA-512:	B0B9E2D8AC07BA4E6B32234FCACDA85DB7B0D04320D91464099FCCE43281C6AC4F8EBCB8B3F30571CA69970B17CE476FD2FC3FFBA39E8EAE13238B21F68ED011
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\awt.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	1187192
Entropy (8bit):	6.644728701453138
Encrypted:	false
MD5:	7C8D28C3F4C2FA8C08CAA77F9713A275
SHA1:	FAD3092266AEDEFAE8BA8DDCE807245294559961
SHA-256:	FF5890D1A98544638986A7FDFDD99CDC7E31196A2B1B3E7E035806EDD4C6CF28
SHA-512:	AFB2AF956A11BC55FBFF744038D07DEBB5D45D980717CA117C4D3A096304D443730C1D0DDFC96FE134AF42AFBC8F524E1CB56AC857A5C758B37AD7DC3E5BB1BD
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\bci.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	16248
Entropy (8bit):	6.458076528710725
Encrypted:	false
MD5:	DC72DE6BB52D19BB97F749E1D455C769
SHA1:	42E5507D0B866F80393BFD6D3F93533C5C3F5A7D
SHA-256:	E0B0C5F06E6169D487A40B04592F813C4FB62F31D852654AC8BF18B6BCE2FD39
SHA-512:	3D8FF4D7BFD19949F2E5A681C227DA8D56D4B60BA745AD38FB671D52D177FA49EFAEEAB54A94FA555729609A4E0559F9680CF1F15B9B387E172A633A7D550761
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\client\Xusage.txt
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII C++ program text
Size (bytes):	1423
Entropy (8bit):	4.176285626070561
Encrypted:	false
MD5:	B3174769A9E9E654812315468AE9C5FA
SHA1:	238B369DFC7EB8F0DC6A85CDD080ED4B78388CA8
SHA-256:	37CF4E6CDC4357CEBB0EC8108D5CB0AD42611F675B926C819AE03B74CE990A08
SHA-512:	0815CA93C8CF762468DE668AD7F0EB0BDD3802DCAA42D55F2FB57A4AE23D9B9E2FE148898A28FE22C846A4FCDF1EE5190E74BCDABF206F73DA2DE644EA62A5D3
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\client\classes.jsa
Process:	C:\Windows\System32\xcopy.exe
File Type:	data
Size (bytes):	12976128
Entropy (8bit):	5.087918153860169
Encrypted:	false
MD5:	4A66B6532008FCC04423C6180A22AED1
SHA1:	D36805E223E7F021D07633C1C3E60F0329EBBBE9
SHA-256:	0B6BB0B896F52921EFB57243D7F4A34097F1D11440DB45E16B94679EDA3619A9
SHA-512:	6A855AD088567030797EA4FE2C4747185DD556DA1154A8DDF912421710235E47F185EC25084A14421380DE9696F9A5CB77B276DE55E818E9EC48A4A888E8E6D6
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\client\jvm.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	3886968
Entropy (8bit):	6.861481782045105
Encrypted:	false
MD5:	E301320478E77149730412B8A6543109
SHA1:	5172E50ECAC49A822595BB7BD190DFD9A64B89F2
SHA-256:	9A594FC76C2369D86C422FC678C35D09C720BF917FCEA040A7CCCF7444BF60FD
SHA-512:	F90B1F9C0CB9A707474D18EBCFF01D29EFBD0DE078ED97B0D83B7F6706269D57E0BABE34977728F3481BB3AA49563E9E4238A70D1A9C15643D3C048EDA0F1522
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\concrt140.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	243016
Entropy (8bit):	6.687284757607745
Encrypted:	false
MD5:	F0FAACD505C45B84534EEF1D29B7538B
SHA1:	57C6FFDCBAB3FE593813A2D9C7E0CC2D3AE1A18D
SHA-256:	3436EDE160F6613D24BC48D3A29C41A90BE9E1091A056F2227000FCA5E40516A
SHA-512:	F75484EB374C14D9A87CF0ED77A6444CA45ADA4A6B549FA989A974A98D18DE896EF1EA0C28AE583173CC47C4DC68F801125FC4123F3926C5F00E35A62F852CC3
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\dcpr.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	143736
Entropy (8bit):	7.356877533062866
Encrypted:	false
MD5:	3E53D78FFBB36A49DBF24E0FFCD69587
SHA1:	C80C5778BB406619B7943B60EC74FBE7278026A5
SHA-256:	9FE3D0C3A3E9A2EB919B428C9258553D49451834F36EA7475A17D6422E99A5A9
SHA-512:	A3031781B9E4B8F62B568B093A03E4BAF9E5EEB9DC260CA711A641AC7DE9712D471B083ADEFEF74D105319B87107BDE8512949ACA4FB440FB362DE82658D663E
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\decora_sse.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	65912
Entropy (8bit):	6.398245068772495
Encrypted:	false
MD5:	E59FA862FB5E427281F9123DDA284FE1
SHA1:	756B6FBC57F8FB3F1E88FC2BCCA2960A86B5D1D4
SHA-256:	E7A1A97016764772330DABBFCBFE34E9C893BF1F5A029841FE457C6DFDD971E7
SHA-512:	421C86A6C16AD45270516853149C9A32C600D5DF53386705AD13F1C94DFB867D886778EAE1F2632861A42AE89F67A0CD6CACF1513B150D7EF21FC6CFE2A884E4
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\deploy.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	467320
Entropy (8bit):	6.519713802297683
Encrypted:	false
MD5:	4BEEF3C1EB89956A619551979B806C43
SHA1:	3C7EECAFE69FBDAFBA27058AA6B2DE6870EAF3B6
SHA-256:	2AAF4246C9C5C56D442F8C12F3A25C7A7BC7FBF7DC96A002FA8FBBDFE36BC8E0
SHA-512:	1DD6CEF0BCFBFB8746878B701902E445971A37DBEE7B19BE07E065BCE4CBCDC5279900A9BD53311075071670B73820337221FB6F2E86762F4B3CD22EB56446BE
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\dt_shmem.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	25976
Entropy (8bit):	6.687310196060921
Encrypted:	false
MD5:	FAA3CD89A2A94505DA635FFA6257DAFA
SHA1:	A2CEC22FC036960365E723CB8C6B48CCC7C21440
SHA-256:	6DB6DA9499CC4C9CA40CB96400A04B0933E1BE0D8D7FF4A4757EF846D6498D2A
SHA-512:	B889E5F0464A96FB5A53A83C43DA5A29BC4F123069D55F62CDFECFA2158EAF950628F14B9DB7FFD834765CE0C5ACC215AEC3D5249E65962E44A952D80FA95C80
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\dt_socket.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	22392
Entropy (8bit):	6.644831524005314
Encrypted:	false
MD5:	1EA139C9727376AA7428FFD8537650E9
SHA1:	06105CCC5142736542A6BA793F8D2C7283D017EF
SHA-256:	FBDB59D94837B6BBF22FAAF7B20ECB7C7489E4915DAE660BC27B694654F0ED72
SHA-512:	FD6261F7B98C7BA864B2B6ED96496EECAAF143AC70E2C36E6C1DFC6FB6C16D525009EB7FEDF93CB8C9F091891CD56A6D89D8859E1F4D4D90878DD8C7A774953B
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\deployJava1.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	842104
Entropy (8bit):	6.033474427158569
Encrypted:	false
MD5:	2EE6B3B59378C448250C9BF6FE35555E
SHA1:	5D8B5A6A547EF7FB63CDFE540FCDFE394403D951
SHA-256:	C1D0C211AE8BE09A2DF846C62E4AA498E9AA3E7E440E27D2D9B0168345E91576
SHA-512:	7BA516D5610508DAC0FEB5B88BFC9D5282A8268533F1452F86204FF36A7111AE913F561EBA82E37813C1E7A27CF16B21BFE82FE6E08B5B68E76F2706865B6BD8
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\npdeployJava1.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	925048
Entropy (8bit):	6.185264757004177
Encrypted:	false
MD5:	A7AC8B0A6AF8E231691916E04B7C6C76
SHA1:	3F9920D0AF8E7A49A64071C5454F2B52BA596F86
SHA-256:	4D8A8CB37EF56063275CC89505F6A63A93B54B2B68D51A34F7508A1F6BA748E0
SHA-512:	8D319C220B25AD37CC95EE504FD18DD2D2123DA93BEF60EB0CD204E77264F9C40C2D66763ACC9F37F1A3D5D6D6C90EAC303756CCB6D2939F8548828A0AF981F0
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\eula.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	109944
Entropy (8bit):	5.999762937265523
Encrypted:	false
MD5:	5DBE4C2BF700ED17C4A098BAE7918DBF
SHA1:	549D0C6054714B0C5210C1904CB57C23A0FC701D
SHA-256:	08AB0CAD1AE637A24DE369DD7D0E9924F928651CBFCCA8375B9314FA961F212F
SHA-512:	61C6DCB44148F3496548B28880EB90DDFE49ADE2E3A0864B87D82A3670909D16621CA2834329928D575D5F8A2ED249F96EBC7B98C0CCA42E01D837F6455476ED
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\fontmanager.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	224120
Entropy (8bit):	6.5149499373714574
Encrypted:	false
MD5:	A44369AFB95176B702C38B524A03D9B3
SHA1:	A21B1C0299A419F1A55F0F7BFF8E01ADF7D889D3
SHA-256:	AA73CC3ED19D24C611186F152D2EC601D043AC758D350966AC6CCEDBBABA858F
SHA-512:	A706F6A18997C0E7309BE22E1E1C42733C897BA61C520303BA812898DEBA7253AA26868032ABFF54BA76A9DAE37B00AD129AA2FE3BCA987F3913B1943F19341F
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\fxplugins.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	153976
Entropy (8bit):	6.550907325825214
Encrypted:	false
MD5:	ECC5B3BD08B33795AE4430293D6BDD35
SHA1:	86D3AD4245B707E38C3F6E7E793FA94F5CB01464
SHA-256:	3C918EF3A3AFF8783FE216E4996E00B284E23F43812D37B541BFE4E0BE1E4875
SHA-512:	F71E871E6C5E8C68A725E4B08CB1F6C00ED7D99719B5C82FFABE321AC988A1CB88EC24B51E5218E43F4767F6651D59BE3151C81EE4CBBA8DF7A5863E1EBB8B2F
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\glass.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	216952
Entropy (8bit):	6.410597996583332
Encrypted:	false
MD5:	39A485679C2B2752E1F679CC2C762F1D
SHA1:	3D35C0938AB6146368EB0B98A9639210F42B0ABA
SHA-256:	AA0570D04969C83B14BDAA1BD4A54B2DFFE675E0A689288CA254A7503F8FB9BC
SHA-512:	2AEDF2338A3F66E68DBCCCFB5AF2E88817DDECDF894F9F9667C839C3941553E89F824EE14B93ECA941DB4EF328C5F4A5467BB73517179F68BCD272042FDE6176
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\glib-lite.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	579448
Entropy (8bit):	6.206657530816119
Encrypted:	false
MD5:	3AA32095B329637B64E4EA995CDE7015
SHA1:	2006B17A45581BF2A32BFDDEDBAC17EAB1D6771D
SHA-256:	7F96F41DB37420799B090CB0A787E096835B46EC201FEF82DE033A615A80292B
SHA-512:	4CD8A19997A25A622BACDB6ED4DBF03E3E3363F60F9D4B118550E1F5DFFC5060F30DD0B6DF4E09733EED87273B64459E4F974A557E28926AABA8EE2767198292
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\gstreamer-lite.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	737656
Entropy (8bit):	6.753169915168224
Encrypted:	false
MD5:	EB8B7DE0C2EC9A950C30A8BCB42AFF3E
SHA1:	4705374DBE7C37B6CA849EEE7430D9EB71FC04A1
SHA-256:	18350912A2FBFEEEF288DD63A0B43FB83F4D59B1C5302152551062990B345A1A
SHA-512:	DDDB27E0829D5B2A80C991AEF95F3DEEC33A417983F1B2146338FB377E6CD33AEF475A95AE6ECAD6DE0607261D32662B33934B0A9C7A19C6DBD1553E03B4731C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\hprof.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	132984
Entropy (8bit):	6.734303033714103
Encrypted:	false
MD5:	C672D0DCF1FDA285601B47C340A6494F
SHA1:	D63C937EC1786AF1A8D12EA2F1D9F2FA092A8244
SHA-256:	DADC7F4EEEAFD64C5E22F9EA8B337B36C17675DE589192A6E7E07A8AA5A7759D
SHA-512:	BFFB30126302201CA4BB350ABD7342EBC930499C7D7C38476D0157E3CBBE1A78D851002D0289FEE436861F248101CF4F659B54FA741A5420B1A7D1971C887A94
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\instrument.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	117112
Entropy (8bit):	6.791519763958959
Encrypted:	false
MD5:	7FE96922848D55CA190CA5D129C1FA33
SHA1:	059E09B4BA745846DC9FC76F7C6AC2210A4D2B7D
SHA-256:	7C9C58821093C417217CF26B2EF81015C86B7B54C1AC92232570F497F8E777FE
SHA-512:	2B6EB230EE913088D88F057055B18444931E6D6B074326E1F7E8FFE08CADAFBED131C77FA19E93570B2AF9BA07A8CF750504F3FD2B09C1E3E2FCA354ABF2CCCC
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\j2pcsc.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	17272
Entropy (8bit):	6.549556435174573
Encrypted:	false
MD5:	F0AD0648DA20524424E01793584326E3
SHA1:	5ABB3D6422B8CB85354CFAA7D004261D663D21F8
SHA-256:	228471BCF807DA96D228968736686C6EAE8288D046EA3E1D6EC9561DA0248369
SHA-512:	9727A93A6CFBC4012C4FD926A183A8AAD127478D9FF3B6F36FFAB19C895C5B52878D1A4907218603E68FFD10F969F3E15534626C9BC1ECE4475D55009A0836C7
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\j2pkcs11.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	52088
Entropy (8bit):	6.597193167478412
Encrypted:	false
MD5:	9433CA3EEA807F005E614B2B479C2F60
SHA1:	7709850E15B8819E1FAD89C3DC15B513DABD5CA3
SHA-256:	686BD68CA6CFFCED24AD2E2B3432709B3DB2ABF6D60A5AF5222E6FC0AB67F2F6
SHA-512:	EAA68B2D66D18B9284D5E12370A05F34F5B259BAE151D30E82C9CF0C932D63B75693D8D006BCB02F7C1997248D0B5A08B75D7782154C3EC0D7F9208620053A41
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jaas_nt.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	20344
Entropy (8bit):	6.451605063689161
Encrypted:	false
MD5:	E9CCA543E14ABDF0471CC640C0E9F654
SHA1:	5ED55E184324A5D5F20BA3187AF65CD8A2A04D8C
SHA-256:	806912BCE9C7896A135DBBFDA9998C90DF6C3D7E87C4901C8D4FC8DE7A523AA5
SHA-512:	20D9E8AA90B5255B824205BFF06A9CFB8F8598B10D5C5043BC6D7549F6184249D37CD3378F9258FFDAC5BADB8F96F54A2D166C88B03B43BCDC9BF918EF6DD3E1
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jabswitch.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	31608
Entropy (8bit):	6.453813320087704
Encrypted:	false
MD5:	6394B352C054C165878762D606C58CC4
SHA1:	3C06C6274FC631DB552D935534B3D3EFB9C9A0DA
SHA-256:	C3AF3D8A42940E09A80D07A032DB049EC9F9E6EC041A45B01F2A2171A1F0AF73
SHA-512:	7DB28F83AEEF36C7CE4E1A0F492574584F7003E5506D2ED314B7119B366D7740B1039A21184A19252C7967120D62C5714498FED8CE5E5B8EC9855DDE21CE3770
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\java-rmi.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	16760
Entropy (8bit):	6.521852499436146
Encrypted:	false
MD5:	5B9F2B950EA5749702BBF7F4B64DF822
SHA1:	DAE2FF1922402540171810E46A9BDD45B62E5B6F
SHA-256:	D064126F3E425BBC8A52D43C0E39BF1883B09B650CD0AA85949260D4AEA831A2
SHA-512:	4595706EA9323611B591C4B4BD12BCE9F8E9FBBFC81211C4A2CAF489B5204280C146EDD31DC56A698F597163127BCC3F47FDE1C551B602D8AB740CA8C6F46731
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\java.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	128888
Entropy (8bit):	6.825600057896529
Encrypted:	false
MD5:	E9DBF06852E1809968D52F987131CB6A
SHA1:	9D957CD6C085985E006ABE29C0D6985E46D6E0DD
SHA-256:	FA7F80A977D7A1AE3DBFE98F07819736C18052BEE9C2F61A79420C5569417D5F
SHA-512:	15D7652BC2CF4ED0EA651A7825F6992964EBE8C5435C3C410C5B785CA24F6E319CF198E46EA506C57180EBE3C9D77EC2A25AA9DD1729E3E52F4FE18FAE19159B
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\java.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	192376
Entropy (8bit):	6.756652403136599
Encrypted:	false
MD5:	1A4BAEBCD4466698D9FA846719405E92
SHA1:	5E313904C1722468C3BDA5D4ED824724F3C06E2D
SHA-256:	5F03B02BD9D44CA1AFDE01BCC0069F28FDA261B001A04BB8C659CF3D5CAA8F47
SHA-512:	B28CB06CE03FD0975BEE0047D7949F5E48EE9223B1E8F7352691C10018DC94D1F243A0142BEC7056C2875B30D7582620B4816F2D64F79E15F23FFF08B6A2715A
Malicious:	true
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\java_crw_demo.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	24440
Entropy (8bit):	6.667627693609952
Encrypted:	false
MD5:	DFE1320214E5E58CA5B5F85982AB12EF
SHA1:	84E17499C56B91E009446CC745B002D4B3426126
SHA-256:	92F091347C848B6DE2AC28AB4C8F663B5298875771A51803A47DF35695C04B06
SHA-512:	4C31E2CCD7FCF7F31A9DC836561743C870549C9A4C694088C956422B91A3A765F275E2AD1AF7ED78D92F8BFC5D1ED174FE3A0CAC7E794878F142D15DA2EF4D45
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.cpl
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	162816
Entropy (8bit):	6.477914737958197
Encrypted:	false
MD5:	E6D7506F7BA976CB0D8805C345CF7429
SHA1:	0F09A2909B5D7807781B452EEBA41D3BB0BF687C
SHA-256:	970B55811733C4BFAD7274CCA567CE7881B70FF18E7AB412F22279A8F9F26435
SHA-512:	93104CBC85591152321F5B2FBE834E677125CFDBF653037028FD8E0230BE60768DF8A218B9AB811F9ADBF2A45877426F6FAF06D4A0ACED0EBAEC08C8F89FB861
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Size (bytes):	74616
Entropy (8bit):	6.339543969264713
Encrypted:	false
MD5:	93AC2627E46C745ECB3EF6254FF0A766
SHA1:	DFAB6A056AF2CD51210CAB55008DF5B2F88BF4FD
SHA-256:	185A37B058233EB244CDAE848CAE70D0BC121C9A84904F956F340A9D15E4571D
SHA-512:	55529B59E3707261C8FAE767F0ECB20D5A698F58FF5D50C2BA9ADEF9AACE51A0DC0E210FC2E4F16B314064715D08B9BB491B759813CE1B70A713373CF85C62C1
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	58744
Entropy (8bit):	6.676162706510785
Encrypted:	false
MD5:	3FFDD39AB5870BA0E4D9073B4921347C
SHA1:	A5CF6DE504CECAA2C299777B1BBF0352874E92A9
SHA-256:	3A5EB1EBBB6E6C64C9686D3926DF845A15CB49F816A5ACE482E52C2432CF560C
SHA-512:	F76692845A146FB4F81A4EAA68B7FF20D50D754DD4F56708C304BB00786C0887E8A3F0334E581E54D5447FB0A2F469FE53223B890DA734E76B0F4D194B5E6784
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font_t2k.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	448376
Entropy (8bit):	6.637705003431729
Encrypted:	false
MD5:	475F54B2BE58AD459C565A385F7A2932
SHA1:	2F78197A8B2C52E94F2B196EFE9FB48CDA2527D8
SHA-256:	45BD56FB5025D2893AC4FC109C8DE14F0DBA67BBDA62D5D5B75DD5A3BE65B319
SHA-512:	AEC9C6EEF2F5DA3C461ECE5133303D4D734B32F745EF7A1F514BAD0CDF8C851513DB59D345E1AB7730216CCE843B507B554A3D8362D9A3514963DB8F67F2B14F
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\javafx_iio.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	128888
Entropy (8bit):	6.620986655369692
Encrypted:	false
MD5:	8BB2C78789AFBC363CAEFC98DFF25FAF
SHA1:	65F0791727D2CF5431FB53A2B0A586B726FB677F
SHA-256:	0B9415BF8440605C1DC6A78EEE4ECC1235F72B4C56416FFB61D30039C21ADB43
SHA-512:	7788744D27E70A955016589851E510A020EAF4D8486AAC7A755308EE7D6864B6444817BA9738A77090487D79062DD2F86BEEB18C00350D23C3105406460C75DF
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Size (bytes):	192376
Entropy (8bit):	6.761376939278606
Encrypted:	false
MD5:	84C2540CEDB08C146D1AD06122E6CC12
SHA1:	76E71CE35F5DE6B23C5EEB4EC76C806C78B76E78
SHA-256:	74C51F97510362F319A21EC98AD4D09099A81C6A2829AACB5E3AD21E573E3276
SHA-512:	E43BC79EE0046112458141D0B534600B00EF06EA66A97C26B651E0D39F14288B15510B8DB70433AE2EBAF9C7F5E094B1F9967D96F5154DC632C09D48C093944D
Malicious:	true
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\javaws.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Size (bytes):	300408
Entropy (8bit):	6.455671601705719
Encrypted:	false
MD5:	EE9B8795F3406088F917A1ADF954BA18
SHA1:	3F2AA657CF6E5A627251FAF663B584A1E98506AF
SHA-256:	441FBFFC24D77195478A6A44CFD71949403824079AF9122D015E04869B00D11D
SHA-512:	6FB836F04467BBD30BD1B0325F39082293B822571DF4E4A4403F3DBECF2DF3FAA2C2F68C721278863AA4FA553659D8F55BF4075D7CB007FDAD0F9D40F399E837
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jawt.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	14712
Entropy (8bit):	6.357388286134717
Encrypted:	false
MD5:	215875360E139754DC3ABD94C5C270AD
SHA1:	48869EAA976A974504F5485ADD82FC0EA987561F
SHA-256:	71DDD4218DC9C5F74F09732FD991FAB7E9E22B7FCC6C718B8DC82B2F3032ADF4
SHA-512:	692331721D565C4E1652D80824925D484A9AB24B5DCB22B192A9778F4F451A45D5C9EA76F04C1AE8D3DE119FB53BD1522C0345B592426DA251A699830F7796FF
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jdwp.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	165752
Entropy (8bit):	6.754896295120896
Encrypted:	false
MD5:	F402A907BB6E972C2737CFC018FDBD3A
SHA1:	82A66CA8C087963C4799849528813941DD74F597
SHA-256:	1CD035BFE74741FC16840403180E709462DDF07A19478ADF5961EA7F9B4ADF8B
SHA-512:	A6C18EC636F83F40D83B254CEAE785FB1E3707D56C8842533C1FF8A5797D723E6F1C3BD4A3CE170832F5C128F224D3CC6DED9E9D869C650F9903A5622E3897DD
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jfr.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	23928
Entropy (8bit):	6.64438670229773
Encrypted:	false
MD5:	12FA818A5BC37B8B7482074A38E4B301
SHA1:	CEC4518B4F8EA119B4FA18699DFB05E6FFFF3C96
SHA-256:	67C6E4CA890E2254177EFEEDEED19CAE737454BB69481674AB1B3476EC1B998D
SHA-512:	58054B51096FDFE07499B49CE7739A411400D81E59AD410F068CA7A5E19745D219C1922F2325602C44C56431AE7876A270FBD1CD8C61432B28527736191ADD4E
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jfxmedia.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	117624
Entropy (8bit):	6.589905307596588
Encrypted:	false
MD5:	7EEC8C6CDD7F4A7170D0CC49979E345A
SHA1:	F764EF511056EB52D61B767D1F7ED719E96D9819
SHA-256:	5C4FC7E96015F21093946D774F15DD1AAC2BCEC3D32A6EEF9D1268FCBDF0CF8B
SHA-512:	3B7A3E8EC965ED806161D5650C4E8264D2BD618607635E33D73571A6404B8D9E23F753183A2E00EA4C04251762181ADE8535B8615FE35F4DC4EEB07E205E8204
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jfxwebkit.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	48242552
Entropy (8bit):	6.571594485181242
Encrypted:	false
MD5:	FAA1E194A340C2F64EFB63CC21F4FB49
SHA1:	20235A810C6D362B9B0993D6CF0F38173F89474C
SHA-256:	32F01A2ACB7A37CCE68588B275AD46F97CCB656900C233117328FE8A68C8A4B7
SHA-512:	59681FEB7F69500A089967FE0D7DA9F5BE64E608AE4CF13C63413879B16A87BC0FB60973D0396C72B7EAF1D841DBB7442EF8912DE9DDE37880AAAB09EAC036D3
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jjs.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	16760
Entropy (8bit):	6.528741881787049
Encrypted:	false
MD5:	BA9321813C9246BD263F01D07FE1571D
SHA1:	F1B740C42B943D85CC218BA067465707787704D1
SHA-256:	292FAA4845074907CA7F40C084D939F62286E2001E9C0AF405FF9A33338E50D8
SHA-512:	A9B85256A4EA957094B6410F4A8CE53730D6A9B11B72CF70B42849FC954E1EED9F45E9C4348724A7D5293E8ACBC6433BEAA8910827C59E6028465644C781B7AC
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jli.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	160120
Entropy (8bit):	6.82756704602524
Encrypted:	false
MD5:	8D92F03A27F3C6A3DF2068039E7D0AAE
SHA1:	FCA5A94D0F78E29B921942A0D9D25F0770283E4C
SHA-256:	0DA523F0E5A6BFC3992152F393E2494DF86FCB8D91C161D83198BE2E9C7781D0
SHA-512:	B715214D17671E4B87AC21CC08CB7BEF054C45FEDA51349E383D1C136A051B9F74C5B12EB283E5151ECC58EB9166603F2AACAF0F5923760E0B776AE3C762D589
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jp2iexp.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	214904
Entropy (8bit):	6.655531445438969
Encrypted:	false
MD5:	2757AE006AD43DDB3FC634DD4C3A7187
SHA1:	38A0C379B0B6B5F3D70E67E54F304029740E4324
SHA-256:	406B025F816C9397425C673B0FBB7EEA2466C2F7D42C3DC34494FF9EBA7E6124
SHA-512:	B0D90537AF2240229D59574F2C0C91A4F016728DF3B794851D4451561D8D30D32EB3977EAE7447BC785EECFC1DAC425EE4C84B9E08852A24C92C060503450CAE
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jp2launcher.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Size (bytes):	92536
Entropy (8bit):	6.595142371502019
Encrypted:	false
MD5:	B382F861384702C68B7071973E3394C2
SHA1:	B664C124394B35E6A1B2B4D109455C398E054B97
SHA-256:	95B4D2386484A8529CF7DDB3E0DA6CEC97534B9EAECB460674A861659700E16F
SHA-512:	A19DF813F2D44FFDBFC23727607E3F82454B9E4676F3EE1CB05CF07BA7703485A6139BE672EEE0CFE66A3F533EC6307DDB4599777B73CBDFAFDFF5B1C1C4892C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jp2native.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	19832
Entropy (8bit):	6.438470080096222
Encrypted:	false
MD5:	36ECD123C4EA89A5175707BF65DC5153
SHA1:	369253B2720BDB32BFC80D3BE49BA2A66F3F4AAC
SHA-256:	066005FBB8438462C2910605B05261DD1F9CA3CF5B70761DC600DD3D16ABF73E
SHA-512:	266434429DAF4CDCC67617A7557B67ECE16FF9B2E7B5EB9360FD05617D7F2A74961A50B94302B9F2106A3AA287ABA2E42BABEDA1AA3849C6F2D2B4855213C302
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jp2ssv.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	194424
Entropy (8bit):	6.627126559169478
Encrypted:	false
MD5:	AC99C6A3C8A02C986D843F68E1163BEB
SHA1:	97BFF29D28BEF79B2F32CE90575AA425AB677DB9
SHA-256:	90896E41BFC2E60CCD56CAEED068CBDB828E794CA1B4758822827CBEBBCAC834
SHA-512:	AF3A6D66153EC1578691BABC38BFF141C4ECFD54B6D10B03CF67BE5EED7B9E77EB3EBC6FEA40229EB37439ABFE7D9ED8305385B850109972BA796EAD501BE7C3
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jpeg.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	147320
Entropy (8bit):	6.699096695465657
Encrypted:	false
MD5:	B79272C4B9E219D261368F0F808C3E28
SHA1:	D27C51E04B568AB1DF474219B18091179D87885A
SHA-256:	8E15564B4608E8BC848AED9F2FF0413B0AC733AE3D7DC7DC3BB3882D7188AE96
SHA-512:	9BDBC91A312E6F107FF82C4B0B5DB37EB9FC742411B79D435B9BF21CF062BEAAAE9931F283A15540B55880395F79331FC27FE64A9AE59A3C8DCD2C67D6259E62
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jsdt.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	17272
Entropy (8bit):	6.551811071939567
Encrypted:	false
MD5:	692C7B863EA442160ADE5553EBC96FEC
SHA1:	2F11990EC34D14FC785040B9EDDBB0B58DCB900D
SHA-256:	25D507F1E2393A6AC5AEF457FC1A8ACC91EA6C84B3588E0366A1E68126169BDD
SHA-512:	C7F77415257C755211F88B8C01F2CA7FBBCC161AB4429A8A611344B0B3BA972559209BB0D549BC1838F4792127738F8D0FFF36A74A44B30A59316436A7BA4D25
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jsound.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	31608
Entropy (8bit):	6.651666365047301
Encrypted:	false
MD5:	B2CF70A89D64D211ECBBEC043E37FB89
SHA1:	E407EFAFA1AEE914B74369C57FFF6EBF26E686E6
SHA-256:	4C974EBCBA6E2E1BB9E9DA0C5AE15258A22B0851E91084B813716BC312D69799
SHA-512:	BB0B7C0A41F899DB0D262C0EC84AB5F515F1573887F1036CD94B6F1FA72B17976B26A4E36B58A55EF3F54128B946F66243520319DB358F383A63C50408B91146
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\jsoundds.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	28536
Entropy (8bit):	6.674110511026289
Encrypted:	false
MD5:	85A2384FCF9F01DB22E873A00691912E
SHA1:	3D7156E1890250026901B38FC72B1C7D2E38DA6A
SHA-256:	A159BA921144A2529D4699C13C16C5B51EF44AEA2E3E26188DAD28EAF3169916
SHA-512:	3542B93863AF308354E990A7040EA277F83C06A23A5050EA1882F7D1827010FE9A08DC0C14C61EFF901611D1CD6DB574DE1DD8D20FBE4921205A410AB632FEC1
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\kcms.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	179064
Entropy (8bit):	6.804624704838239
Encrypted:	false
MD5:	54C6D38A24CF76BB25FD46D9CA0FC387
SHA1:	960C07550CD2805FC60EBCA9C13E986178A45D95
SHA-256:	EEE8AF9CC47D9F43E1171F8FA9F1B75622141A7075FD9B0D542CC4E20622C611
SHA-512:	51F4F83E05FC1A7ABAE7DD878F59AB0F3D5118407707B25B0361D3E4B05DD0A5E81A907098FE41ECF1E36C4C0AAB012424F3E5ADBC9C3140C8DC69367347084D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\keytool.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	16760
Entropy (8bit):	6.532037652999659
Encrypted:	false
MD5:	D0B004132BE1B55F1CD2606C5B73974F
SHA1:	C753D9EE8F3B9F57C07E0E464CCC6306EC8626B7
SHA-256:	8BC65B5047B3D739FFDDC62D97A28C783D1D29FDDBF0DF93FED0669F301E4D23
SHA-512:	08C4F502FEDB444E2E537DB8569A4F821DAEC6417CD642C43CDDAB095DA13651D294F8DF4B6FD7D074D1B65D69C5D541B775F0F2A870D3AD188D400DBB607C3D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\kinit.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	16760
Entropy (8bit):	6.53588252347906
Encrypted:	false
MD5:	E8E02ABAD6D699B999ABA1764D25B789
SHA1:	83B33F580148AF98EBAC346F5ACB9ACC8925C338
SHA-256:	7F95105E4F785AECB3F6DEB0E353235F2DF3DC1A71CDDB939428524C4B48D5F2
SHA-512:	91F2352EC5EB6297B7DB8C1C428A407F291EA80796C0323AAAA1BA11882932EBA0804D64D890D821BDCC2CD9C24F29513419CBEC92028DFAFCEF9E72E447C8BB
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\klist.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	16760
Entropy (8bit):	6.538208630010994
Encrypted:	false
MD5:	A99FFBFCF94242C59D891BF38C93F58B
SHA1:	D7172B93A015B860EA46762EB86C5D2D43137A8B
SHA-256:	90DEF7AA8DD0237F2B8F6A775B824D688C7E2E754FE3E81E22E3509778B13CA6
SHA-512:	BAC07FF741DC7396F60711449F64DE37C1A1C1C1BF41A582829545C0AAF594E4DB7326B886170F23DDE3A8D666CFB505B899679E6DF96D3E2D670D29B8F4CB07
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\ktab.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	16760
Entropy (8bit):	6.5339992572339645
Encrypted:	false
MD5:	CD9A4CF84775AFB50702CFE02BA2E2F4
SHA1:	7FE07A9EEFC7B0DC240917D519B21FC308A6BD93
SHA-256:	E3B724F59AF3ECE76B5C609F867511B341418D7C3D33A3839D84736216CF3190
SHA-512:	B4C43AD1DB16E197ED0ACAF4CCDECE528AABD04339AD0836234BDC52A93384C77EC5B3FA2A146190349A13E9C8BEDE053E3F8185714411F3AAECFBFE29C06703
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\lcms.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	192888
Entropy (8bit):	6.524506827543123
Encrypted:	false
MD5:	D441FA7E151CE34540280CCAFF333BB4
SHA1:	41AA8A75F3C8219B415E3C805167D3EFF6B112E8
SHA-256:	9A96511021FCBDCE00039C9AD69BCE453F20D049A3D359741AA3EB573BAE1A0C
SHA-512:	BFD9BB1E6FBE7AAD216E7CB63BAB8869BA58C01B93851EFC9ABA79DB411CFE268EC68B27B382336BBA8FD1B5DD9420B6375DBDFE86DB173E1E5397BC4EAC6B32
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\management.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	34168
Entropy (8bit):	6.595544627838039
Encrypted:	false
MD5:	C471B8FFBF5AE977BFF5EB7AA8563CE1
SHA1:	7F8770FC5EE15F2DC72FC9E59A33CAD9F556FCE1
SHA-256:	71CF108A103B9917DD99D656936C3481FDB6F40E1391248A12EBF29630519D90
SHA-512:	33B2558D1B47C8C6ACFD015098FFBEE3316F442AF3EA217E5B736F6B7BE901616A8D0A3725F13CA000A33130C68FFB91F002EC5DEF0481706E52359D536470D5
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\mlib_image.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	575352
Entropy (8bit):	6.507957668661324
Encrypted:	false
MD5:	FE083A445E4B330B15F73D0D5480726C
SHA1:	5006C4A50B819F6B5E5F6F886286689B56E02B67
SHA-256:	8C0204D577ED8F63A0212C69431E2A1FA12C2183F9F837F4DFDA9A3C10C30365
SHA-512:	303DFA947B7CB138B2228F183CE563530A23BD980E21485ADDEEE9A31A9649FD825CE8D45A9033B89E48A6A22C3219A6EE21F9CE7AE75DEF2ED12ADDCF91101D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\msvcp140.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	438080
Entropy (8bit):	6.652787327977781
Encrypted:	false
MD5:	0A252601B942F683C2C60BEACB4F1A72
SHA1:	A9D80CAD7885E64C5724B70472FF4F1D2B1466C0
SHA-256:	916EAA54E02AB03F8065A487AED6C7960FCD70556AAD0B27DE547FFF9D603D47
SHA-512:	95E136387DCD9CFAED7C2D4DE5BEEA984AD62ED7995A393E5AB5208510D94672D5060F6FB038CD4D0449095DF4118E6FD3FBCBD911173E2F28926EC63163C150
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\msvcr100.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\net.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	81272
Entropy (8bit):	6.738707365295144
Encrypted:	false
MD5:	8BC8D00783B15CF08359799BEEE0FE22
SHA1:	646448B857548CB40247CB85FD8997D30D525966
SHA-256:	C478ED246F648F7B0F00056D71762C641B1F90E850F723DFCF583B5BABF5EED9
SHA-512:	D0262E902B1D770D941F96D7BAB9812BA71209B554DD1FDEA96144E8D05CAD2C470830A426168770957021B6AD821E4B9232ED6E1E3E1E2A3061A9DCDCBC3358
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\nio.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	52088
Entropy (8bit):	6.599265591667461
Encrypted:	false
MD5:	341D72389771DFA4C7D7DE687D47C48A
SHA1:	21B3FFBD0DA53B19A162C9C3A7EB6CAC81A88D3B
SHA-256:	E23959EA08C5396BBD0DCE489B9D7F1A7CBC0699099BE5BC0C9DF3BBA3D8651E
SHA-512:	E1A05CFB07B48485EDF9C7A9F764A93DC1106DF507E8490EEDEDD7BAC04F82E37EAFC83E4FD56963470A8D6D581AB32E0366BDBD656A74AD89BCBEE5408EDAC4
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\npt.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	18296
Entropy (8bit):	6.475141767750064
Encrypted:	false
MD5:	597095C991E6E5F2489A6B173BE7490B
SHA1:	4814E413D9BBFFE02097E72F8BAC4BD32C54BDA2
SHA-256:	348166BA1AB72BB265FC5E61185397DF743B34514EE57C2F80EF43870AB43FFC
SHA-512:	D6DA94572D685D663C29647F0A5D29882470C86E9A1A19759BDA013B9BFFA0F6604DE8F4A0EFA302BC9BBDCF7482E635A246517A5F043A25A00821906CA52B41
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\orbd.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	17272
Entropy (8bit):	6.45472163137851
Encrypted:	false
MD5:	E7B6321ED7CF58AD1E9E093647EE6755
SHA1:	361BECFFFB494CE250B0D9A97DB4720FAD25E7F2
SHA-256:	FEFE44C7091360C053465A67987F97FCC145E6B892AAA3759CD9BB063753FA2D
SHA-512:	09258F9A093F4939AD5BFE46F6CE96BD9E537EAD5889241DD3ED7CDD65BDB81E197BBAA6B603484B038E99E5A42821FBF4AF52E1875C6ACDDB50A58AEC0A0F95
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\pack200.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	16760
Entropy (8bit):	6.548101730244062
Encrypted:	false
MD5:	7273BF951B4F743DE412BE92EE0F3893
SHA1:	EFCEF7AC5E4CC2E6ABAB0D2983FF743C268B5FB5
SHA-256:	00DA43E4BF46212EDD26CB28658B722C4AFBDEB4C2BEC65F9E1B13D93FC571A0
SHA-512:	C0A824E256E832F68B78E222A200E82A1D1541B719F0B07642F2B609ACAE71750D907C03E958A47257E3E39026D976D4826C997FFB1FBE11F4F780E1891CD24F
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\plugin2\msvcr100.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\plugin2\npjp2.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	180600
Entropy (8bit):	6.411615437404592
Encrypted:	false
MD5:	66BC52579DD255400D022FBC3D2870F2
SHA1:	AF017B5E79E630CFB105B94BE84E0E06E32E6F65
SHA-256:	21024C984AEFE27A64C23E3C142295C91E03A71973F0EF50636F5F1292C5863A
SHA-512:	AE5BC86704794AC5564A481133E02525E16C01FC990D77FDD13A8C031A1C74E078500DA85457F43CB155CE182D8E3E7BF279AF36ABB5C37F1986A0863EF4A603
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\policytool.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	16760
Entropy (8bit):	6.543390219438642
Encrypted:	false
MD5:	47929D849244E716BC26F35EE0F76851
SHA1:	CCC22EFFD83FCA23D592F292F254D0DC1F3B7D35
SHA-256:	A3AE9BFB7CDBEDBEC9CD6535C5A828CD68FFC03C020ED0167F27762A4E433CF5
SHA-512:	0C86CA9B793C1974FDA2B6FE1776BC6330F34FD21340EA3287858EC5A26EB75E1BAEDB05F7E96C07969B47E03EC90575848010706F832611F96A82AE59F89D68
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\prism_common.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	54648
Entropy (8bit):	6.5132481089247145
Encrypted:	false
MD5:	F60F1730C0A12FB56A3BBE5D93FBA6A1
SHA1:	AEC13849601A29B3A3D01DB7BB1ACB17C8004516
SHA-256:	E718B262F88BD4E9C3FF599E26FFD660F624D41B03825ABBCBA8DEA1ADD75434
SHA-512:	7E93F27B55BE1FF2CA60621F5C2C0652253F1DF3A06E15AC62AA93EFC4718AC347F4E56DB3FD7FC03A3AE6FF1F02197EB3F2D6753B2A3AE20E8323054EDC7746
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\prism_d3d.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	117112
Entropy (8bit):	5.815680053368549
Encrypted:	false
MD5:	9C496988370A2A2A383E311E7BDD46B7
SHA1:	E056BBC4B4C121F433395FD5B853028A156C5BDA
SHA-256:	313E192D35CCAFB502FF769BDCFA9AC1FA1DF1D5B8A52C136F33FF01CBB38720
SHA-512:	14363B6367BB824AFE49BCF0AE8AB9FA26A28FF12FE93154D99E4F60C8982F6741834340CBFE807663EECC067F866AA0BDBF2374D38538F795156EC34FA7CD2F
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\prism_sw.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	87928
Entropy (8bit):	6.71704019598687
Encrypted:	false
MD5:	D71511EEFBB9056E549C0C843F8C5136
SHA1:	3EB22FD950A4592785AF7046D2C9ECD54A403296
SHA-256:	E73F4632E11F78237635D311C1192F99D8B8C1BB55EF227CDD927893AFCA2897
SHA-512:	F7DAEECAAF5AF8B252916B7815165C3A6F1525EC9C4E1C1A3861F35C4E325503D2766FAFAB1D3A7E99F60D6BFA501E831359277B6B3BFC0A8DD07CEDE90EB589
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\resource.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	15736
Entropy (8bit):	6.463358480381595
Encrypted:	false
MD5:	30D67256E0F1370B7C892A18FDEA8693
SHA1:	23C4A7E6D137DA9BC3699AE9B7A36EB1CBC41251
SHA-256:	C09E460F73A3BF97C2871CEB2DC88D4DFBBAF26A96C6D3D82A4D4D7998715B93
SHA-512:	2EB10BC1FD27DC60930A06FED895BA7935F74B20955D27E20935C79C0D0C8912CD914858350D77B8CAFFF14877680D935310940575F46C14E90AEC5E1039C2AD
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\rmid.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	16760
Entropy (8bit):	6.52881737759378
Encrypted:	false
MD5:	1CBBCC5FBB84376F67BCF27D917ED231
SHA1:	03DD2EC4124598180F8C748EADD095E66937CED5
SHA-256:	0A37AF7D50516FBA11B8BC4D4BFB1D482A91F2174FF7BD5DEC527CA0066B49BB
SHA-512:	61D4338F984F1C180082A1AADE0C1AA4FB24DA58276305CE47AB8B82112E5694F1E0B79EE33EDC5646BCE9E62DAE5EF42ACB5109ABD8605EAA80636D8A828E01
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\rmiregistry.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	16760
Entropy (8bit):	6.530353528266159
Encrypted:	false
MD5:	7C7855E5AF9CBF2893B1131926FBB20D
SHA1:	ADF3585EB01420FD38E9B6F5167470263F893624
SHA-256:	E2055093C09ABB782F0440C5983288A08F20DE3437F5E07490B75D44E8CB555B
SHA-512:	C37BDB326FF33E51D190317FCECA6A7E99C8707679F9E1AE0D6416E4AA0F8BDC6A01C3A08A67F7F6A68BAB4A0E4AA50123F3CE247AB2BEE9B4D9CC62CAE3A5A2
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\servertool.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	16760
Entropy (8bit):	6.535983537798705
Encrypted:	false
MD5:	B8F281D1777FD8AC07F3087DADE7155A
SHA1:	A47E894F8E3AAB7FC9BCAB8EE60E77ABB08F226F
SHA-256:	99D72995E2C1703676135B2A3ADD03EF2CE4D3C9FE0DEE112248E55DAA10EFEE
SHA-512:	4199DF2DC8F141277882D782664F4D08C3DCCE44575BAA7F9695B890DE886D0597F6956743D8D72B1C48D24C75FF63FDAE82C8D11D9E294603EDD9D79CFC2693
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\splashscreen.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	174456
Entropy (8bit):	6.910207435378543
Encrypted:	false
MD5:	B9AF487E40C60CAE41BAEE10FB28EF7E
SHA1:	EA5DC68F218DBFCE44EBE717FC7F1496B236107D
SHA-256:	A74D890FDAA3A1494DFB58164D7D4C7F55D9766A1BB1B1799318A5968E88FD16
SHA-512:	DFE2700EC37E42E9F37CE9046CBC2DC65CFAB00FF35FB421AF202326C7FF7171C6BB7FA6CBF66FC49913A70A118F4B998B29A072C61DD8A8C1DBC613B3F984DF
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\ssv.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	480120
Entropy (8bit):	5.567501752392046
Encrypted:	false
MD5:	639920CC93E484D3F8E799DC970516C1
SHA1:	B6FC976B9A48793AA648BC000B8A1B40C6FE77B7
SHA-256:	913EC20733C0CC90E79194CCECC9D7ADA7EF13DFC35FFBBF910B07261010DC74
SHA-512:	85ED042DFECB101AABEFFD367080424734007C6D617BE4F0F4D7566F7B0D18F5465B7CF58864665BE7D0DF64E40029FB4925E8D40F4D84FE0993C795448F9C69
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\ssvagent.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Size (bytes):	58232
Entropy (8bit):	6.366565262599299
Encrypted:	false
MD5:	78A43D6D73A416768FEF07907E0B49FE
SHA1:	14A7A9D1F7A62CF6793561B6B9A83F8B50417AB4
SHA-256:	7996C8C85F25FEB63A6683FCA48FF47EEB9B97356DB11A755A7D5D407AC140F6
SHA-512:	4EBCA583F404D0242CAE5AC6AC7DFF179636B899F86119ABD69D97021A64D1DF941A53A2327ABD954E4A290E089CDA5884850A36FD0C991CBE8EFBBFEE59D1CE
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\sunec.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	125304
Entropy (8bit):	6.731559009294073
Encrypted:	false
MD5:	012E5D405C8446F6174A62E080848940
SHA1:	A7ECF8E26EF5BF20243FCE00747EAC5BB74B417C
SHA-256:	B30167A2EBC5F170E224F0F2E994D13CED31764E0C1953F8E7B690D6A96C5B18
SHA-512:	EC20EFA9D85DF1B13E81AA48285D3F146F9079DF2082851D43E9B6B991B0D238F3755841CDBD70ABA7FD14A2CCFBC5D44CEE10F984E2E3CC6739AD29A5DED0A3
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\sunmscapi.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	26488
Entropy (8bit):	6.547735636193031
Encrypted:	false
MD5:	6D4DF1A5526000671FE820C3BDF3B218
SHA1:	B6B97985842CDB143599A07A83C1BCB86AE7A503
SHA-256:	7A6C1C34D005C4F9CEADA3095BB02B423236CAC627EB7569D8CEC63FBD5A7AA6
SHA-512:	9F91BBCC189701E7E90215238F2BD3424E85BFDA5F6C61C69E7C7338E67E9E03DB21DC85F200E4653322692E6FEE0708B08A96B812265BEA6CF3B0A607F62CFB
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\t2k.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	197496
Entropy (8bit):	6.80699244898355
Encrypted:	false
MD5:	6C737E2B7649EB6B9C877AA991FD50AE
SHA1:	0069724F3C1EADFE7CA07E3EBE415EC8A341116F
SHA-256:	E67AA8DEF2CB3EEB4C5E00BAA5607D8DBBD731FDA662324C0927DF02986F6861
SHA-512:	ECB45D35193A2FE8B9F6A861C789FA9B40D4C18829814C11E7B42EED12B5972AA864CED72A3AD2EC10E8EEBAFB17157B68A3FE78DCA83415C9788F1FEEFD1560
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\tnameserv.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	17272
Entropy (8bit):	6.453751424439634
Encrypted:	false
MD5:	A709AC5ADE7EA15E5E6AF67E5EA90906
SHA1:	8389C1499D6BE6892E7C33E2E3FB9A2FFCBB280A
SHA-256:	A937855BDB919B346E91CE8ED12BCCD7369F81C962334709569A2097A77A8C01
SHA-512:	5D260E9A2BE2177F8AD0D03B795AC2CF7DA832D940DB35876A2F0C600A0FC60A3B3B5C50584D8D2CB484C77C86C86261F11813F315A406B322B28AD7F3C94F9E
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\ucrtbase.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	1147712
Entropy (8bit):	6.814532185579252
Encrypted:	false
MD5:	5D2F9266695D6E0152A6C9CE090F01B5
SHA1:	19290A0AB6942E182C393A0C35D0FC44AA2FF82F
SHA-256:	0AE2D103D87250F64EF5091D4807523038954ABA0E119B121EED7F0A23B00B52
SHA-512:	4961DB60BC30F5D91792606D5BE7159D0D41E23EA987A5A4B6D4C2D96A99481B8AEFEF43AF8568CA3DA67FE8D7DC623C1B732A633A2AF82905A2AC4DA0CDE5CD
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\unpack.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	66424
Entropy (8bit):	6.500264089351928
Encrypted:	false
MD5:	A09B704CBF8D698AF496C422EED33953
SHA1:	B37E861A45A50A3011767CEFE69D413E4C68F249
SHA-256:	6EF275591FFDBCEABD007249A6B8F4A21A8A005AD581BFE67D4764E1FC4704D1
SHA-512:	62DF4E70E3A6989B33FA247CF2549AC76407D7CC41AC0AB589793C0FFD606DD5FF3D43C4C3E36540F05EFD653710BE77124720A250E482D7EDB0C725FD0A5953
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\unpack200.exe
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (console) Intel 80386 32-bit
Size (bytes):	161144
Entropy (8bit):	6.050460540443696
Encrypted:	false
MD5:	F4EEA0A4C94BEC535C7F784ACB10755F
SHA1:	BF6B27ABDE6411AEADEFCD44814077A448B60C18
SHA-256:	DBEC210D8CB3DA15BD62089CE7FC744ADABA777C72C6FC130658F0823D001F3B
SHA-512:	2347BE3A2FEE9F1562C6BBEEC9DB167686A83D456CB549C12DCEA8A6FA548672777FE172C37528D6A42395CA91B339CAB99D76DCAF3694AC3A0C3B827218896A
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\vcruntime140.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
Size (bytes):	83792
Entropy (8bit):	6.880051776775058
Encrypted:	false
MD5:	F4B8A73C18E65EB5AF950751EB71994A
SHA1:	D8D379BF2CF7C844F12BA644254122F24535B1E3
SHA-256:	CDC006FC80C4437D009B8C72008A443A9EE5BCE383D8B3DC16AEEC0E081CFE32
SHA-512:	3CBF6B2B2AF27F8A8FB19ECFD53EEA3CE345C617FD3EB2E3E870146283492766E24FCFA3CCA8719BD31F38DCF5860398250BA1096C73F2A08287C9C86818C879
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\verify.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	40312
Entropy (8bit):	6.7907190354394364
Encrypted:	false
MD5:	34C795493534FE2AB341686518D3B3E6
SHA1:	42CD53E1F64D01C8D3152F7EFB45AD9564A3A29A
SHA-256:	A9EE9384DF4499EB624E1B7E636FF7D0C0684506AE0E938076978AE074C2E30E
SHA-512:	DAC1B862F90695EE0D938A4D2B58CDCCE7364CC4C8EA2AA06B9ABE59D0255CF8BB21C9076707550BA9839EC02D107FD8BF8BC6FF5B4B50CE41122A005A7E9C1A
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\w2k_lsa_auth.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	22392
Entropy (8bit):	6.536191889649962
Encrypted:	false
MD5:	A369F223C724DE20D95EEB840798E879
SHA1:	CCC15A1C43485BCB7179B0F316E978040A572449
SHA-256:	75E938EF521D30F8E6D8AE7E290E378EF12C5B11992E2BF0CE9079A3AF8F60BD
SHA-512:	B2B96B64A105F85F6A43C0E43F8423B4F3878154C1EFF62C68544C56A31C06256CC4771C1FAE6BE89ED1EB8C1F18808BD5E8C008CED5E6018F868543FB8F4A3B
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\wsdetect.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	165752
Entropy (8bit):	6.500628587966399
Encrypted:	false
MD5:	B6433CD53FBCDF80FA868F20561A8306
SHA1:	EDF5C32D64A976B01C10E67D0432AB7E9B1DAB3F
SHA-256:	241A30EB481608A3AF4D6DB5DB80A69C8028B45EEDA3DF6074BD39065042E75B
SHA-512:	4CBA7EF8315F7A69F5BA8D3975EF1991319152648FFC140BAA8175545D47D556E68DAE352AD13ABB7EC77F3C5E11E50D4D1F63AC3D0B1F5AF6058D47176A14C6
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\bin\zip.dll
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Size (bytes):	71544
Entropy (8bit):	6.918397043575868
Encrypted:	false
MD5:	522CE196C43DCB935B043994E240CC1A
SHA1:	37B7BC9B0CB93C571F7023C7383670123FEC12E8
SHA-256:	5D12A6D34DFB4B0CE39F2CAA7273BF1E0C2D154F5AE52004B978502471EE1151
SHA-512:	7F044E6E005DB6CCFFA1FA5F011C929E24E085E655001A15E16EE4E4953EC8F7194B8D591D060D68A2A8C9363B4556F2A691B4A01FFE1F16D214B838304FEA27
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\accessibility.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	149
Entropy (8bit):	4.558376029276625
Encrypted:	false
MD5:	2ED483DF31645D3D00C625C00C1E5A14
SHA1:	27C9B302D2D47AAE04FC1F4EF9127A2835A77853
SHA-256:	68EF2F3C6D7636E39C6626ED1BD700E3A6B796C25A9E5FECA4533ABFACD61CDF
SHA-512:	4BF6D06F2CEAF070DF4BD734370DEF74A6DD545FD40EFD64A948E1422470EF39E37A4909FEEB8F0731D5BADB3DD9086E96DACE6BDCA7BBD3078E8383B16894DA
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\calendars.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text
Size (bytes):	1378
Entropy (8bit):	5.180680535922269
Encrypted:	false
MD5:	40A6F317D17705B4D0241F4EBB45962D
SHA1:	42EBB0988124433B8F2A6E5D9A74ED41240BCFC6
SHA-256:	D93FB6D3451D1B82256B0E31AAE7850152FA5DF76F116A9D669AA4ACE6BB68B4
SHA-512:	E4C95F8F1354833F440672C0761CE1B4895DAA52E7F143A110533F978CC6C094847AEB66636EFA6DE74B0E900FBBE79A3CC21280C4063627CE8D259068084A3A
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\charsets.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v1.0 to extract
Size (bytes):	3036922
Entropy (8bit):	6.609636479442583
Encrypted:	false
MD5:	5F2CB749302F25B83CA4DAC0E53051DF
SHA1:	902186F0C9C745BECB08780FFF84DBD200C91912
SHA-256:	E6C282FE201028B95C74DAEC184B97348CB8657813787DBDAD7B4BC2D172A7C3
SHA-512:	7C83BB495F4506494591FFB30390DCA3A2D7DE8B0924625F4A8E1B7EDDC02CA341DE4B2B1FE6636FC7603F7191929310F345E046719482041D56539A2DF0C599
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\classlist
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	84355
Entropy (8bit):	4.927199323446014
Encrypted:	false
MD5:	7FC71A62D85CCF12996680A4080AA44E
SHA1:	199DCCAA94E9129A3649A09F8667B552803E1D0E
SHA-256:	01FE24232D0DBEFE339F88C44A3FD3D99FF0E17AE03926CCF90B835332F5F89C
SHA-512:	B0B9B486223CF79CCF9346AAF5C1CA0F9588247A00C826AA9F3D366B7E2EF905AF4D179787DCB02B32870500FD63899538CF6FAFCDD9B573799B255F658CEB1D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\cmm\CIEXYZ.pf
Process:	C:\Windows\System32\xcopy.exe
File Type:	Kodak Color Management System, ICC Profile
Size (bytes):	51236
Entropy (8bit):	7.226972359973779
Encrypted:	false
MD5:	10F23396E21454E6BDFB0DB2D124DB85
SHA1:	B7779924C70554647B87C2A86159CA7781E929F8
SHA-256:	207D748A76C10E5FA10EC7D0494E31AB72F2BACAB591371F2E9653961321FE9C
SHA-512:	F5C5F9FC3C4A940D684297493902FD46F6AA5248D2B74914CA5A688F0BAD682831F6060E2264326D2ECB1F3544831EB1FA029499D1500EA4BFE3B97567FE8444
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\cmm\GRAY.pf
Process:	C:\Windows\System32\xcopy.exe
File Type:	Kodak Color Management System, ICC Profile
Size (bytes):	632
Entropy (8bit):	3.7843698642539243
Encrypted:	false
MD5:	1002F18FC4916F83E0FC7E33DCC1FA09
SHA1:	27F93961D66B8230D0CDB8B166BC8B4153D5BC2D
SHA-256:	081CAAC386D968ADD4C2D722776E259380DCF78A306E14CC790B040AB876D424
SHA-512:	334D932D395B46DFC619576B391F2ADC2617E345AFF032B592C25E333E853735DA8B286EF7542EB19059CDE8215CDCEA147A3419ED56BDD6006CA9918D0618E1
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\cmm\LINEAR_RGB.pf
Process:	C:\Windows\System32\xcopy.exe
File Type:	Kodak Color Management System, ICC Profile
Size (bytes):	1044
Entropy (8bit):	6.510788634170065
Encrypted:	false
MD5:	A387B65159C9887265BABDEF9CA8DAE5
SHA1:	7913274C2F73BAFCF888F09FF60990B100214EDE
SHA-256:	712036AA1951427D42E3E190E714F420CA8C2DD97EF01FCD0675EE54B920DB46
SHA-512:	359D9B57215855F6794E47026C06036B93710998205D0817C6E602B2A24DAEB92537C388F129407461FC60180198F02A236AEB349A17430ED7AC85A1E5F71350
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\cmm\PYCC.pf
Process:	C:\Windows\System32\xcopy.exe
File Type:	Kodak Color Management System, ICC Profile
Size (bytes):	274474
Entropy (8bit):	7.843290819622709
Encrypted:	false
MD5:	24B9DEE2469F9CC8EC39D5BDB3901500
SHA1:	4F7EED05B8F0EEA7BCDC8F8F7AAEB1925CE7B144
SHA-256:	48122294B5C08C69B7FE1DB28904969DCB6EDC9AA5076E3F8768BF48B76204D0
SHA-512:	D23CE2623DE400216D249602486F21F66398B75196E80E447143D058A07438919A78AE0ED2DDF8E80D20BD70A635D51C9FB300E9F08A4751E00CD21883B88693
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\cmm\sRGB.pf
Process:	C:\Windows\System32\xcopy.exe
File Type:	Microsoft ICM Color Profile
Size (bytes):	3144
Entropy (8bit):	7.026867070945169
Encrypted:	false
MD5:	1D3FDA2EDB4A89AB60A23C5F7C7D81DD
SHA1:	9EAEA0911D89D63E39E95F2E2116EAEC7E0BB91E
SHA-256:	2B3AA1645779A9E634744FAF9B01E9102B0C9B88FD6DECED7934DF86B949AF7E
SHA-512:	16AAE81ACF757036634B40FB8B638D3EBA89A0906C7F95BD915BC3579E3BE38C7549EE4CD3F344EF0A17834FF041F875B9370230042D20B377C562952C47509B
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\content-types.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	5548
Entropy (8bit):	5.037985807321917
Encrypted:	false
MD5:	F507712B379FDC5A8D539811FAF51D02
SHA1:	82BB25303CF6835AC4B076575F27E8486DAB9511
SHA-256:	46F47B3883C7244A819AE1161113FE9D2375F881B75C9B3012D7A6B3497E030A
SHA-512:	CB3C99883336D04C42CEA9C2401E81140ECBB7FC5B8EF3301B13268A45C1AC93FD62176AB8270B91528AC8E938C7C90CC9663D8598E224794354546139965DFE
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\currency.data
Process:	C:\Windows\System32\xcopy.exe
File Type:	data
Size (bytes):	4134
Entropy (8bit):	3.2626102825006704
Encrypted:	false
MD5:	A30D03F3E7BDC05878CF1919AAE62BC9
SHA1:	BF524381A7A9B9D5BBAB48069C583D2936E367A1
SHA-256:	668E6D107E4E63310D067C0B54AF357C083D961FD99EC465FE76FCC3860CE603
SHA-512:	5D7BBC27FEC6E24EEA1BD6EF3A89F8332B2D7A03DEEEDA66DD34F4C65EC64EC14A6ADA53F77743849EEF56D609D0C36576077F82479955B43C8553F894B72B61
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v1.0 to extract
Size (bytes):	5048197
Entropy (8bit):	6.575382235507512
Encrypted:	false
MD5:	F6586A82942E86F2E215667EECF521DC
SHA1:	F1EF3DBF4EDB5C367C70B1FB59F19988DBC13526
SHA-256:	183D9F526423E545CB565418690BA46BC5C010386873D100741F620CC6300DD3
SHA-512:	A64C024CDECE0A51F6BE6D0BF35E90B63090D016E7C77551F0CFA5F369B27ADC15A258746DDAF92AF149A2AF7291DA7077B87C084FFB5D623F56D1A5D9DF2B6D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\ffjcext.zip
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v1.0 to extract
Size (bytes):	14156
Entropy (8bit):	5.730863945557212
Encrypted:	false
MD5:	B501B7DFBF9D829E88E92C1F409AAFA1
SHA1:	6F3199BC3BE418F8BF53771A3045BCF990A18E29
SHA-256:	B0F1EE836AEE5E05236B1939A29C79C6296F8E3AC9CF6E600F81037B80B37D49
SHA-512:	0DCC581BDC3E1FC38817BD12FA4655AE17632323E4121C9A1C6BAD368952AE09F918742E4CC70508FB63C90D46564FE82DA7C5D0E70EE59040133777E1F79691
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\messages.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	2860
Entropy (8bit):	4.793521742012267
Encrypted:	false
MD5:	811BAFA6F97801186910E9B1D9927FE2
SHA1:	DC52841C708E3C1EB2A044088A43396D1291BB5E
SHA-256:	926CCADAEC649F621590D1AA5E915481016564E7AB28390C8D68BDAAF4785F1F
SHA-512:	5AE9C27DCE552EA32603B2C87C1510858F86D9D10CADE691B2E54747C3602FE75DE032CF8917DCD4EE160EE4CC5BE2E708B321BB1D5CDEBFA9FE46C2F870CA7C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\messages_de.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text, with very long lines
Size (bytes):	3306
Entropy (8bit):	4.888605396125911
Encrypted:	false
MD5:	D77C3B5274B8161328AB5C78F66DD0D0
SHA1:	D989FE1B8F7904888D5102294EBEFD28D932ECDB
SHA-256:	C9399A33BB9C75345130B99D1D7CE886D9148F1936543587848C47B8540DA640
SHA-512:	696E28B6BC7E834C51AB9821D0D65D1A32F00EB15CAA732047B751288EA73D8D703D3152BF81F267147F8C1538E1BF470748DF41176392F10E622F4C7708DD92
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\messages_es.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text, with very long lines
Size (bytes):	3600
Entropy (8bit):	4.74546152535042
Encrypted:	false
MD5:	6D32848BD173B9444B71922616E0645E
SHA1:	1B0334B79DB481C3A59BE6915D5118D760C97BAA
SHA-256:	BE987D93E23AB7318DB095727DEDD8461BA6D98B9409EF8FC7F5C79FA9666B84
SHA-512:	8E9E92D3229FF80761010E4878B4A33BFB9F0BD053040FE152565CFB2819467E9A92609B3786F9BDBF0D7934CF3C7D20BC3369FE1AD7D0DF7FADF561C3FDCA3C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\messages_fr.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text, with very long lines
Size (bytes):	3409
Entropy (8bit):	4.800862996269612
Encrypted:	false
MD5:	C11AB66FEDE3042EE75DFD19032C8A72
SHA1:	69BD2D03C2064F8679DE5B4E430EA61B567C69C5
SHA-256:	8DEEEC35ED29348F5755801F42675E3BF3FA7AD4B1E414ACCA283C4DA40E4D77
SHA-512:	072F8923DF111F82F482D65651758B8B4BA2486CB0EA08FB8B113F472A42A1C3BCB00DAE7D1780CF371E2C2BD955D8B66658D5EE15E548B1EEA16B312FDCBDF9
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\messages_it.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text, with very long lines
Size (bytes):	3223
Entropy (8bit):	4.671266438569996
Encrypted:	false
MD5:	A81C4B0F3BF9A499429E14A881010EF6
SHA1:	DBE49949308F28540A42AE6CD2AD58AFBF615592
SHA-256:	550954F1F80FE0E73D74EB10AD529B454D5EBC626EB94A6B294D7D2ACF06F372
SHA-512:	6FED61CBCD7FE82C15C9A312ACED9D93836EBCFFAF3E13543BC9DD8B4C88400C371D2365FEEE0F1BB844A6372D4128376568A5B6FE666FD6213636FCBD8C7791
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\messages_ja.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text, with very long lines
Size (bytes):	6349
Entropy (8bit):	4.575777726495053
Encrypted:	false
MD5:	B7279F1C3BA0B63806F37F6B9D33C314
SHA1:	751170A7CDEFCB1226604AC3F8196E06A04FD7AC
SHA-256:	8D499C1CB14D58E968A823E11D5B114408C010B053B3B38CFEF7EBF9FB49096F
SHA-512:	4A3BF898A36D55010C8A8F92E5A784516475BDFFFCD337D439D6DA251DDB97BCC7E26F104AC5602320019ED5C0B8DC8883B2581760AFEA9C59C74982574D164B
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\messages_ko.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text, with very long lines
Size (bytes):	5712
Entropy (8bit):	4.758283080201437
Encrypted:	false
MD5:	FED33982E349F696EF21E35ED0DBBDE3
SHA1:	BF9E055B5AB138AD6D49769E2B7630B7938848D6
SHA-256:	D9C95C31B4C1092F32BDCF40D5232B31CC09FB5B68564067C1C2A5F59D3869FA
SHA-512:	88B16B7C3ACFED2FC4B1E3A14006FEF532147EB1E2930D8966E90629069462FB2E8CBF65F561E6CBC9A946F39D1866583CB02D6BB84C60C71428F489DAAA61EF
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\messages_pt_BR.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text, with very long lines
Size (bytes):	3285
Entropy (8bit):	4.837889715420947
Encrypted:	false
MD5:	ED15A441A20EA85C29521A0C7C8C3097
SHA1:	24E4951743521AB9A11381C77BD0CDB1ED30F5B5
SHA-256:	4140663A49040FF191C07D2D04588402263EC2E1679A9A1A79B790A137EE7FB8
SHA-512:	BE5F0639DE6B0AC95792987D0AF83CA77495F7F49953698C8B18692DE982F77B68FE63159E8CD7537D62A71209A9FFABBECF046AD82D8341F613D39F180F9C83
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\messages_sv.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text, with very long lines
Size (bytes):	3384
Entropy (8bit):	4.898189215756456
Encrypted:	false
MD5:	BF9652F69C3BE79D0972E860990CE375
SHA1:	BB5A4AA0BA499F6B1916A83E3C7922A4583B4ADB
SHA-256:	99D7F49ECD3109370C0C6E8F1230317F7BEA299EBBC811CA780028475E59B547
SHA-512:	61232DFB1D9B9D519EE9B000802286EF2708609EA847737477CA5F762DBBBA917ED958EF38D4F7AEAE45AB7ACF830FCCDB6915C1CE1C17662BAAA7722B843132
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\messages_zh_CN.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text, with very long lines
Size (bytes):	4072
Entropy (8bit):	5.01527031899567
Encrypted:	false
MD5:	E6F84C081895ACDFD98DA0F496E1DD3D
SHA1:	1C2B96673DDDD3596890EF4FC22017D484A1F652
SHA-256:	A1752A0175F490F61E0AAD46DC6887C19711F078309062D5260E164AC844F61A
SHA-512:	D4D28780147E22678CD8E7415CACFAD533AE5AF31D74426BBE4993F05A0707E4F0F71D948093FFA1A0D6EA48310E901CD0ED1C14E2FBDF69C92462D070A9664F
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\messages_zh_HK.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text, with very long lines
Size (bytes):	3752
Entropy (8bit):	5.14936903006307
Encrypted:	false
MD5:	880BAACB176553DEAB39EDBE4B74380D
SHA1:	37A57AAD121C14C25E149206179728FA62203BF0
SHA-256:	FF4A3A92BC92CB08D2C32C435810440FD264EDD63E56EFA39430E0240C835620
SHA-512:	3039315BB283198AF9090BD3D31CFAE68EE73BC2B118BBAE0B32812D4E3FD0F11CE962068D4A17B065DAB9A66EF651B9CB8404C0A2DEFCE74BB6B2D1D93646D5
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\messages_zh_TW.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text, with very long lines
Size (bytes):	3752
Entropy (8bit):	5.14936903006307
Encrypted:	false
MD5:	880BAACB176553DEAB39EDBE4B74380D
SHA1:	37A57AAD121C14C25E149206179728FA62203BF0
SHA-256:	FF4A3A92BC92CB08D2C32C435810440FD264EDD63E56EFA39430E0240C835620
SHA-512:	3039315BB283198AF9090BD3D31CFAE68EE73BC2B118BBAE0B32812D4E3FD0F11CE962068D4A17B065DAB9A66EF651B9CB8404C0A2DEFCE74BB6B2D1D93646D5
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\splash.gif
Process:	C:\Windows\System32\xcopy.exe
File Type:	GIF image data, version 89a, 320 x 139
Size (bytes):	8590
Entropy (8bit):	7.910688771816331
Encrypted:	false
MD5:	249053609EAF5B17DDD42149FC24C469
SHA1:	20E7AEC75F6D036D504277542E507EB7DC24AAE8
SHA-256:	113B01304EBBF3CC729A5CA3452DDA2093BD8B3DDC2BA29E5E1C1605661F90BE
SHA-512:	9C04A20E2FA70E4BCFAC729E366A0802F6F5167EA49475C2157C8E2741C4E4B8452D14C75F67906359C12F1514F9FB7E9AF8E736392AC8434F0A5811F7DDE0CB
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\splash@2x.gif
Process:	C:\Windows\System32\xcopy.exe
File Type:	GIF image data, version 89a, 640 x 278
Size (bytes):	15276
Entropy (8bit):	7.949850025334252
Encrypted:	false
MD5:	CB81FED291361D1DD745202659857B1B
SHA1:	0AE4A5BDA2A6D628FAC51462390B503C99509FDC
SHA-256:	9DD5CCD6BDFDAAD38F7D05A14661108E629FDD207FC7776268B566F7941E1435
SHA-512:	4A383107AC2D642F4EB63EE7E7E85A8E2F63C67B41CA55EBAE56B52CECFE8A301AAF14E6536553CBC3651519DB5C10FC66588C84C9840D496F5AE980EF2ED2B9
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\splash_11-lic.gif
Process:	C:\Windows\System32\xcopy.exe
File Type:	GIF image data, version 89a, 320 x 139
Size (bytes):	7805
Entropy (8bit):	7.877495465139721
Encrypted:	false
MD5:	9E8F541E6CEBA93C12D272840CC555F8
SHA1:	8DEF364E07F40142822DF84B5BB4F50846CB5E4E
SHA-256:	C5578AC349105DE51C1E9109D22C7843AAB525C951E312700C73D5FD427281B9
SHA-512:	2AB06CAE68DEC9D92B66288466F24CC25505AF954FA038748D6F294D1CFFB72FCC7C07BA8928001D6C487D1BF71FE0AF1B1AA0F35120E5F6B1B2C209BA596CE2
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\deploy\splash_11@2x-lic.gif
Process:	C:\Windows\System32\xcopy.exe
File Type:	GIF image data, version 89a, 640 x 278
Size (bytes):	12250
Entropy (8bit):	7.901446927123525
Encrypted:	false
MD5:	3FE2013854A5BDAA488A6D7208D5DDD3
SHA1:	D2BFF9BBF7920CA743B81A0EE23B0719B4D057CA
SHA-256:	FC39D09D187739E580E47569556DE0D19AF28B53DF5372C7E0538FD26EDB7988
SHA-512:	E3048E8E0C22F6B200E5275477309083AA0435C0F33D1994C10CE65A52F357EE7CF7081F85C00876F438DFA1EE59B542D602287EC02EA340BFDF90C0C6ABD548
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\ext\access-bridge.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	196904
Entropy (8bit):	7.790739523027544
Encrypted:	false
MD5:	4873F8754FD5414A66C7B1DE5839A0C7
SHA1:	40B5D24717465B9E993328382DE41C4B6893222B
SHA-256:	46B790A98328CCAA48BA0A36225DCC81E78A5F2D762004FD42CF786BCF290FF8
SHA-512:	D2CBF9067AED0B87754FB5EE52BB1ACC88F1681D06776298CE185E75CF7BF09CAD3C89D9D9DA0F4B3D814BB2CD10D6F7840151BA58C879D6C31FAB1EE82C373C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\ext\cldrdata.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	3860502
Entropy (8bit):	7.966948567623716
Encrypted:	false
MD5:	EE54BC33506906367C525A785D0BC2E9
SHA1:	FC27EC22C28ED62DA322B07B11DE3FCC13F2C10F
SHA-256:	290403BC9F7ED7B1453D0EECBF0295FD11E552BE81D78D6173F5B9685A8F106C
SHA-512:	9712C6B271A4D7152AACA0AA43796E9BB23A96DCF580133DB7E2045455D7A6A1893B5BE131137A5D141EF7DFFBF3F980BA19B021D0FB3C628C2702ED13662133
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\ext\dnsns.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	8286
Entropy (8bit):	7.788355319932537
Encrypted:	false
MD5:	1A2BB50407109826AE847F9F6B205CA3
SHA1:	107000650AA0F54D33BF73D71872ADC7A2FE6F77
SHA-256:	A9CD937DD007D0DB121492F8AA281F029135C8E9A8E718429C23217AE02BA155
SHA-512:	2CE6EB9000A5997213F39EF7E71BE62FC89B10E428050EA743FB983F6ED296CD4930D866962D88A7B7C139EE305A6E3F413CAD50DAF4C7887C90A5BA5FBD5DD0
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\ext\jaccess.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	44516
Entropy (8bit):	7.904153386558646
Encrypted:	false
MD5:	B00F9E66A918751F5FD9B608125D7BC3
SHA1:	D12EE41787221682B6748A9D2291F710295CC879
SHA-256:	3AE0D420C6A086B7CFD37C0AC4778B376E41912812D3784096A70650130EA94F
SHA-512:	113BF0B8F7A1F14AE61A9C656E88BCED8175EE8B937C6305423489B69424D54721699F0D0494C72F41A28D92836678FA23DAA9732C914F22DA21A5139DABBB18
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\ext\jfxrt.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v1.0 to extract
Size (bytes):	18238071
Entropy (8bit):	5.973440386801481
Encrypted:	false
MD5:	F31FA50674945D43E05A5007040B1F66
SHA1:	7BA9794C1F8A4CD92375B9C24A8DF6B44929664A
SHA-256:	DD9CA4E9750C8B7A76DC986041252931FE75485AADA9021F49B501BE4FEB7936
SHA-512:	9C0D9529CF2ACC5E70550AB69E0B11208436AEE347E64CF3A1F18D094D4C1914377496A47BEFEDCE99928FB36463B5440CA50529E1E1B99966A3EFE5953EC7F2
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\ext\localedata.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v1.0 to extract
Size (bytes):	2204307
Entropy (8bit):	6.727444706597239
Encrypted:	false
MD5:	B157D9014681541C7434B68E07817A6C
SHA1:	004B08B62C6563590698E2015EBDAB9F437F2DDA
SHA-256:	8C5D06F921BFCD7714AD550C02EC2ECDA60BB84BA9C27B763BEB32C365A5B564
SHA-512:	2B719DB48DDA27BD583FE2E454C58E60F3031CFD3A93E6C828F20F06B0839BAE9522D79FABC772B96F2BA2EC20F3F8DBA419107F0687F612EC238286E1C703F2
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\ext\meta-index
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	1511
Entropy (8bit):	5.142622776492157
Encrypted:	false
MD5:	77ABE2551C7A5931B70F78962AC5A3C7
SHA1:	A8BB53A505D7002DEF70C7A8788B9A2EA8A1D7BC
SHA-256:	C557F0C9053301703798E01DC0F65E290B0AE69075FB49FCC0E68C14B21D87F4
SHA-512:	9FE671380335804D4416E26C1E00CDED200687DB484F770EBBDB8631A9C769F0A449C661CB38F49C41463E822BEB5248E69FD63562C3D8C508154C5D64421935
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\ext\nashorn.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	2023853
Entropy (8bit):	7.932995990000677
Encrypted:	false
MD5:	24DCB76E364E1B58B550D8BC84E2D80C
SHA1:	34A480574BA3D4029E1C947847B112DC47925D69
SHA-256:	BDCB20C9A2F4EB158B29ED1518023C10CE571C45A1CC9C1527714E1D029ABD8A
SHA-512:	767E737BA939A687AEBFFB90A924FD6E45B8026CD4A8ADD5B09E68ED045B90D557C72DE20B1A48232DA942941DE3C51F8AF58A93B090159233EB870FB4511E39
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\ext\sunec.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	41672
Entropy (8bit):	7.932619413425341
Encrypted:	false
MD5:	FB191D1B00134C235F263C18188DD948
SHA1:	BF1C817820341A246F7130FE046E8310B03D04F6
SHA-256:	6F51B006FFCFDD1A29A3DAA0A53A2B485CBBE111866F9CA4AD93DC3E9F57B5B6
SHA-512:	2854D93E2D663E050DAFB683077687D864D4EA63E5F776F38EBAADE4B27E9740AA28305E47B8EF54F413E3247DD89E72172561556ED676EE38B0C2608E03725B
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\ext\sunjce_provider.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	277838
Entropy (8bit):	7.897993668830911
Encrypted:	false
MD5:	4A9EE03BE626D17B46E348F233AB5510
SHA1:	323BC9469F18CB72A4E20EE4D26CA6DAA80E4E96
SHA-256:	6BE7454C0CD5E87D4A198951C2B3C065095234A6BEF94E3B2AB9C748422801B9
SHA-512:	4724AC42C5F335351BB38B2C882EF6B59DF5EE32E813F6C35E150A095D3678052DB7C12F50CFA65DE288FD7464E1498270894006885DC7A36A20701229C0B888
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\ext\sunmscapi.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	33143
Entropy (8bit):	7.865859451497504
Encrypted:	false
MD5:	5C8CCD85BC0A7053592EDB52F137BF51
SHA1:	6452DF62BDD2AA95350F178B87D663E247D53676
SHA-256:	8F83100C9057BCE46A5B6D81027CE9339C439437F2655E7F0F4176F7FB5F57B2
SHA-512:	C5A9FD767CDE6B4ACF0FAB4709FE6F1AE9BEFE7FDA3EA9EC801880D2E5D23D1B5D30B35C79562A30528AF9F3B7C40217347FF26C184CEE5B8B06ACC560F298F1
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\ext\sunpkcs11.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	250131
Entropy (8bit):	7.947794580491802
Encrypted:	false
MD5:	CC517A250C57226D0FEB8271D50F8364
SHA1:	C423FB190B0B7DBC03D6210C4310AA84E4AA1399
SHA-256:	78D8AFF43B52AE526A81AB06E26F65B955AEF991FF8D54E0AFA5E49FED30B2E8
SHA-512:	4BF35E2FFD197FE4490576E5B87D0CCEA827932C40D0401585DD9B65D1895914032D6BBCE85FB4BBCF3685DC76870CDEE79EDCB4B228AC46F5898F0631C33B3C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\ext\zipfs.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	68964
Entropy (8bit):	7.950389438629771
Encrypted:	false
MD5:	94F39BFEFDC9CA55A8827F0FC30D18F9
SHA1:	5A47DABF76D4D770974E04C383F17425D6058E5D
SHA-256:	B46C6772864298C5F5EAB48DED5112D1A0D64E48CF016B8BFF1CF414188176D8
SHA-512:	AB89E3EE82C68063D554D884D0FFC47AF7AC38357C9624259ABDC9942FB514B99C7D6867DE69C4BB53B1C422D904528319A4CF07505CE985F4E2263817303F31
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\flavormap.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	3928
Entropy (8bit):	4.86616891434286
Encrypted:	false
MD5:	D8B47B11E300EF3E8BE3E6E50AC6910B
SHA1:	2D5ED3B53072B184D67B1A4E26AEC2DF908DDC55
SHA-256:	C2748E07B59398CC40CACCCD47FC98A70C562F84067E9272383B45A8DF72A692
SHA-512:	8C5F3E1619E8A92B9D9CF5932392B1CB9F77625316B9EEF447E4DCE54836D90951D9EE70FFD765482414DD51B816649F846E40FD07B4FBDD5080C056ADBBAE6F
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\fontconfig.bfc
Process:	C:\Windows\System32\xcopy.exe
File Type:	raw G3 data
Size (bytes):	3770
Entropy (8bit):	4.414778819875262
Encrypted:	false
MD5:	827F00E05F3C5272AEF3BF456CF52BF5
SHA1:	280EF454A4644D1E17C7AFAC3B94249ED6BBDCBE
SHA-256:	0F2265F0113A757C15D51FA53409D630478378FD0856EF547780B40AC6C87156
SHA-512:	F6F4F9B7EEEA090081CC0FFE9D2DB705F832CF0AF9882B00AC97ECAE89F8C77A8D62EB6F224D78B7195172EDCFF74CD21A2459A7ED9CD6DDB29B3CC32398C4BC
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\fontconfig.properties.src
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text
Size (bytes):	10568
Entropy (8bit):	5.183430724132545
Encrypted:	false
MD5:	A15D4F6635BFB05282B88458D33C1309
SHA1:	A3D930002D0C8BF2FD263CB21EC089D233FFF106
SHA-256:	115B2049DE908E5D9BAD5BDE2ED035E85A7ADE35BF323BFD3D491A8C218146F1
SHA-512:	9B089BD2723F11BDEFA2CE1BE5804C595811BECD8F1ED922E0CFB43DC4C8CEE637E5AE2594A8F3B2B50B750174C9EDB7E30BF7451D6EFA5ECA8741EE86D8205C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\fonts\LucidaBrightDemiBold.ttf
Process:	C:\Windows\System32\xcopy.exe
File Type:	TrueType font data
Size (bytes):	75144
Entropy (8bit):	6.849420541001734
Encrypted:	false
MD5:	AF0C5C24EF340AEA5CCAC002177E5C09
SHA1:	B5C97F985639E19A3B712193EE48B55DDA581FD1
SHA-256:	72CEE3E6DF72AD577AF49C59DCA2D0541060F95A881845950595E5614C486244
SHA-512:	6CE87441E223543394B7242AC0CB63505888B503EC071BBF7DB857B5C935B855719B818090305E17C1197DE882CCC90612FB1E0A0E5D2731F264C663EB8DA3F9
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\fonts\LucidaBrightDemiItalic.ttf
Process:	C:\Windows\System32\xcopy.exe
File Type:	TrueType font data
Size (bytes):	75124
Entropy (8bit):	6.805969666701276
Encrypted:	false
MD5:	793AE1AB32085C8DE36541BB6B30DA7C
SHA1:	1FD1F757FEBF3E5F5FBB7FBF7A56587A40D57DE7
SHA-256:	895C5262CDB6297C13725515F849ED70609DBD7C49974A382E8BBFE4A3D75F8C
SHA-512:	A92ADDD0163F6D81C3AEABD63FF5C293E71A323F4AEDFB404F6F1CDE7F84C2A995A30DFEC84A9CAF8FFAF8E274EDD0D7822E6AABB2B0608696A360CABFC866C6
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\fonts\LucidaBrightItalic.ttf
Process:	C:\Windows\System32\xcopy.exe
File Type:	TrueType font data
Size (bytes):	80856
Entropy (8bit):	6.821405620058844
Encrypted:	false
MD5:	4D666869C97CDB9E1381A393FFE50A3A
SHA1:	AA5C037865C563726ECD63D61CA26443589BE425
SHA-256:	D68819A70B60FF68CA945EF5AD358C31829E43EC25024A99D17174C626575E06
SHA-512:	1D1F61E371E4A667C90C2CE315024AE6168E47FE8A5C02244DBF3DF26E8AC79F2355AC7E36D4A81D82C52149197892DAED1B4C19241575256BB4541F8B126AE2
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\fonts\LucidaBrightRegular.ttf
Process:	C:\Windows\System32\xcopy.exe
File Type:	TrueType font data
Size (bytes):	344908
Entropy (8bit):	6.939775499317555
Encrypted:	false
MD5:	630A6FA16C414F3DE6110E46717AAD53
SHA1:	5D7ED564791C900A8786936930BA99385653139C
SHA-256:	0FAAACA3C730857D3E50FBA1BBAD4CA2330ADD217B35E22B7E67F02809FAC923
SHA-512:	0B7CDE0FACE982B5867AEBFB92918404ADAC7FB351A9D47DCD9FE86C441CACA4DD4EC22E36B61025092220C0A8730D292DA31E9CAFD7808C56CDBF34ECD05035
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\fonts\LucidaSansDemiBold.ttf
Process:	C:\Windows\System32\xcopy.exe
File Type:	TrueType font data
Size (bytes):	317896
Entropy (8bit):	6.869598480468745
Encrypted:	false
MD5:	5DD099908B722236AA0C0047C56E5AF2
SHA1:	92B79FEFC35E96190250C602A8FED85276B32A95
SHA-256:	53773357D739F89BC10087AB2A829BA057649784A9ACBFFEE18A488B2DCCB9EE
SHA-512:	440534EB2076004BEA66CF9AC2CE2B37C10FBF5CC5E0DD8B8A8EDEA25E3613CE8A59FFCB2500F60528BBF871FF37F1D0A3C60396BC740CCDB4324177C38BE97A
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\fonts\LucidaSansRegular.ttf
Process:	C:\Windows\System32\xcopy.exe
File Type:	TrueType font data
Size (bytes):	698236
Entropy (8bit):	6.892888039120645
Encrypted:	false
MD5:	B75309B925371B38997DF1B25C1EA508
SHA1:	39CC8BCB8D4A71D4657FC92EF0B9F4E3E9E67ADD
SHA-256:	F8D877B0B64600E736DFE436753E8E11ACB022E59B5D7723D7D221D81DC2FCDE
SHA-512:	9C792EF3116833C90103F27CFD26A175AB1EB11286959F77062893A2E15DE44D79B27E5C47694CBBA734CC05A9A5BEFA72E991C7D60EAB1495AAC14C5CAD901D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\fonts\LucidaTypewriterBold.ttf
Process:	C:\Windows\System32\xcopy.exe
File Type:	TrueType font data
Size (bytes):	234068
Entropy (8bit):	6.901545053424004
Encrypted:	false
MD5:	A0C96AA334F1AEAA799773DB3E6CBA9C
SHA1:	A5DA2EB49448F461470387C939F0E69119310E0B
SHA-256:	FC908259013B90F1CBC597A510C6DD7855BF9E7830ABE3FC3612AB4092EDCDE2
SHA-512:	A43CF773A42B4CEBF4170A6C94060EA2602D2D7FA7F6500F69758A20DC5CC3ED1793C7CEB9B44CE8640721CA919D2EF7F9568C5AF58BA6E3CF88EAE19A95E796
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\fonts\LucidaTypewriterRegular.ttf
Process:	C:\Windows\System32\xcopy.exe
File Type:	TrueType font data
Size (bytes):	242700
Entropy (8bit):	6.936925430880877
Encrypted:	false
MD5:	C1397E8D6E6ABCD727C71FCA2132E218
SHA1:	C144DCAFE4FAF2E79CFD74D8134A631F30234DB1
SHA-256:	D9D0AAB0354C3856DF81AFAC49BDC586E930A77428CB499007DDE99ED31152FF
SHA-512:	DA70826793C7023E61F272D37E2CC2983449F26926746605C550E9D614ACBF618F73D03D0C6351B9537703B05007CD822E42E6DC74423CB5CC736B31458D33B1
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\hijrah-config-umalqura.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	13962
Entropy (8bit):	3.4283479014478493
Encrypted:	false
MD5:	1EDDFB1EE252055556F40CDC79632E98
SHA1:	84AA425100740722E91F4725CAF849E7863D12BA
SHA-256:	69BECFE0D45B62BBDBCF6FE111A8A3A041FB749B6CF38E8A2F670607E17C9EE2
SHA-512:	A0FDBF42FF105C9A2F12179124606A720DF8F32365605644E15600767E5732312777A58390FDB1A9B1C0B152CCC29496133B278A6E5736B38AF2B5FAB251D40C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\i386\jvm.cfg
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	623
Entropy (8bit):	4.956046853743128
Encrypted:	false
MD5:	9AEF14A90600CD453C4E472BA83C441F
SHA1:	10C53C9FE9970D41A84CB45C883EA6C386482199
SHA-256:	9E86B24FF2B19D814BBAEDD92DF9F0E1AE86BF11A86A92989C9F91F959B736E1
SHA-512:	481562547BF9E37D270D9A2881AC9C86FC8F928B5C176E9BAF6B8F7B72FB9827C84EF0C84B60894656A6E82DD141779B8D283C6E7A0E85D2829EA071C6DB7D14
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\images\cursors\cursors.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	1280
Entropy (8bit):	4.9763389414972465
Encrypted:	false
MD5:	269D03935907969C3F11D43FEF252EF1
SHA1:	713ACB9EFF5F0B14A109E6C2771F62EAC9B57D7C
SHA-256:	7B8B63F78E2F732BD58BF8F16144C4802C513A52970C18DC0BDB789DD04078E4
SHA-512:	94D8EE79847CD07681645D379FEEF6A4005F1836AC00453FB685422D58113F641E60053F611802B0FF8F595B2186B824675A91BF3E68D336EF5BD72FAFB2DCC5
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\images\cursors\invalid32x32.gif
Process:	C:\Windows\System32\xcopy.exe
File Type:	GIF image data, version 89a, 32 x 32
Size (bytes):	153
Entropy (8bit):	6.2813106319833665
Encrypted:	false
MD5:	1E9D8F133A442DA6B0C74D49BC84A341
SHA1:	259EDC45B4569427E8319895A444F4295D54348F
SHA-256:	1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
SHA-512:	63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyDrop32x32.gif
Process:	C:\Windows\System32\xcopy.exe
File Type:	GIF image data, version 89a, 31 x 32
Size (bytes):	165
Entropy (8bit):	6.347455736310776
Encrypted:	false
MD5:	89CDF623E11AAF0407328FD3ADA32C07
SHA1:	AE813939F9A52E7B59927F531CE8757636FF8082
SHA-256:	13C783ACD580DF27207DABCCB10B3F0C14674560A23943AC7233DF7F72D4E49D
SHA-512:	2A35311D7DB5466697D7284DE75BABEE9BD0F0E2B20543332FCB6813F06DEBF2457A9C0CF569449C37F371BFEB0D81FB0D219E82B9A77ACC6BAFA07499EAC2F7
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyNoDrop32x32.gif
Process:	C:\Windows\System32\xcopy.exe
File Type:	GIF image data, version 89a, 32 x 32
Size (bytes):	153
Entropy (8bit):	6.2813106319833665
Encrypted:	false
MD5:	1E9D8F133A442DA6B0C74D49BC84A341
SHA1:	259EDC45B4569427E8319895A444F4295D54348F
SHA-256:	1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
SHA-512:	63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\images\cursors\win32_LinkDrop32x32.gif
Process:	C:\Windows\System32\xcopy.exe
File Type:	GIF image data, version 89a, 31 x 32
Size (bytes):	168
Entropy (8bit):	6.465243369905675
Encrypted:	false
MD5:	694A59EFDE0648F49FA448A46C4D8948
SHA1:	4B3843CBD4F112A90D112A37957684C843D68E83
SHA-256:	485CBE5C5144CFCD13CC6D701CDAB96E4A6F8660CBC70A0A58F1B7916BE64198
SHA-512:	CF2DFD500AF64B63CC080151BC5B9DE59EDB99F0E31676056CF1AFBC9D6E2E5AF18DC40E393E043BBBBCB26F42D425AF71CCE6D283E838E67E61D826ED6ECD27
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\images\cursors\win32_LinkNoDrop32x32.gif
Process:	C:\Windows\System32\xcopy.exe
File Type:	GIF image data, version 89a, 32 x 32
Size (bytes):	153
Entropy (8bit):	6.2813106319833665
Encrypted:	false
MD5:	1E9D8F133A442DA6B0C74D49BC84A341
SHA1:	259EDC45B4569427E8319895A444F4295D54348F
SHA-256:	1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
SHA-512:	63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\images\cursors\win32_MoveDrop32x32.gif
Process:	C:\Windows\System32\xcopy.exe
File Type:	GIF image data, version 89a, 31 x 32
Size (bytes):	147
Entropy (8bit):	6.147949937659802
Encrypted:	false
MD5:	CC8DD9AB7DDF6EFA2F3B8BCFA31115C0
SHA1:	1333F489AC0506D7DC98656A515FEEB6E87E27F9
SHA-256:	12CFCE05229DBA939CE13375D65CA7D303CE87851AE15539C02F11D1DC824338
SHA-512:	9857B329ACD0DB45EA8C16E945B4CFA6DF9445A1EF457E4B8B40740720E8C658301FC3AB8BDD242B7697A65AE1436FD444F1968BD29DA6A89725CDDE1DE387B8
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\images\cursors\win32_MoveNoDrop32x32.gif
Process:	C:\Windows\System32\xcopy.exe
File Type:	GIF image data, version 89a, 32 x 32
Size (bytes):	153
Entropy (8bit):	6.2813106319833665
Encrypted:	false
MD5:	1E9D8F133A442DA6B0C74D49BC84A341
SHA1:	259EDC45B4569427E8319895A444F4295D54348F
SHA-256:	1A1D3079D49583837662B84E11D8C0870698511D9110E710EB8E7EB20DF7AE3B
SHA-512:	63D6F70C8CAB9735F0F857F5BF99E319F6AE98238DC7829DD706B7D6855C70BE206E32E3E55DF884402483CF8BEBAD00D139283AF5C0B85DC1C5BF8F253ACD37
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\javafx.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text
Size (bytes):	56
Entropy (8bit):	4.4137995646056805
Encrypted:	false
MD5:	5EDD777409474036DB6932B6EA35A3BB
SHA1:	2904CF8DAEC22CB14D64A4A73474820EB238B056
SHA-256:	F04F4A2CCCBFB2F0E7042C1EF7A4F06269DB64D676B73DE33689AF5C9E968D84
SHA-512:	4F75EDF3C9AE7D454498B2A7CB244114C022AA96CB9853927E4C68C876CFDBF54DBEF2339C67480D20DC50D6DB3132D043BC5B435C95263E37EDE15E796FD75A
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\javaws.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v1.0 to extract
Size (bytes):	956577
Entropy (8bit):	5.935609233030053
Encrypted:	false
MD5:	E4307FB305181B708EBA8E2A44BC6E9F
SHA1:	8FDEA54257708A38C1F438B1674DE1E7312FA56C
SHA-256:	5B3EE1E46E8F6E4F1A287E0BE2AE2830B5DD512806BA8B443ED79EF0639A6675
SHA-512:	6CCC683FDA749A5856B3BA918E66F61EC10843B763DB14D9D74DE6096D1E95F95191FD0E8FAAA66F272995D1CF9C74D93CEA45E6842CAA1C4A9DEDAB40445348
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\jce.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	115646
Entropy (8bit):	7.910006705550157
Encrypted:	false
MD5:	8E442747088544E5FFD7505479FE059C
SHA1:	5460ADEE09CC5FC8829C0ACFC46C34670A7D70A0
SHA-256:	DA325B8683C9B3B2B68DFD395B2797815CD7D915040A96C459380151F7E4351F
SHA-512:	7C76DA68583FD63C89D50EC8504009F105DB0B4BF9A6F2A9F23E903E0F89BF42B9A8B980B1ABDAB109A0A359D8950A915A8265776ACE84975ADA0B25203B8EEF
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\jfr.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v1.0 to extract
Size (bytes):	560713
Entropy (8bit):	5.779709229909674
Encrypted:	false
MD5:	09EF254262A505DA0717DD6640D95D8C
SHA1:	04AEB057D977721B51AEFF519FD968C2CF265BE6
SHA-256:	B922DF6B9CD15CDB826570885F3D7E324CAAD5536A04708EA72515F3B1BC0541
SHA-512:	D8F16555C8CE7F84655F34FABADD4994DB05F8760056684487861A0353125CC69AA9B4465E78FC68951BF20EC610CDFCCE9D5978B8F64A09CA8FDE69305DE37A
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\jfr\default.jfc
Process:	C:\Windows\System32\xcopy.exe
File Type:	XML document text
Size (bytes):	20109
Entropy (8bit):	4.571267855712911
Encrypted:	false
MD5:	41D5CD8DB1F75101304308A9EE3612FF
SHA1:	1A64B68D0E7D43F8149FABA94440BE54F4F24527
SHA-256:	0C8CD372C548E4DDCBB0FA8CD6FCA09D65EC312D784F495BE19BAF1BF06C57F3
SHA-512:	77D752A9C8ADC5C5D4F2AFAA158B0D105A172426CDD0F2D17EACDA5F6572CE4FD76CA6B142588BF8FCF69BB41FC1141F3808ECB40FD54F0F45944691D8CC2E2E
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\jfr\profile.jfc
Process:	C:\Windows\System32\xcopy.exe
File Type:	XML document text
Size (bytes):	20065
Entropy (8bit):	4.570942254721535
Encrypted:	false
MD5:	8B5C309810D64A8C62E7CDC6436F97A9
SHA1:	5D7D08A595F76322C51AE43EA966FBBA6B69EEBE
SHA-256:	F70E4C858A96603DE6C042EA796300C232953AAB17579FF4E7A47FE9FFE17C26
SHA-512:	D28DF53CD060853E2BC8EE7FC1384D2E2FA5B9C38D1C4AF19B9E13FE89E130262231C76CE656D4A7FBBBE4B893F3DCEC1D2BE56562A5BA65C4306673FBC49F0F
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\jfxswt.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v1.0 to extract
Size (bytes):	33932
Entropy (8bit):	7.931585258571254
Encrypted:	false
MD5:	65A0181C52B4F34650ED0871DD20C1FE
SHA1:	16ABC3619FA5278051ADF5315873F6E9FB6C9BFA
SHA-256:	55D3969F0E90B833B17ECAC9FD81BA6F0E713F8D3348DC9A1D203F35808EF952
SHA-512:	A9F15E2D37D6AB2BAE307BA469C6CF5EB1117291B488AA4747D6CA1CF168BDDDDD70E85653271AA383B8D89823E884B632687F4A511EB4429AB7C353FEE52C70
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\jsse.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v1.0 to extract
Size (bytes):	606778
Entropy (8bit):	6.0992455611587015
Encrypted:	false
MD5:	CD29374C4C491BDD6203792391539110
SHA1:	D9F9A7D75A1A050797E9F2DE05F580A879BE658F
SHA-256:	ABFE013278C7BF24C20E37DBEFC16D7603471FBF013A1AFB8DED908B9AC51FD1
SHA-512:	F967798D435C38D1DBA190E660DF78633798CDB337DACE2ACD270868BECB82799300608DEB0B1F0AA020F1F1D2541A128ABE47E46BF1494F36C90B99A818DF2F
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\jvm.hprof.txt
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	4226
Entropy (8bit):	4.708892688554676
Encrypted:	false
MD5:	C677FF69E70DC36A67C72A3D7EF84D28
SHA1:	FBD61D52534CDD0C15DF332114D469C65D001E33
SHA-256:	B055BF25B07E5AC70E99B897FB8152F288769065B5B84387362BB9CC2E6C9D38
SHA-512:	32D82DAEDBCA1988282A3BF67012970D0EE29B16A7E52C1242234D88E0F3ED8AF9FC9D6699924D19D066FD89A2100E4E8898AAC67675D4CD9831B19B975ED568
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\logging.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	2455
Entropy (8bit):	4.47026133037931
Encrypted:	false
MD5:	809C50033F825EFF7FC70419AAF30317
SHA1:	89DA8094484891F9EC1FA40C6C8B61F94C5869D0
SHA-256:	CE1688FE641099954572EA856953035B5188E2CA228705001368250337B9B232
SHA-512:	C5AA71AD9E1D17472644EB43146EDF87CAA7BCCF0A39E102E31E6C081CD017E01B39645F55EE87F4EA3556376F7CAD3953CE3F3301B4B3AF265B7B4357B67A5C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\management-agent.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	381
Entropy (8bit):	4.911613678050225
Encrypted:	false
MD5:	0DF1BB22956455853BED5C2434673692
SHA1:	73EE8069D68F19DB4E545F3432D97F8EFF067954
SHA-256:	6008E2220FCDD136A1D696DD1D6F41937C2A265E108983BA9F0DF305FE9A6A67
SHA-512:	C10C3ACAB5C97046346B40D6380378F097917594FC6284B5792C779CA0CB7A5F5292CD54A866AB152EBA5400FF57CE6CFB39C784F039CD41C6DBDA57BFA58834
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\management\jmxremote.access
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	3998
Entropy (8bit):	4.420205717459709
Encrypted:	false
MD5:	F63BEA1F4A31317F6F061D83215594DF
SHA1:	21200EAAD898BA4A2A8834A032EFB6616FABB930
SHA-256:	439158EB513525FEDA19E0E4153CCF36A08FE6A39C0C6CEEB9FCEE86899DD33C
SHA-512:	DE49913B8FA2593DC71FF8DAC85214A86DE891BEDEE0E4C5A70FCDD34E605F8C5C8483E2F1BDB06E1001F7A8CF3C86CAD9FA575DE1A4DC466E0C8FF5891A2773
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\management\jmxremote.password.template
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII C++ program text
Size (bytes):	2856
Entropy (8bit):	4.492265087792545
Encrypted:	false
MD5:	7B46C291E7073C31D3CE0ADAE2F7554F
SHA1:	C1E0F01408BF20FBBB8B4810520C725F70050DB5
SHA-256:	3D83E336C9A24D09A16063EA1355885E07F7A176A37543463596B5DB8D82F8FA
SHA-512:	D91EEBC8F30EDCE1A7E16085EB1B18CFDDF0566EFAB174BBCA53DE453EE36DFECB747D401E787A4D15CC9798E090E19A8A0CF3FC8246116CE507D6B464068CDB
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\management\management.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	14630
Entropy (8bit):	4.568210341404396
Encrypted:	false
MD5:	5EDB0D3275263013F0981FF0DF96F87E
SHA1:	E0451D8D7D9E84D7B1C39EC7D00993307A5CBBF1
SHA-256:	3A923735D9C2062064CD8FD30FF8CCA84D0BC0AB5A8FAB80FDAD3155C0E3A380
SHA-512:	F31A3802665F9BB1A00A0F838B94AE4D9F1B9D6284FAF626EBE4F96819E24494771A1B8BFE655FD2DA202C5463D47BAE3B2391764E6F4C5867C0337AA21C87C1
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\management\snmp.acl.template
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII C++ program text
Size (bytes):	3376
Entropy (8bit):	4.371600962667748
Encrypted:	false
MD5:	71A7DE7DBE2977F6ECE75C904D430B62
SHA1:	2E9F9AC287274532EB1F0D1AFCEFD7F3E97CC794
SHA-256:	F1DC97DA5A5D220ED5D5B71110CE8200B16CAC50622B33790BB03E329C751CED
SHA-512:	3A46E2A4E8A78B190260AFE4EEB54E7D631DB50E6776F625861759C0E0BC9F113E8CD8D734A52327C28608715F6EB999A3684ABD83EE2970274CE04E56CA1527
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\meta-index
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2126
Entropy (8bit):	4.970874214349507
Encrypted:	false
MD5:	91AA6EA7320140F30379F758D626E59D
SHA1:	3BE2FEBE28723B1033CCDAA110EAF59BBD6D1F96
SHA-256:	4AF21954CDF398D1EAE795B6886CA2581DAC9F2F1D41C98C6ED9B5DBC3E3C1D4
SHA-512:	03428803F1D644D89EB4C0DCBDEA93ACAAC366D35FC1356CCABF83473F4FEF7924EDB771E44C721103CEC22D94A179F092D1BFD1C0A62130F076EB82A826D7CB
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\net.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	4464
Entropy (8bit):	4.834345958771967
Encrypted:	false
MD5:	2FE77CD007D99DDE926A22094E333E0E
SHA1:	6587F43B93527DD17ABCD5699EB9682B6F08C09B
SHA-256:	16C93910B2785E7CBDDA90D5479AA9687148C2141AC0ADBD0277FDE284F6BBB3
SHA-512:	33D32B1C50BAFC4BCEE1D97D81176E3C9FF6B316536A7A88F76DB92781B4ACB716CC9FF75A97AB32F4469838B370A8DF54B2E2F5FE97F0873B8A44CD2B848FAA
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\plugin.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v1.0 to extract
Size (bytes):	1923848
Entropy (8bit):	6.073438184635327
Encrypted:	false
MD5:	11B95AE5DACF1F46A0ABCE819AB1244A
SHA1:	4D1782EEE74380B683351C4F93FF47FFEAA1B76A
SHA-256:	C149EAB201113BC78DAB2003A762CD83CF4A2F0CEA92ECFD796C3FA0D69ED7C9
SHA-512:	3BC5E897B0975CDB6AAEFA8B89BF3DD4F3C61D19D6E3109CB5DB043D723BA194672D76B8D7057A03BE9F8610F8207D515CBB3031D687ADDE9FBEF326FA720502
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\psfont.properties.ja
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text
Size (bytes):	2796
Entropy (8bit):	5.182793663606788
Encrypted:	false
MD5:	7C5514B805B4A954BC55D67B44330C69
SHA1:	56ED1C661EEEDE17B4FAE8C9DE7B5EDBAD387ABC
SHA-256:	0C790DE696536165913685785EA8CBE1AC64ACF09E2C8D92D802083A6DA09393
SHA-512:	CCD4CB61C95DEFDCBA6A6A3F898C29A64CD5831A8AB50E0AFAC32ADB6A9E0C4A4BA37EB6DEE147830DA33AE0B2067473132C0B91A21D546A6528F42267A2C40E
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\psfontj2d.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	10393
Entropy (8bit):	4.970762688893053
Encrypted:	false
MD5:	F8734590A1AEC97F6B22F08D1AD1B4BB
SHA1:	AA327A22A49967F4D74AFEEE6726F505F209692F
SHA-256:	7D51936FA3FD5812AE51F9F5657E0E70487DCA810B985607B6C5D6603F5E6C98
SHA-512:	72E62DC63DAA2591B48B2B774E2479B8861D159061B92FD3A0A06256295DA4D8B20DAFA77983FDBF6179F666F9FF6B3275F7A5BCF9555E638595230B9A42B177
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\resources.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v1.0 to extract
Size (bytes):	3492544
Entropy (8bit):	6.064636719501429
Encrypted:	false
MD5:	D331D9224A53EBA9B76A3CC06D65BC7F
SHA1:	71ADF39D44620487384ED5BC002CD071DC8C0A7E
SHA-256:	D8713ADF96EC01590A8F11B27AED5D904F03D8A9B4F41F1DD770ACAC9A52FA87
SHA-512:	6DB2AF98420F3E7A95EEEB0B40517A565EE68D2CAC32821B4BF43BF5C2AA4B8CF0A5D862B185A14431B559BA82A12235BA8D671D56CD92D5AF61A6B6C299ADD2
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\rt.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v1.0 to extract
Size (bytes):	54675310
Entropy (8bit):	6.042090170984797
Encrypted:	false
MD5:	A8D62D1122AB1CBEC625218D6BFF8C82
SHA1:	B50F41B668B2E84BA0C2CD2F5014AAB4787E7CD9
SHA-256:	61A06545E4EE1499C5D0E6654095E473836A6E52C2328E2449E86D2B7872DEF9
SHA-512:	33A3360447F1DE5E36CD9F411C4707FCBF3918930A9D8ED5B9BDEBA0F3D453C0ED907927483F1BE5FC590F362683AB22AD7731ABA9EF4D01C09C1352FDA42C2A
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\security\blacklist
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text
Size (bytes):	4054
Entropy (8bit):	5.791238368311065
Encrypted:	false
MD5:	B2C6EAE6382150192EA3912393747180
SHA1:	D4FFB3857EAB403955CE9D156E46D056061E6A5A
SHA-256:	6C73C877B36D4ABD086CB691959B180513AC5ABC0C87FE9070D2D5426D3DBF71
SHA-512:	898582C23F311F9F46825E7F8B6D36BED7255E5A4E2FA4B4452153B86EFBD88DB7E5B94DBD9CB9DB554F62B84D19F22AE9D81822B4896081C487FB50946A9A9A
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\security\blacklisted.certs
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text
Size (bytes):	1253
Entropy (8bit):	4.115037497545474
Encrypted:	false
MD5:	B9C358F9D668E86FDA8048982E741ACC
SHA1:	8870BEF548310B648EF044DB40C5EC609F896F0B
SHA-256:	DDD297102146AC7F6607B35C0E0B565975739A7841DA5E5A6207B6F4EBB2D822
SHA-512:	91CED5411767FBA041B950AD46F71A19F5DD48AF3D2199DA835D6CB9062AB80076A961D1F91856D74DBB0E037B092729D065204A74E113C914B33CD9B2F714B7
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\security\cacerts
Process:	C:\Windows\System32\xcopy.exe
File Type:	Java KeyStore
Size (bytes):	106896
Entropy (8bit):	7.60090379885828
Encrypted:	false
MD5:	E05D4EB65F8A922E578DA0A0D901A157
SHA1:	A2AFF1E3E349FE6AB6FA62CCA02753BD5617904F
SHA-256:	5957F02C0E9FCB793152F1D2B27F57C02F375241C28814A59AE223C2438E0F41
SHA-512:	89A7DE17DCA92790298463D0FE53A0A664CBDF9F0CD87EB913C958A0A15D0F2252A4EE660A95958680E52A317CCE5E066466B7FAF5D892390D0B16073D2BD67D
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\security\java.policy
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII C++ program text
Size (bytes):	2466
Entropy (8bit):	4.437992103838927
Encrypted:	false
MD5:	11340CD598A8517A0FD315A319716A08
SHA1:	C0112209A567B3B523CFED7041709F9440227968
SHA-256:	B8582889B0DF36065093C642ED0F9FA2A94CC0DC6FDE366980CFD818EC957250
SHA-512:	2B6DADC555EEB28DC1C553AB429F0CB9E3AD9AA64DFA2B62910769A935A1E6030A7FF0DDE2689F29C58D1B0720416D6B99FFA19BD23E6686EFB1547AFB7DCCFD
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\security\java.security
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text, with CRLF line terminators
Size (bytes):	42610
Entropy (8bit):	4.8445887255568465
Encrypted:	false
MD5:	41641408632A73C7A7D5FC1378BEB3CE
SHA1:	3E31533E1BC9A55075F47D1F3E6A9F0A6C677601
SHA-256:	4E3EAA2A2E5B66CC002068A4B0BECC168914BFADBE7509805D49614F6E2EBF91
SHA-512:	D31281F5D60D37E5493C998DF4E40F42004E7E805EF147AC1565987085AD063417F0D62BF17940FE096017FD3C4C4183EC757E22426C09B34DA39458FF825985
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\security\javaws.policy
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text
Size (bytes):	98
Entropy (8bit):	4.75309355004813
Encrypted:	false
MD5:	9107D028BD329DBFE4C1F19015ED6D80
SHA1:	4384CA5E4D32F7DD86D8BADDD1E690730D74E694
SHA-256:	B7A87D1F3F4B7BA1D19D0460FA4B63BD1093AFC514D67FE3C356247236326425
SHA-512:	81B14373B64CE14AF26B70D12D831E05158D5A4FA8CEC0508FEF8A6CA65B6F4EF73928F4B1E617C68DDEACFF9328A3D4433B041B7FB14DE248B1428C51DBC716
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\security\policy\limited\US_export_policy.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	3026
Entropy (8bit):	7.48902128028383
Encrypted:	false
MD5:	EE4ED9C75A1AAA04DFD192382C57900C
SHA1:	7D69EA3B385BC067738520F1B5C549E1084BE285
SHA-256:	90012F900CF749A0E52A0775966EF575D390AD46388C49D512838983A554A870
SHA-512:	EAE6A23D2FD7002A55465844E662D7A5E3ED5A6A8BAF7317897E59A92A4B806DD26F2A19B7C05984745050B4FE3FFA30646A19C0F08451440E415F958204137C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\security\policy\limited\local_policy.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	3527
Entropy (8bit):	7.521709350514316
Encrypted:	false
MD5:	57AAAA3176DC28FC554EF0906D01041A
SHA1:	238B8826E110F58ACB2E1959773B0A577CD4D569
SHA-256:	B8BECC3EF2E7FF7D2165DD1A4E13B9C59FD626F20A26AF9A32277C1F4B5D5BC7
SHA-512:	8704B5E3665F28D1A0BC2A063F4BC07BA3C7CD8611E06C0D636A91D5EA55F63E85C6D2AD49E5D8ECE267D43CA3800B3CD09CF369841C94D30692EB715BB0098E
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\security\policy\unlimited\US_export_policy.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	3023
Entropy (8bit):	7.508070596860004
Encrypted:	false
MD5:	EF6E8EAE7D1876D7F05D765D2C2E0529
SHA1:	F6FB2AF1E87FC622CDA194A7D6B5F5F069653FF1
SHA-256:	FADF649815E8DD4295980EC4C81A76E25FEA3CECC8067DE333A075BBCDAF8FB9
SHA-512:	26C46FED68540C1F0567CCA482C20FF399C7F6521621DC865F845A38FDB8EB26D05C05AB642AFE14078529A4504758ACEE6D9910BDE5EF0CF53D77162AA369B9
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\security\policy\unlimited\local_policy.jar
Process:	C:\Windows\System32\xcopy.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	3035
Entropy (8bit):	7.503555903928921
Encrypted:	false
MD5:	DABFCB23D7BF9BF5A201C3F6EA9BFB2C
SHA1:	517368AB2CBAF6B42EA0B963F98EEEDD996E83E3
SHA-256:	4924CBE86A60D93351C8955B924B714FFDEEA776B2621D84E3BAD99749C56DF3
SHA-512:	16A6AC1BD13F9974118EBB444E4A10DB6D55696A1363BC865E9C0BCC3A285438944C167F1B2FCF549970C9075ED6290D6C1A4C1BA94E64B4E84697BF8D317B64
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\sound.properties
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	1210
Entropy (8bit):	4.681309933800066
Encrypted:	false
MD5:	4F95242740BFB7B133B879597947A41E
SHA1:	9AFCEB218059D981D0FA9F07AAD3C5097CF41B0C
SHA-256:	299C2360B6155EB28990EC49CD21753F97E43442FE8FAB03E04F3E213DF43A66
SHA-512:	99FDD75B8CE71622F85F957AE52B85E6646763F7864B670E993DF0C2C77363EF9CFCE2727BADEE03503CDA41ABE6EB8A278142766BF66F00B4EB39D0D4FC4A87
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\tzdb.dat
Process:	C:\Windows\System32\xcopy.exe
File Type:	data
Size (bytes):	105882
Entropy (8bit):	7.1195132173140125
Encrypted:	false
MD5:	41A96E63EF9886A79F5F2C1DF5E8D40A
SHA1:	A8A54A5DB56642B94CEDB1E07E9ED6B713393CB5
SHA-256:	9ACF0CA3BCC10C06C926296650B158CBA38E2CED24462004F33B0A765AECA6F2
SHA-512:	C92C851C8BF8ACE51CA6E0CDB59028C9BA5C45FD4D8229D8D6278063ABCF3EBA42CD28A8A5028231B1DAB7517CD7BA4E4C36ABD9567EEC751860900865225123
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\lib\tzmappings
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII English text
Size (bytes):	9577
Entropy (8bit):	5.17061677089257
Encrypted:	false
MD5:	62BC9FA21191D34F1DB3ED7AD5106EFA
SHA1:	750CC36B35487D6054E039469039AECE3A0CC9E9
SHA-256:	83755EFBCB24476F61B7B57BCF54707161678431347E5DE2D7B894D022A0089A
SHA-512:	AF0DDB1BC2E9838B8F37DC196D26024126AC989F5B632CB2A8EFDC29FBCE289B4D0BAC587FE23F17DFB6905CEADA8D07B18508DB78F226B15B15900738F581A3
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Oracle\release
Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text, with very long lines
Size (bytes):	425
Entropy (8bit):	5.451985736528572
Encrypted:	false
MD5:	09B81EA8917C30E3769248DCF26106DE
SHA1:	E28B12945CBE526A5795AE50C174E4A7920DCE3A
SHA-256:	579B63DD73A24856609A531BA6132A2FE15E35675C79D50193974B6C2422BC69
SHA-512:	505C9CA217222F71E4D0ADBA7F72EE997526299ABC843A7131D4674D260D66243DF13588B064FD760DB8C1547B44FFC1A9CCB1C928F12CCED2B7008B5B5CAF01
Malicious:	false
Reputation:	low

C:\Users\user\KtXRptueuIB\ID.txt
Process:	C:\Program Files\Java\jre1.8.0_191\bin\java.exe
File Type:	ASCII text, with no line terminators
Size (bytes):	47
Entropy (8bit):	4.330976617543022
Encrypted:	false
MD5:	78A2EEC5DFDF191CB85B2EE15043284C
SHA1:	3B3A639376129A69B4FE77BF9396D3C88483EA8E
SHA-256:	6E6368C7817EDA44ECBB49001BA4F238047A5B8CD77F2E772A69E6915F434864
SHA-512:	343F29E41F97425B4CEF32D33E09DA3E52CC3A385F02AB5FA17FFDF676FAE1E529C55E8F7DDDA48CB66D9491689D29D4DD064088912130792C4083EE2F473C79
Malicious:	false
Reputation:	low

C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG
Process:	C:\Program Files\Java\jre1.8.0_191\bin\java.exe
File Type:	Zip archive data, at least v2.0 to extract
Size (bytes):	697566
Entropy (8bit):	7.4852454310795284
Encrypted:	false
MD5:	19CD10627207BCF7F7C41EE26CBDD174
SHA1:	D6E369AB13757655D962812C85C25D88CF84BC06
SHA-256:	CF9B4DC7D49BE9AE92C254EB489660E8D4BDDDBFAEFE6169C65AC3F0F7D78AB8
SHA-512:	8C816EC2321FB0F9B52531F7F5BEDDBB8024C51D1DB71BDD6D355C9F47BD3AB916B799C08AB806D74E98F4E418B47FC7E1363EE3BBD120EA21F4C0AEDC5979A2
Malicious:	true
Reputation:	low

C:\Users\user\fUTkALeaTxM\ID.txt
Process:	C:\Users\user\AppData\Roaming\Oracle\bin\java.exe
File Type:	ASCII text, with no line terminators
Size (bytes):	47
Entropy (8bit):	4.383960128089257
Encrypted:	false
MD5:	F64BAA7B2C517AFED262E256E8EAA399
SHA1:	2C9D8426914D3297DDA9AC3EA218ADC3818B3144
SHA-256:	84FDC4959CA3D92C2259A2440773BD69717CD8BCA453CC53ED61555EDC1915CC
SHA-512:	2C23F8195936AF0530642D183554753D09535219067A80C3B37CFE4EE92F8663D7F7D1C23AED351E9550786753F02E62F8F1E43C8E66C00BA8E740799C45675E
Malicious:	false
Reputation:	low

C:\Windows\System32\test.txt
Process:	C:\Users\user\AppData\Roaming\Oracle\bin\java.exe
File Type:	ASCII text, with very long lines, with no line terminators
Size (bytes):	405
Entropy (8bit):	5.564225910306235
Encrypted:	false
MD5:	76C66A673D141E17BEAA2020616F66C2
SHA1:	BE826646007F52523E3CD23173DC6F631F5F3C4D
SHA-256:	2B85347DF7653F485E4E8B99659D760362363145AFF6A7BA026DBD9C8BE12F30
SHA-512:	9567FB0AF25141950D3D749C30D07DE8FB6103255F240453FA2D8D56DBB50E959AC43BF9BDD7A16FC836C34B35E83F45C23149EC796E615E489DC5BC71FD9195
Malicious:	false
Reputation:	low

C:\cmdlinestart.log
Process:	C:\Program Files\Java\jre1.8.0_191\bin\java.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Size (bytes):	4688
Entropy (8bit):	4.047638648333259
Encrypted:	false
MD5:	A49C688BBB382C166DCFB8AC622B9D17
SHA1:	5FC9ECEAC5C5343BB7E85FE98BC62BDD8BF914D7
SHA-256:	4AB062531FD65B39ADA1660652F96CFFDAB272608FB6229793BDB4FA3479EC41
SHA-512:	2D5B62BABD220343EC0027823FB315C2512D9407CD93C6C87A60C7463DC82EC3E0666C9144C995A4F863B0ADB48846D25D99133F046FA6BD7B4B317D1AFF9E49
Malicious:	false
Reputation:	low

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
onyeka1.duckdns.org	185.244.30.124	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.freebxml.org/	THIRDPARTYLICENSEREADME.txt.19.dr	false	unknown
http://www.linuxnet.com	THIRDPARTYLICENSEREADME.txt.19.dr	false	unknown
http://www.oracle.com/goto/opensourcecode/request	THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://upx.sourceforge.net/upx-license.html.	THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://bugzilla.gnome.org/enter_bug.cgi?product=GStreamer.GStreamer	gstreamer-lite.dll.19.dr	false	high
http://creativecommons.org/licenses/	gstreamer-lite.dll.19.dr	false	high
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd	jfxwebkit.dll.19.dr	false	high
http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/tip/src/share/native/sun/security/ec/impl	THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://musicbrainz.org	gstreamer-lite.dll.19.dr	false	high
http://www.freebxml.org/).	THIRDPARTYLICENSEREADME.txt.19.dr	false	unknown
http://mozilla.org/MPL/2.0/.	THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://www.apache.org/).	THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://hg.openjdk.java.net/openjfx/8u/rt	THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr	false	high
http://www.unicode.org/Public/	THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr, THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://relaxngcc.sf.net/).	THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://bugzilla.gnome.org/enter_bug.cgi?product=GStreamer.	gstreamer-lite.dll.19.dr	false	high
http://www.nexus.hu/upx	THIRDPARTYLICENSEREADME.txt.19.dr	false	unknown
http://javafx.com/vp6decoderflvdemuxvideo/unsupportedvideo/x-vp6-flashvideo/x-vp6-alphaOn2	fxplugins.dll.19.dr	false	unknown
http://tartarus.org/~martin/PorterStemmer	THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://download.oracle.com/javase/7/docs/technotes/guides/plugin/	Welcome.html.19.dr	false	high
http://exslt.org/commonnode-set	jfxwebkit.dll.19.dr	false	unknown
http://bugreport.sun.com/bugreport/java.vendor.url.bughttp://java.oracle.com/java.vendor.urljava.ven	java.dll.19.dr	false	unknown
http://wildsau.idv.uni-linz.ac.at/mfx/upx.html	THIRDPARTYLICENSEREADME.txt.19.dr	false	unknown
http://bugzilla.gnome.org/enter_bug.cgi?product=GStreamer.Your	gstreamer-lite.dll.19.dr	false	high
http://creativecommons.org/licenses/WOAFID3PrivateFramehttp://musicbrainz.org%d/%d%drxRemixcr	gstreamer-lite.dll.19.dr	false	high
http://www.apache.org/licenses/LICENSE-2.0	THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://www.unicode.org/Public/.	THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr, THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://java.sun.com/products/jpda	jdwp.dll.19.dr	false	unknown
http://tools.ietf.org/html/rfc3986#section-2.1.The	jfxwebkit.dll.19.dr	false	high
http://www.apache.org/licenses/	THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//w3c//dtd	jfxwebkit.dll.19.dr	false	high
https://sourceforge.net/project/?group_id=1519	THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr	false	high
http://casper.beckman.uiuc.edu/~c-tsai4	THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr	false	high
http://exslt.org/common	jfxwebkit.dll.19.dr	false	unknown
http://bugreport.sun.com/bugreport/	java.dll.19.dr	false	unknown
http://java.oracle.com/	java.dll.19.dr	false	high
http://www.unicode.org/reports/	THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr, THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://www.xfree86.org/)	THIRDPARTYLICENSEREADME.txt.19.dr	false	unknown
http://tools.ietf.org/html/rfc3986#section-2.1.	jfxwebkit.dll.19.dr	false	high
http://www.symauth.com/cps0(	awt.dll.19.dr	false	high
http://www.ifpi.org/isrc/	gstreamer-lite.dll.19.dr	false	high
http://chasen.aist-nara.ac.jp/chasen/distribution.html	THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr	false	unknown
http://www.ecma-international.org/memento/codeofconduct.htm	THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://www.unicode.org/cldr/data/.	THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://opensource.org/licenses/bsd-license.php	THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr	false	high
http://www.symauth.com/rpa00	awt.dll.19.dr	false	high
http://bugzilla.gnome.org/enter_bug.cgi?product=GStreamer.Internal	gstreamer-lite.dll.19.dr	false	high
http://www.ecma-international.org	THIRDPARTYLICENSEREADME.txt.19.dr	false	high
http://www.oracle.com/technetwork/java/javase/overview/	Welcome.html.19.dr	false	high
http://javafx.com/	fxplugins.dll.19.dr	false	unknown
http://www.unicode.org/copyright.html.	THIRDPARTYLICENSEREADME-JAVAFX.txt.19.dr	false	high
http://upx.tsx.org	THIRDPARTYLICENSEREADME.txt.19.dr	false	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Country	Flag	ASN	ASN Name	Malicious
185.244.30.124	unknown		60781	LEASEWEB-NLNetherlandsNL	false

Private

IP
127.0.0.1

Static File Info

General
File type:	Zip archive data, at least v2.0 to extract
Entropy (8bit):	7.4852454310795284
TrID:	Java Archive (13504/1) 77.13% ZIP compressed archive (4004/1) 22.87%
File name:	INV 3326GHF- from Outriger General Importers Korea for acknowledgment.jar
File size:	697566
MD5:	19cd10627207bcf7f7c41ee26cbdd174
SHA1:	d6e369ab13757655d962812c85c25d88cf84bc06
SHA256:	cf9b4dc7d49be9ae92c254eb489660e8d4bdddbfaefe6169c65ac3f0f7d78ab8
SHA512:	8c816ec2321fb0f9b52531f7f5beddbb8024c51d1db71bdd6d355c9f47bd3ab916b799c08ab806d74e98f4e418b47fc7e1363ee3bbd120ea21f4c0aedc5979a2
SSDEEP:	12288:q2LabHNfJZct6FidIwzkdzsgoPuSrWMvzHF/1ADYcO4NFYx9kz:q2Labx5EkhlohKWzHF/MW4sqz
File Content Preview:	PK.........F.M................META-INF/MANIFEST.MF.....M..LK-...K-*....R0.3.3...M...u.I,..R(-..O..-M...s)IK.).......PK......>...<...PK.........F.M................uphoc/mubhl/Sfraf.class.$o.........4...........Fhtslphp...()V...Roftmaof...Rhncd...Fjychu...H

File Icon


Icon Hash:	3074e8e8cecec0c4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dez 30, 2018 12:44:36.456410885 MEZ	49810	53	192.168.1.16	8.8.8.8
Dez 30, 2018 12:44:36.624973059 MEZ	53	49810	8.8.8.8	192.168.1.16
Dez 30, 2018 12:44:36.639990091 MEZ	49230	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:36.665887117 MEZ	6654	49230	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:37.215635061 MEZ	49230	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:37.241189957 MEZ	6654	49230	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:37.776716948 MEZ	49230	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:37.800169945 MEZ	6654	49230	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:39.815455914 MEZ	49233	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:39.840564966 MEZ	6654	49233	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:40.356328011 MEZ	49233	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:40.380196095 MEZ	6654	49233	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:40.887629032 MEZ	49233	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:40.912261009 MEZ	6654	49233	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:43.693867922 MEZ	55151	53	192.168.1.16	8.8.8.8
Dez 30, 2018 12:44:43.864792109 MEZ	53	55151	8.8.8.8	192.168.1.16
Dez 30, 2018 12:44:43.876147985 MEZ	49239	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:43.900703907 MEZ	6654	49239	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:44.403340101 MEZ	49239	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:44.427285910 MEZ	6654	49239	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:44.934648037 MEZ	49239	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:44.958069086 MEZ	6654	49239	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:47.303112030 MEZ	49241	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:47.328500986 MEZ	6654	49241	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:47.825532913 MEZ	49241	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:47.850816965 MEZ	6654	49241	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:48.199431896 MEZ	49244	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:48.225536108 MEZ	6654	49244	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:48.419351101 MEZ	49241	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:48.444052935 MEZ	6654	49241	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:48.825433969 MEZ	49244	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:48.849982023 MEZ	6654	49244	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:49.356184959 MEZ	49244	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:49.381390095 MEZ	6654	49244	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:50.465234995 MEZ	49245	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:50.490381002 MEZ	6654	49245	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:50.996865988 MEZ	49245	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:51.025161028 MEZ	6654	49245	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:51.528068066 MEZ	49245	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:51.552350998 MEZ	6654	49245	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:56.540594101 MEZ	49252	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:56.565109015 MEZ	6654	49252	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:57.075481892 MEZ	49252	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:57.100915909 MEZ	6654	49252	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:57.606573105 MEZ	49252	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:57.635808945 MEZ	6654	49252	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:59.379951000 MEZ	49254	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:59.405019999 MEZ	6654	49254	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:59.695060968 MEZ	49256	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:59.720097065 MEZ	6654	49256	185.244.30.124	192.168.1.16
Dez 30, 2018 12:44:59.918813944 MEZ	49254	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:44:59.944835901 MEZ	6654	49254	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:00.215545893 MEZ	49256	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:00.239665985 MEZ	6654	49256	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:00.449955940 MEZ	49254	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:00.475878954 MEZ	6654	49254	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:00.746686935 MEZ	49256	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:00.772038937 MEZ	6654	49256	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:02.496368885 MEZ	49259	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:02.525196075 MEZ	6654	49259	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:03.122494936 MEZ	49259	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:03.148942947 MEZ	6654	49259	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:03.653724909 MEZ	49259	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:03.680573940 MEZ	6654	49259	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:05.905905008 MEZ	49264	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:05.931739092 MEZ	6654	49264	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:06.434302092 MEZ	49264	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:06.459389925 MEZ	6654	49264	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:06.965420961 MEZ	49264	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:06.990614891 MEZ	6654	49264	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:08.810151100 MEZ	53216	53	192.168.1.16	8.8.8.8
Dez 30, 2018 12:45:08.837255001 MEZ	53	53216	8.8.8.8	192.168.1.16
Dez 30, 2018 12:45:08.839272976 MEZ	49267	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:08.863174915 MEZ	6654	49267	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:09.096544027 MEZ	49268	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:09.122150898 MEZ	6654	49268	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:09.372282982 MEZ	49267	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:09.398852110 MEZ	6654	49267	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:09.621836901 MEZ	49268	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:09.647186995 MEZ	6654	49268	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:09.918688059 MEZ	49267	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:09.944161892 MEZ	6654	49267	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:10.153101921 MEZ	49268	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:10.177269936 MEZ	6654	49268	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:11.953943968 MEZ	49271	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:11.980993032 MEZ	6654	49271	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:12.481271029 MEZ	49271	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:12.507330894 MEZ	6654	49271	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:13.012495041 MEZ	49271	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:13.039478064 MEZ	6654	49271	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:15.479866028 MEZ	49792	53	192.168.1.16	8.8.8.8
Dez 30, 2018 12:45:15.648642063 MEZ	53	49792	8.8.8.8	192.168.1.16
Dez 30, 2018 12:45:15.717869997 MEZ	49276	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:15.742773056 MEZ	6654	49276	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:16.246701956 MEZ	49276	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:16.271672964 MEZ	6654	49276	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:16.778661966 MEZ	49276	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:16.804430962 MEZ	6654	49276	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:18.099725962 MEZ	49279	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:18.124608040 MEZ	6654	49279	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:18.637963057 MEZ	49279	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:18.663903952 MEZ	6654	49279	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:18.822419882 MEZ	49280	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:18.847964048 MEZ	6654	49280	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:19.169281960 MEZ	49279	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:19.193943977 MEZ	6654	49279	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:19.356443882 MEZ	49280	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:19.382571936 MEZ	6654	49280	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:19.887320995 MEZ	49280	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:19.911587954 MEZ	6654	49280	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:21.201455116 MEZ	49283	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:21.226911068 MEZ	6654	49283	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:21.731195927 MEZ	49283	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:21.756067991 MEZ	6654	49283	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:22.273978949 MEZ	49283	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:22.297663927 MEZ	6654	49283	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:25.003048897 MEZ	49288	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:25.027970076 MEZ	6654	49288	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:25.575541973 MEZ	49288	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:25.599376917 MEZ	6654	49288	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:26.106277943 MEZ	49288	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:26.136616945 MEZ	6654	49288	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:27.342976093 MEZ	49291	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:27.368577957 MEZ	6654	49291	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:27.871876001 MEZ	49291	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:27.899758101 MEZ	6654	49291	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:28.156121016 MEZ	49292	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:28.191970110 MEZ	6654	49292	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:28.403542042 MEZ	49291	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:28.429286957 MEZ	6654	49291	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:28.699841022 MEZ	49292	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:28.726943016 MEZ	6654	49292	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:29.231101990 MEZ	49292	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:29.256097078 MEZ	6654	49292	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:30.467705011 MEZ	49295	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:30.496177912 MEZ	6654	49295	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:31.003829956 MEZ	49295	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:31.032721996 MEZ	6654	49295	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:31.528038025 MEZ	49295	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:31.552843094 MEZ	6654	49295	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:34.299595118 MEZ	49300	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:34.324933052 MEZ	6654	49300	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:34.840750933 MEZ	49300	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:34.868134022 MEZ	6654	49300	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:35.371999979 MEZ	49300	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:35.395879984 MEZ	6654	49300	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:36.560916901 MEZ	49303	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:36.585345984 MEZ	6654	49303	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:37.087167025 MEZ	49303	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:37.112091064 MEZ	6654	49303	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:37.477390051 MEZ	49304	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:37.502825022 MEZ	6654	49304	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:37.606038094 MEZ	49303	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:37.632864952 MEZ	6654	49303	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:38.012522936 MEZ	49304	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:38.035943985 MEZ	6654	49304	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:38.539212942 MEZ	49304	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:38.565459967 MEZ	6654	49304	185.244.30.124	192.168.1.16
Dez 30, 2018 12:45:39.645184994 MEZ	50672	53	192.168.1.16	8.8.8.8
Dez 30, 2018 12:45:39.816361904 MEZ	53	50672	8.8.8.8	192.168.1.16
Dez 30, 2018 12:45:39.817671061 MEZ	49307	6654	192.168.1.16	185.244.30.124
Dez 30, 2018 12:45:39.844302893 MEZ	6654	49307	185.244.30.124	192.168.1.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dez 30, 2018 12:44:36.456410885 MEZ	49810	53	192.168.1.16	8.8.8.8
Dez 30, 2018 12:44:36.624973059 MEZ	53	49810	8.8.8.8	192.168.1.16
Dez 30, 2018 12:44:43.693867922 MEZ	55151	53	192.168.1.16	8.8.8.8
Dez 30, 2018 12:44:43.864792109 MEZ	53	55151	8.8.8.8	192.168.1.16
Dez 30, 2018 12:45:08.810151100 MEZ	53216	53	192.168.1.16	8.8.8.8
Dez 30, 2018 12:45:08.837255001 MEZ	53	53216	8.8.8.8	192.168.1.16
Dez 30, 2018 12:45:15.479866028 MEZ	49792	53	192.168.1.16	8.8.8.8
Dez 30, 2018 12:45:15.648642063 MEZ	53	49792	8.8.8.8	192.168.1.16
Dez 30, 2018 12:45:39.645184994 MEZ	50672	53	192.168.1.16	8.8.8.8
Dez 30, 2018 12:45:39.816361904 MEZ	53	50672	8.8.8.8	192.168.1.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dez 30, 2018 12:44:36.456410885 MEZ	192.168.1.16	8.8.8.8	0xf03	Standard query (0)	onyeka1.duckdns.org	A (IP address)	IN (0x0001)
Dez 30, 2018 12:44:43.693867922 MEZ	192.168.1.16	8.8.8.8	0x9ec5	Standard query (0)	onyeka1.duckdns.org	A (IP address)	IN (0x0001)
Dez 30, 2018 12:45:08.810151100 MEZ	192.168.1.16	8.8.8.8	0x1c05	Standard query (0)	onyeka1.duckdns.org	A (IP address)	IN (0x0001)
Dez 30, 2018 12:45:15.479866028 MEZ	192.168.1.16	8.8.8.8	0xd268	Standard query (0)	onyeka1.duckdns.org	A (IP address)	IN (0x0001)
Dez 30, 2018 12:45:39.645184994 MEZ	192.168.1.16	8.8.8.8	0xd2f8	Standard query (0)	onyeka1.duckdns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Dez 30, 2018 12:44:36.624973059 MEZ	8.8.8.8	192.168.1.16	0xf03	No error (0)	onyeka1.duckdns.org	185.244.30.124	A (IP address)	IN (0x0001)
Dez 30, 2018 12:44:43.864792109 MEZ	8.8.8.8	192.168.1.16	0x9ec5	No error (0)	onyeka1.duckdns.org	185.244.30.124	A (IP address)	IN (0x0001)
Dez 30, 2018 12:45:08.837255001 MEZ	8.8.8.8	192.168.1.16	0x1c05	No error (0)	onyeka1.duckdns.org	185.244.30.124	A (IP address)	IN (0x0001)
Dez 30, 2018 12:45:15.648642063 MEZ	8.8.8.8	192.168.1.16	0xd268	No error (0)	onyeka1.duckdns.org	185.244.30.124	A (IP address)	IN (0x0001)
Dez 30, 2018 12:45:39.816361904 MEZ	8.8.8.8	192.168.1.16	0xd2f8	No error (0)	onyeka1.duckdns.org	185.244.30.124	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: cmd.exe PID: 4080 Parent PID: 1780

General

Start time:	12:43:54
Start date:	30/12/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\INV 3326GHF- from Outriger General Importers Korea for acknowledgment.jar'' >> C:\cmdlinestart.log 2>&1
Imagebase:	0x4a440000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	Java
Reputation:	low

Chronological Activities

Analysis Process: java.exe PID: 3864 Parent PID: 4080

General

Start time:	12:43:54
Start date:	30/12/2018
Path:	C:\Program Files\Java\jre1.8.0_191\bin\java.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\INV 3326GHF- from Outriger General Importers Korea for acknowledgment.jar'
Imagebase:	0x8c0000
File size:	192376 bytes
MD5 hash:	1A4BAEBCD4466698D9FA846719405E92
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: icacls.exe PID: 1912 Parent PID: 3864

General

Start time:	12:43:56
Start date:	30/12/2018
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M
Imagebase:	0x850000
File size:	27136 bytes
MD5 hash:	1542A92D5C6F7E1E80613F3466C9CE7F
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: java.exe PID: 2056 Parent PID: 3864

General

Start time:	12:44:01
Start date:	30/12/2018
Path:	C:\Program Files\Java\jre1.8.0_191\bin\java.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Java\jre1.8.0_191\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar C:\Users\user~1\AppData\Local\Temp\_0.63493269659919425532230313552172834.class
Imagebase:	0x8c0000
File size:	192376 bytes
MD5 hash:	1A4BAEBCD4466698D9FA846719405E92
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 3360 Parent PID: 3864

General

Start time:	12:44:07
Start date:	30/12/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5438807271024442592.vbs
Imagebase:	0x4a440000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cscript.exe PID: 3596 Parent PID: 3360

General

Start time:	12:44:07
Start date:	30/12/2018
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive5438807271024442592.vbs
Imagebase:	0xda0000
File size:	126976 bytes
MD5 hash:	A3A35EE79C64A640152B3113E6E254E2
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 1948 Parent PID: 2056

General

Start time:	12:44:09
Start date:	30/12/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7307749898854467482.vbs
Imagebase:	0x4a440000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cscript.exe PID: 3156 Parent PID: 1948

General

Start time:	12:44:09
Start date:	30/12/2018
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7307749898854467482.vbs
Imagebase:	0xda0000
File size:	126976 bytes
MD5 hash:	A3A35EE79C64A640152B3113E6E254E2
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 2256 Parent PID: 3864

General

Start time:	12:44:11
Start date:	30/12/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive2024933177882465042.vbs
Imagebase:	0x4a440000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cscript.exe PID: 3600 Parent PID: 2256

General

Start time:	12:44:11
Start date:	30/12/2018
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive2024933177882465042.vbs
Imagebase:	0xda0000
File size:	126976 bytes
MD5 hash:	A3A35EE79C64A640152B3113E6E254E2
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 2296 Parent PID: 2056

General

Start time:	12:44:11
Start date:	30/12/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7530535289870207342.vbs
Imagebase:	0x4a440000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cscript.exe PID: 2988 Parent PID: 2296

General

Start time:	12:44:11
Start date:	30/12/2018
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7530535289870207342.vbs
Imagebase:	0xda0000
File size:	126976 bytes
MD5 hash:	A3A35EE79C64A640152B3113E6E254E2
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: xcopy.exe PID: 1908 Parent PID: 3864

General

Start time:	12:44:12
Start date:	30/12/2018
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy 'C:\Program Files\Java\jre1.8.0_191' 'C:\Users\user\AppData\Roaming\Oracle\' /e
Imagebase:	0x5a0000
File size:	36864 bytes
MD5 hash:	361D273773994ED11A6F1E51BBB4277E
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: xcopy.exe PID: 2008 Parent PID: 2056

General

Start time:	12:44:13
Start date:	30/12/2018
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy 'C:\Program Files\Java\jre1.8.0_191' 'C:\Users\user\AppData\Roaming\Oracle\' /e
Imagebase:	0x5a0000
File size:	36864 bytes
MD5 hash:	361D273773994ED11A6F1E51BBB4277E
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 2816 Parent PID: 3864

General

Start time:	12:44:30
Start date:	30/12/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe
Imagebase:	0x4a440000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: reg.exe PID: 1880 Parent PID: 3864

General

Start time:	12:44:32
Start date:	30/12/2018
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v bJnYSNphoio /t REG_EXPAND_SZ /d '\'C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe\' -jar \'C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG\'' /f
Imagebase:	0x9c0000
File size:	62464 bytes
MD5 hash:	D69A9ABBB0D795F21995C2F48C1EB560
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: attrib.exe PID: 272 Parent PID: 3864

General

Start time:	12:44:33
Start date:	30/12/2018
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h 'C:\Users\user\KtXRptueuIB\.'
Imagebase:	0x770000
File size:	16384 bytes
MD5 hash:	459A5755AFBB1CB3E67CA4C1296599E3
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: attrib.exe PID: 3664 Parent PID: 3864

General

Start time:	12:44:33
Start date:	30/12/2018
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h 'C:\Users\user\KtXRptueuIB'
Imagebase:	0x770000
File size:	16384 bytes
MD5 hash:	459A5755AFBB1CB3E67CA4C1296599E3
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: javaw.exe PID: 2524 Parent PID: 3864

General

Start time:	12:44:33
Start date:	30/12/2018
Path:	C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG
Imagebase:	0x1220000
File size:	192376 bytes
MD5 hash:	84C2540CEDB08C146D1AD06122E6CC12
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: javaw.exe PID: 2356 Parent PID: 3768

General

Start time:	12:44:36
Start date:	30/12/2018
Path:	C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe' -jar 'C:\Users\user\KtXRptueuIB\XSZHGSWUUvB.nxPNyG'
Imagebase:	0x1220000
File size:	192376 bytes
MD5 hash:	84C2540CEDB08C146D1AD06122E6CC12
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: java.exe PID: 2864 Parent PID: 2356

General

Start time:	12:44:47
Start date:	30/12/2018
Path:	C:\Users\user\AppData\Roaming\Oracle\bin\java.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\user~1\AppData\Local\Temp\_0.27057588722335616152848481378506703.class
Imagebase:	0x9d0000
File size:	192376 bytes
MD5 hash:	1A4BAEBCD4466698D9FA846719405E92
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 856 Parent PID: 2356

General

Start time:	12:44:53
Start date:	30/12/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7103461586894408784.vbs
Imagebase:	0x4a440000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cscript.exe PID: 1532 Parent PID: 856

General

Start time:	12:44:54
Start date:	30/12/2018
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive7103461586894408784.vbs
Imagebase:	0xeb0000
File size:	126976 bytes
MD5 hash:	A3A35EE79C64A640152B3113E6E254E2
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 2932 Parent PID: 2864

General

Start time:	12:44:57
Start date:	30/12/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3097055394604195664.vbs
Imagebase:	0x4a440000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cscript.exe PID: 2288 Parent PID: 2932

General

Start time:	12:44:59
Start date:	30/12/2018
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript.exe C:\Users\user~1\AppData\Local\Temp\Retrive3097055394604195664.vbs
Imagebase:	0xeb0000
File size:	126976 bytes
MD5 hash:	A3A35EE79C64A640152B3113E6E254E2
Has administrator privileges:	true
Programmed in:	"C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Reset < >

Description:	Command-line interfaces provide a way of interacting with computer systems and is a common feature across many types of operating system platforms. One example command-line interface on Windows systems is cmd , which can be used to perform a number of tasks including execution of other software. Command-line interfaces can be interacted with locally or remotely via a remote desktop application, reverse shell session, etc. Commands that are executed run with the current permission level of the command-line interface process unless the command includes process invocation that changes permissions context for that execution (e.g. Scheduled Task ).
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and PowerShell but could also be in the form of command-line batch scripts.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process Monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion, Persistence
Data Sources:	File monitoring, Process Monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process Monitoring, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting.
Tactics:	Defense Evasion
Data Sources:	API monitoring, Anti-virus, File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules, anti-virus, and virtualization. These checks may be built into early-stage remote access tools.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries will likely attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may conduct C2 communications over a non-standard port to bypass proxies and firewalls that have been improperly configured.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be whitelisted within a target environment. Remote access tools like VNC, Ammy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process Monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Use of a standard non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a common, standardized application layer protocol such as HTTP, HTTPS, SMTP, or DNS to avoid detection by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report INV 3326GHF- from Outriger General Importers Korea for acknowledgment.jar

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Spreading:

Software Vulnerabilities:

Networking:

DDoS:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Remote Access Functionality:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Screenshots

Thumbnails

Startup

Created / dropped Files

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: cmd.exe PID: 4080 Parent PID: 1780

General

Analysis Process: java.exe PID: 3864 Parent PID: 4080

General

Analysis Process: icacls.exe PID: 1912 Parent PID: 3864

General