Edit tour

Windows Analysis Report
https://repo.maven.apache.org/maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar

Overview

General Information

Sample URL:	https://repo.maven.apache.org/maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar
Analysis ID:	1431469
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Exploit detected, runtime environment starts unknown processes

Contains functionality to detect virtual machines (SLDT)

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Found inlined nop instructions (likely shell or obfuscated code)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2208,i,13480584101053597956,9907863780671905047,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://repo.maven.apache.org/maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

7za.exe (PID: 7128 cmdline: 7za.exe x -y -oC:\jar "C:\Users\user\Downloads\picocli-4.1.4.jar" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

java.exe (PID: 6608 cmdline: java.exe -jar "C:\Users\user\Downloads\picocli-4.1.4.jar" picocli.AutoComplete MD5: 9DAA53BAB2ECB33DC0D9CA51552701FA)

conhost.exe (PID: 6556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 5168 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 6708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49748 version: TLS 1.2

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\System32\conhost.exe

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Code function: 4x nop then cmp eax, dword ptr [ecx+04h]

11_2_0287FBA6

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26

Source: global traffic	HTTP traffic detected: GET /maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar HTTP/1.1Host: repo.maven.apache.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=65HSr++Fuo+LbRH&MD=bw4YOY8N HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=65HSr++Fuo+LbRH&MD=bw4YOY8N HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: repo.maven.apache.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: java.exe, 0000000B.00000002.2530976526.0000000009F6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe, 0000000B.00000002.2530976526.0000000009F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.oracle.com/
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	String found in binary or memory: http://picocli.info/)
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	String found in binary or memory: http://stackoverflow.com/a/12495480/1440785
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	String found in binary or memory: http://tiswww.case.edu/php/chet/bash/FAQ
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	String found in binary or memory: http://zsh.sourceforge.net/Doc/Release/Options.html#index-COMPLETE_005fALIASES
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	String found in binary or memory: https://github.com/scop/bash-completion)
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	String found in binary or memory: https://stackoverflow.com/questions/17042057/bash-check-element-in-array-for-elements-in-another-arr
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	String found in binary or memory: https://stackoverflow.com/questions/3249432/can-a-bash-tab-completion-script-be-used-in-zsh/27853970
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	String found in binary or memory: https://www.gnu.org/software/bash/manual/html_node/Programmable-Completion.html#Programmable-Complet
Source: java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	String found in binary or memory: https://www.gnu.org/software/bash/manual/html_node/The-Shopt-Builtin.html

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: classification engine

Classification label: sus24.expl.win@24/211@4/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\8e79ea8f-e22d-448d-88fd-ec974ae80df0.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6708:120:WilError_03
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6296:120:WilError_03

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user

Jump to behavior

Source: C:\Windows\System32\conhost.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Windows\System32\7za.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2208,i,13480584101053597956,9907863780671905047,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://repo.maven.apache.org/maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar"
Source: unknown	Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar "C:\Users\user\Downloads\picocli-4.1.4.jar"
Source: C:\Windows\System32\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe java.exe -jar "C:\Users\user\Downloads\picocli-4.1.4.jar" picocli.AutoComplete
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2208,i,13480584101053597956,9907863780671905047,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior

Source: C:\Windows\System32\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

File opened: C:\Program Files (x86)\Java\jre-1.8\lib\i386\jvm.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 11_2_02879FBC push ds; retn 0000h	11_2_0287A026
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 11_2_0287DB61 push ecx; retn 0022h	11_2_0287DC16
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 11_2_0287D8A7 push es; iretd	11_2_0287D8AE
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 11_2_027DD8F7 push 00000000h; mov dword ptr [esp], esp	11_2_027DD921
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 11_2_027DA21B push ecx; ret	11_2_027DA225
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 11_2_027DA20A push ecx; ret	11_2_027DA21A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 11_2_027DBB67 push 00000000h; mov dword ptr [esp], esp	11_2_027DBB8D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 11_2_027DB3B7 push 00000000h; mov dword ptr [esp], esp	11_2_027DB3DD
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 11_2_027DD8D1 push 00000000h; mov dword ptr [esp], esp	11_2_027DD921
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 11_2_027DB947 push 00000000h; mov dword ptr [esp], esp	11_2_027DB96D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 11_2_027DC477 push 00000000h; mov dword ptr [esp], esp	11_2_027DC49D

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Code function: 11_2_0287F37D sldt word ptr [eax]

11_2_0287F37D

Source: C:\Windows\System32\conhost.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: java.exe, 0000000B.00000003.2518820537.0000000014E6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 0000000B.00000003.2518820537.0000000014E6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 0000000B.00000002.2529316342.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: java.exe, 0000000B.00000003.2518820537.0000000014E6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 0000000B.00000002.2529316342.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cjava/lang/VirtualMachineError
Source: java.exe, 0000000B.00000003.2518820537.0000000014E6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK
Source: java.exe, 0000000B.00000002.2529316342.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\6608 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Services File Permissions Weakness	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Services File Permissions Weakness	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	22 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Services File Permissions Weakness	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label	Link
https://repo.maven.apache.org/maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar	0%	Avira URL Cloud	safe
https://repo.maven.apache.org/maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://bugreport.sun.com/bugreport/	0%	URL Reputation	safe
http://bugreport.sun.com/bugreport/	0%	URL Reputation	safe
http://picocli.info/)	0%	Avira URL Cloud	safe
http://picocli.info/)	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
maven.map.fastly.net	151.101.0.215	true	false	unknown
www.google.com	108.177.122.103	true	false	high
repo.maven.apache.org	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
http://java.oracle.com/	java.exe, 0000000B.00000002.2530976526.0000000009F71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://zsh.sourceforge.net/Doc/Release/Options.html#index-COMPLETE_005fALIASES	java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	false		high
http://picocli.info/)	java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.gnu.org/software/bash/manual/html_node/Programmable-Completion.html#Programmable-Complet	java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	false		high
http://tiswww.case.edu/php/chet/bash/FAQ	java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	false		high
https://github.com/scop/bash-completion)	java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	false		high
https://stackoverflow.com/questions/17042057/bash-check-element-in-array-for-elements-in-another-arr	java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	false		high
https://www.gnu.org/software/bash/manual/html_node/The-Shopt-Builtin.html	java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	false		high
http://bugreport.sun.com/bugreport/	java.exe, 0000000B.00000002.2530976526.0000000009F6B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://stackoverflow.com/a/12495480/1440785	java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	false		high
https://stackoverflow.com/questions/3249432/can-a-bash-tab-completion-script-be-used-in-zsh/27853970	java.exe, 0000000B.00000002.2530976526.000000000A01B000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2529907378.0000000004ECE000.00000004.00000800.00020000.00000000.sdmp, java.exe, 0000000B.00000002.2533598631.00000000150C0000.00000004.00000020.00020000.00000000.sdmp, AutoComplete.class.9.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.0.215	maven.map.fastly.net	United States	54113	FASTLYUS	false
108.177.122.103	www.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431469
Start date and time:	2024-04-25 08:38:36 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://repo.maven.apache.org/maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus24.expl.win@24/211@4/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 91% Number of executed functions: 12 Number of non-executed functions: 3

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.882568083276078
Encrypted:	false
SSDEEP:	3:oFj4I5vpm4USedy:oJ5b7
MD5:	0CCA690C231B17369077F963D683BBBC
SHA1:	E0AACB706D9687273B3203C5DF82AAC54721128A
SHA-256:	BB94D1BFAFF6D845E34E1C9EF1C2AB918E92C342421C33CDAE3EC20142FC2BF7
SHA-512:	BD6749CCEF3E4386CCECC2BF3460C0907C5C519649A355DF2070975E9951B1CAFE7973C982765A62FEBDF9970108C3B5A666AF2CB06CD045F4F6CC46578F4366
Malicious:	false
Reputation:	low
Preview:	C:\Program Files (x86)\Java\jre-1.8..1714027252068..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	351557
Entropy (8bit):	7.925722457921734
Encrypted:	false
SSDEEP:	6144:t+/5s97fikCA09Vcji1AorL7oEBPjE2awNR4DvAVbMxy8IaKg2AGWdXrK:Gs97WVgAHpLE2a+R4cVIxyp5g9GWNu
MD5:	28605E00382694EB4944D5EDB340CB5B
SHA1:	E9AC7856611815391F85AC66C8CEADACB51250B5
SHA-256:	4649B93987327CBD4ABB44BD24870FF49E3F8FAF2FD5C32C0ADE28EC9C213687
SHA-512:	336C77CE7CA0A96A30F3CB6AB0119392898F5FAA9079DFFACFE714F321B4311DCE33537A82BADBCCA72925D5EDF54C214FD873B49CC49A6A4C639168D4E81ADE
Malicious:	false
Reputation:	low
Preview:	PK...........O................META-INF/......PK..............PK...........O................META-INF/MANIFEST.MFmRMo.0.........m......x.26...........3...sl...\|.y.f ..kC..k.d...\...j....9...G....#6...F..Iv.w.^...x.r.;t}.wJ..b.4.C.I5.....m.1e...<.MC..K....c...,>...%.G8.fOO...%s.:Oe%.Di.N..F....,.N...G.-UUB..v.\.T@]w...1*U..U4.p.B.P..n,...k$)T....Z..N..{...d6...+6{.......0.q....s.jy..[.w....R"...2..e4b..8.Y.:...PK......@...S...PK...........O................META-INF/versions/..PK..............PK...........O................META-INF/versions/9/..PK..............PK...........O............%...META-INF/versions/9/module-info.class;.o.>...S..F......T...\|v.FF...K. 39?9'S........a`ed..J,K.KJ,N.f`gd`..ko```b..." ).."..q4@h6....PK....a.......PK...........O................picocli/..PK..............PK...........O................picocli/AutoComplete$1.class.S]o.A.=..R..Z....VQ.. ...A.Mhm.....a...e....~./.`.?..e...J..>..;3.{....~....K..9....!....%==2......C.t.z...=.T......t.

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	595
Entropy (8bit):	5.177490979459722
Encrypted:	false
SSDEEP:	12:1TtBK6FfhT4H3DIibL0bPYUmYgAcfNBirM7c7gcTgYWGY:/Bt94XUibL0rWfNBiI9T
MD5:	E0DEA81A9DD5CC08DBC31FB72EA61158
SHA1:	31BEED033066F6F40004E6D7FA090E8783318A25
SHA-256:	9C64A31A5DED8F8E4B5E4612EC788193829F0949E0945F77081391B57F52796A
SHA-512:	2A8661489E0F06C657D1C2E70DABE6E4C7B01E2710801C20916611111B7636CCA4E5FBAD389A4A9351EA99CBACF8B5021B5C98B4A6CF64436D203A7B2BE505BD
Malicious:	false
Reputation:	low
Preview:	Manifest-Version: 1.0..Bnd-LastModified: 1576970520870..Bundle-ManifestVersion: 2..Bundle-Name: picocli..Bundle-SymbolicName: picocli..Bundle-Version: 4.1.4..Created-By: 1.8.0_202 (Oracle Corporation)..Export-Package: picocli;version="4.1.4"..Implementation-Title: picocli..Implementation-Vendor: Remko Popma..Implementation-Version: 4.1.4..Main-Class: picocli.AutoComplete..Multi-Release: true..Require-Capability: osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))"..Specification-Title: picocli..Specification-Vendor: Remko Popma..Specification-Version: 4.1.4..Tool: Bnd-4.2.0.201903051501....

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 08:39:32.002212048 CEST	53	56655	1.1.1.1	192.168.2.4
Apr 25, 2024 08:39:32.134749889 CEST	53	58250	1.1.1.1	192.168.2.4
Apr 25, 2024 08:39:32.763123989 CEST	53	63440	1.1.1.1	192.168.2.4
Apr 25, 2024 08:39:33.092155933 CEST	60183	53	192.168.2.4	1.1.1.1
Apr 25, 2024 08:39:33.092451096 CEST	65170	53	192.168.2.4	1.1.1.1
Apr 25, 2024 08:39:33.204400063 CEST	53	60183	1.1.1.1	192.168.2.4
Apr 25, 2024 08:39:33.244399071 CEST	53	65170	1.1.1.1	192.168.2.4
Apr 25, 2024 08:39:35.002516031 CEST	51512	53	192.168.2.4	1.1.1.1
Apr 25, 2024 08:39:35.002639055 CEST	64073	53	192.168.2.4	1.1.1.1
Apr 25, 2024 08:39:35.112457991 CEST	53	64073	1.1.1.1	192.168.2.4
Apr 25, 2024 08:39:35.112647057 CEST	53	51512	1.1.1.1	192.168.2.4
Apr 25, 2024 08:39:49.187665939 CEST	138	138	192.168.2.4	192.168.2.255
Apr 25, 2024 08:39:50.248677015 CEST	53	63474	1.1.1.1	192.168.2.4
Apr 25, 2024 08:40:09.198626041 CEST	53	51659	1.1.1.1	192.168.2.4
Apr 25, 2024 08:40:31.508521080 CEST	53	62080	1.1.1.1	192.168.2.4
Apr 25, 2024 08:40:32.023209095 CEST	53	63992	1.1.1.1	192.168.2.4
Apr 25, 2024 08:40:59.848774910 CEST	53	49366	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2024-04-25 06:39:33 UTC	715	OUT	GET /maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar HTTP/1.1 Host: repo.maven.apache.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 06:39:33 UTC	549	IN	HTTP/1.1 200 OK Connection: close Content-Length: 351557 ETag: "28605e00382694eb4944d5edb340cb5b" Content-Type: application/java-archive Last-Modified: Sat, 21 Dec 2019 23:33:58 GMT X-Checksum-MD5: 28605e00382694eb4944d5edb340cb5b X-Checksum-SHA1: e9ac7856611815391f85ac66c8ceadacb51250b5 Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 762348 Date: Thu, 25 Apr 2024 06:39:33 GMT X-Served-By: cache-iad-kjyo7100100-IAD, cache-pdk-kfty2130069-PDK X-Cache: HIT, HIT X-Cache-Hits: 17696, 0 X-Timer: S1714027174.647540,VS0,VE1
2024-04-25 06:39:33 UTC	16384	IN	Data Raw: 50 4b 03 04 14 00 08 08 08 00 c0 ba 95 4f 00 00 00 00 00 00 00 00 00 00 00 00 09 00 04 00 4d 45 54 41 2d 49 4e 46 2f fe ca 00 00 03 00 50 4b 07 08 00 00 00 00 02 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 08 08 00 c0 ba 95 4f 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 4d 45 54 41 2d 49 4e 46 2f 4d 41 4e 49 46 45 53 54 2e 4d 46 6d 52 4d 6f 82 30 18 be 93 f0 1f 88 87 05 0e 6d 0a 93 a9 18 0f 93 78 d8 32 36 a3 c6 eb f2 0a af a6 b1 b4 ac 14 33 ff fd 8a 73 6c 2e 1c fb 7c f5 79 d2 66 20 f9 1e 6b 43 b6 a8 6b ae 64 e2 85 94 b9 ce 5c 16 e4 05 6a 93 a9 82 ef 39 16 16 8e 47 0f 93 11 8b 23 36 1e b5 82 46 16 02 49 76 b5 77 ee a8 a3 5e a1 c4 c4 ab 78 ae 72 c1 3b 74 7d 2e 77 4a f0 bc 9f ed 62 86 34 a4 43 d7 49 35 82 c1 82 cc cf 6d af 31 65 ef 11 8b 3c ff 4d 43 2e d0 Data Ascii: PKOMETA-INF/PKPKOMETA-INF/MANIFEST.MFmRMo0mx263sl.\|yf kCkd\j9G#6FIvw^xr;t}.wJb4CI5m1e<MC.
2024-04-25 06:39:33 UTC	16384	IN	Data Raw: 27 8d d4 72 15 59 d4 12 24 c3 5b ca 66 c5 a6 24 0d ad 9d 4b 64 69 8f c1 32 56 d3 41 38 81 cb 24 d5 13 07 a0 6e 00 96 ef 86 ec fe 23 cf 71 43 3d 37 ac a8 c9 ae 70 67 3f 04 0d fc 58 99 84 1f 84 93 78 8c fe 23 77 56 14 ac b2 1b 04 19 b4 54 18 8e ab 9b eb 42 60 9f b8 03 c6 e0 9d 50 88 77 91 5b ee 25 a9 df 43 e8 ef 85 66 dc 07 67 e3 fd f0 35 7c 00 ae c1 07 e1 01 7c 08 f6 e3 7e 78 12 07 a4 e4 97 91 64 ae a1 5e 65 58 4e a5 b3 a1 0e 2b b0 52 fa d1 d3 09 6d 3c 2d 25 4f 79 10 dc 41 06 eb 20 6d d4 c3 25 58 85 73 c1 26 4d 9d 23 97 de b3 9a 7a ea 6d f3 38 2c f0 01 ac 61 ce 97 13 76 17 c1 0e 14 34 36 17 9c 5c 63 67 61 8f b3 c3 01 38 85 65 e4 49 e3 cf 70 61 b6 77 bd e0 a8 38 04 2b d6 9b c6 dd 44 30 65 ba 39 53 0c 59 5d 7e 10 9a 6d b0 ae cc 9d 5d 4e 5e e1 a8 18 84 16 77 Data Ascii: 'rY$[f$Kdi2VA8$n#qC=7pg?Xx#wVTB`Pw[%Cfg5\|\|~xd^eXN+Rm<-%OyA m%Xs&M#zm8,av46\cga8eIpaw8+D0e9SY]~m]N^w
2024-04-25 06:39:33 UTC	16384	IN	Data Raw: 00 b0 03 00 00 50 4b 03 04 14 00 08 08 08 00 c0 ba 95 4f 00 00 00 00 00 00 00 00 00 00 00 00 34 00 00 00 70 69 63 6f 63 6c 69 2f 43 6f 6d 6d 61 6e 64 4c 69 6e 65 24 42 75 69 6c 74 49 6e 24 43 68 61 72 61 63 74 65 72 43 6f 6e 76 65 72 74 65 72 2e 63 6c 61 73 73 95 54 5b 53 d3 50 10 fe 0e 0d 4d 1b 23 60 b9 2a 5e 22 20 a4 54 68 f0 ae 40 b9 44 d0 6a 95 07 18 66 78 0c 69 2c 61 d2 93 4e 92 32 fa 7f fc 01 f8 52 1c 99 d1 77 7f 94 e3 9e 52 4a a1 15 c6 87 64 f7 ec d9 dd 6f bf 3d 67 cf ef 3f 3f 7e 02 98 c3 7b 05 bd d0 15 a4 31 2d e3 a1 8c 59 05 12 f4 04 b2 42 1a 09 cc 09 f9 48 41 0c 8f 85 d3 13 05 4f f1 4c 41 0f 9e cb 78 21 e3 a5 8c 57 0c f1 05 97 bb 51 8e 21 a6 a7 b7 19 24 d3 2f 3a 0c bd 05 97 3b 1f ab e5 5d 27 d8 b2 76 3d b2 a4 0a be 6d 79 db 56 e0 8a 75 c3 28 45 Data Ascii: PKO4picocli/CommandLine$BuiltIn$CharacterConverter.classT[SPM#`*^" Th@Djfxi,aN2RwRJdo=g??~{1-YBHAOLAx!WQ!$/:;]'v=myVu(E
2024-04-25 06:39:33 UTC	16384	IN	Data Raw: 37 f2 ab 16 23 02 bd 8d 16 d7 ab 14 81 bd 8d 1c ea e4 4b 93 f5 75 ba 86 47 a5 d1 fa 2a c1 23 90 6c b4 b6 56 09 09 a4 1a 2d f7 92 48 4d 32 d4 6a a7 26 9b ec 21 aa 9a 7b d4 aa ad 66 55 78 c8 b0 f5 b9 54 e9 33 81 ee 86 db e0 12 6e 4d 97 a6 d7 bb b9 55 52 ef 2a 9f a5 d5 b5 35 1a b0 c9 a1 af 16 87 4d 68 54 a9 c6 26 27 a0 7e 3f 1b f2 a8 d6 99 4d 78 54 09 d0 26 2f 6a bd 32 6d 42 bc 56 b2 f2 42 6c 16 bf 4e cb 0a ec 6b 58 ac a7 c8 6d b2 af 35 ea 77 1d 65 d7 ca e2 1d 57 bf c4 79 5d 7b 4c 52 7f d6 a8 22 aa ff 39 d5 ce 68 54 52 ea b8 92 97 62 b1 bb c7 eb 9e df 5c 6b e3 d5 cf db 25 af f0 36 b8 cd 43 60 b8 c5 42 e9 f2 1c f4 8c db ee e1 2b 85 c4 c6 2a 29 4f 11 c0 bb ca 56 34 a3 50 e3 b2 1a 9b 9a 65 8b 87 70 92 32 d1 5c 25 1c c8 a9 33 45 62 f7 3a f9 92 86 4f c9 e5 aa 8b Data Ascii: 7#KuG#lV-HM2j&!{fUxT3nMUR5MhT&'~?MxT&/j2mBVBlNkXm5weWy]{LR"9hTRb\k%6C`B+*)OV4Pep2\%3Eb:O
2024-04-25 06:39:33 UTC	16384	IN	Data Raw: ad 4d 71 2e 37 b5 65 28 cb 99 93 81 6e f4 18 d8 8c 4b 0d 6c e2 61 0b 2e 33 d0 c5 50 1f b6 1b b8 0a 7f 12 98 37 85 09 a8 1d 4c 48 bb 21 9d 8e ee 61 91 19 e9 cf 3c fc c5 c0 1b 38 4d 62 ac df ab 93 1a 42 08 87 81 db 85 93 e9 df 6f e0 dd 42 a3 b3 bd eb a9 60 2e 32 84 4b b8 75 a1 1b c2 2b 7c 86 a8 11 86 21 66 88 99 86 98 c5 50 ad 98 4d 10 ee 35 f0 00 0f 29 d0 23 a3 f5 2d c4 1c 0b 33 a2 8b 3a 43 cc c1 c7 04 16 4f 6f 3f c6 e8 37 c4 5c e1 27 39 b1 cf 10 f5 24 b1 98 27 66 0a 2c ad aa 27 18 c8 22 67 e0 03 d8 cf c3 9d 4c 6f 80 06 31 df 10 01 71 8e 2e 82 86 58 20 1a 0c 71 2e dd 12 0b c9 dc 62 11 1e 64 eb 9c 67 88 c5 62 89 81 8f e2 63 06 ee 63 ae 8d a2 41 00 4c e1 b4 2e 96 1a 62 19 1e 32 f0 69 ba 2d 9a b0 d3 10 cd 34 e0 20 1e d2 45 c8 10 11 b1 9c 9c 3c 39 d3 8b 7e 52 Data Ascii: Mq.7e(nKla.3P7LH!a<8MbBoB`.2Ku+\|!fPM5)#-3:COo?7\'9$'f,'"gLo1q.X q.bdgbccAL.b2i-4 E<9~R
2024-04-25 06:39:33 UTC	16384	IN	Data Raw: 5c 0f e0 0d db 64 47 28 6c 97 9d a1 b0 83 7f 9c b2 3d 14 16 64 d1 56 1d 1a c0 8c 1c 6c b1 d7 7a bc 1e 59 7c d8 87 aa 21 0e e7 48 0e a7 c5 e1 f5 a4 59 0e 79 d8 8d 7f ff 4e 31 ba 89 b1 fb 1e 71 71 2b c2 fd 78 61 8b ec 26 ca 3b 98 d9 0f 39 28 c9 52 30 57 ce 7d 58 9b 67 ab cd f7 e6 7b f3 fa a0 c8 b9 de fc ea 60 c1 84 c2 0a d2 92 f2 49 d2 63 4b de 39 59 b0 d5 5c 04 99 55 4e 60 cd 92 5d b2 6b 00 b3 19 1e 60 ce 00 8a 73 f0 08 2f fe 4a 58 db 2c 3f 35 63 1a f9 e9 24 0a 95 53 28 53 4e a3 52 39 83 55 ca 59 34 2a e7 d0 ac 9c 47 58 b9 80 03 ca 45 1c 55 2e e1 0f 6a 07 94 cb f8 4b b9 82 27 ca 55 3c 55 ae b1 62 e5 2a 9b af 5c 66 7e a5 8f 2d 53 ae 5b fe bd 80 7c 1c a4 17 e0 4a ac 82 07 4f c9 b7 ab 51 8f 02 3c c1 5a bc 8a 06 ba 2a dd a7 87 5c 6a 95 fc 9a 8e 03 ea ad 21 0a Data Ascii: \dG(l=dVlzY\|!HYyN1qq+xa&;9(R0W}Xg{`IcK9Y\UN`]k`s/JX,?5c$S(SNR9UY4GXEU.jK'U<Ub\f~-S[\|JOQ<Z*\j!
2024-04-25 06:39:33 UTC	16384	IN	Data Raw: 8e 0d 95 1d e1 a0 83 5f c1 20 ab aa b3 ad 33 54 df bc 23 d0 1e 60 60 c7 af ee f6 0e 07 bf 92 81 ab 21 b0 37 d2 e0 6f 6a c3 fa ac fa ce 50 e4 c4 9e d5 a1 96 40 88 c1 34 fd ab 2b 12 ec ec a8 0c 05 23 3d 95 1d 2d 75 fe f6 40 65 5b d7 0e 7f 53 20 12 6c f6 b7 b5 f5 18 1d eb 77 e0 2b 10 8e 68 03 ac 3a 66 c7 ba 2c 0f 86 c2 11 a4 a3 c6 df d3 d9 8d 05 cf d2 c0 76 7f 77 5b 64 8d 3f e4 6f af c1 21 6d 6b 03 1d 48 44 00 19 ff 7d 06 c3 ab 07 36 30 18 6d 1e 14 88 04 42 f1 31 57 31 c8 ad 1e 50 8f 43 6a 83 1d c1 76 7f 9b 45 53 9e de a4 51 6f aa d7 b1 24 d6 3b f8 d5 0c 86 56 27 57 fe 80 81 7b 7d 30 1c 6c 0a b6 21 bb 18 8c 58 ba 6c 79 e5 ba 9a 86 ad 55 ab 6b 6b 2b eb 96 6e ad ab ac 5d 86 b4 d5 ec f4 ef f6 cf 6a f3 77 b4 ce aa 8f 84 82 1d ad 0b 90 39 55 9d 1d e1 88 bf 23 b2 Data Ascii: _ 3T#``!7ojP@4+#=-u@e[S lw+h:f,vw[d?o!mkHD}60mB1W1PCjvESQo$;V'W{}0l!XlyUkk+n]jw9U#
2024-04-25 06:39:33 UTC	16384	IN	Data Raw: 33 00 00 00 70 69 63 6f 63 6c 69 2f 43 6f 6d 6d 61 6e 64 4c 69 6e 65 24 49 48 65 6c 70 43 6f 6d 6d 61 6e 64 49 6e 69 74 69 61 6c 69 7a 61 62 6c 65 2e 63 6c 61 73 73 7d 50 4d 4b c3 40 14 9c 57 63 62 6b b5 d1 6a b1 82 b7 1e f4 a0 c1 73 2e 96 8a 18 28 28 16 7a df a6 8b bc b2 d9 94 64 eb c1 9f e6 c1 1f e0 8f 12 5f 54 a8 87 d8 85 b7 ef 63 98 61 98 8f cf b7 77 00 d7 e8 05 08 03 1c 12 3c b6 ec 02 74 65 ba d7 66 49 68 27 d6 ea 62 64 54 59 ea 32 c0 91 00 43 5b 32 41 9d 8f 97 9c e6 a9 e1 68 94 67 99 b2 f3 31 5b 1d d7 1d 07 95 d4 a0 a2 c5 e3 85 7a 51 11 e7 d1 63 c1 d6 4d 5c a1 55 56 7f bc 98 12 5a b7 7a 59 e8 54 39 3d 27 f4 9f 56 d6 71 a6 a7 5c f2 cc e8 a1 b5 b9 53 8e 73 5b 12 7a 3f 12 46 d9 e7 68 cd 89 45 61 92 af 8a 54 df b1 d1 84 f0 8f a7 ab 8a 10 e0 98 70 59 e7 Data Ascii: 3picocli/CommandLine$IHelpCommandInitializable.class}PMK@Wcbkjs.((zd_Tcaw<tefIh'bdTY2C[2Ahg1[zQcM\UVZzYT9='Vq\Ss[z?FhEaTpY
2024-04-25 06:39:33 UTC	16384	IN	Data Raw: ef 51 bb d9 50 88 20 b4 2b 18 3a 1a 80 de ce f4 4d be 4d e7 7e 88 58 4b 46 9b 1b 6a 74 14 86 14 75 f3 1e b0 cb 00 da 9c 29 b3 ca 67 97 cf c5 68 54 aa 6f 8c 2f db b5 9b e0 b1 c1 84 f4 9f b3 ea bd 0d f4 84 63 dc b8 bd c7 f2 37 b5 7b 5b b6 17 2e 68 61 bc 16 9d 45 e7 18 ec 8a ea 29 ee b6 d8 a4 44 ee 4f 12 39 3c cd f1 ed 5d 72 fc a5 0e a0 52 de ed 7e dc 02 ce fc 9f 79 08 69 be 9e 56 e8 ff a6 e2 64 77 23 0f f7 a0 6c af 92 1f 70 97 8c cc 79 c4 98 fe 64 8c 6e 2a 4d fd 6e 61 37 2f cc fa 85 e6 37 79 37 7c e2 9a b6 f3 a7 3d dc be 82 47 6a dd f8 ec 49 a7 cd f9 e0 d7 ca 30 bd 75 d3 af 7c ee dc f2 49 87 4d 99 7c dc 82 8a b9 87 1d e7 b0 2d ed 39 1e 4a 33 94 ab d2 1e 01 ed e9 96 1c 72 67 6a 91 03 bc 83 3e f2 9c 13 b1 67 fa 8c 74 8e bd f7 63 5e f2 33 32 72 c4 d6 f6 b9 9d Data Ascii: QP +:MM~XKFjtu)ghTo/c7{[.haE)DO9<]rR~yiVdw#lpydn*Mna7/7y7\|=GjI0u\|IM\|-9J3rgj>gtc^32r
2024-04-25 06:39:33 UTC	16384	IN	Data Raw: 2e 93 3c 92 8e 31 81 19 a7 bd 1b b8 19 08 99 0f 84 c4 b3 2d c8 6f 21 4b ef 20 85 de ff 43 f6 b3 8d 2c 1e 90 45 71 4b 50 71 92 0a 55 8d 0f ed 0b a4 4a 22 1a 3a 44 ec 00 b2 70 14 49 38 9d c2 51 c3 c2 89 47 be 92 17 a2 84 7a 45 6a a1 53 af 84 5b 88 eb 07 60 fb a7 8a 16 0a 54 a7 91 11 36 8b 4b a2 20 d4 fd 98 44 cf d2 c0 6f 50 4b 07 08 78 b7 48 d2 81 02 00 00 c4 04 00 00 50 4b 03 04 14 00 08 08 08 00 c0 ba 95 4f 00 00 00 00 00 00 00 00 00 00 00 00 34 00 00 00 70 69 63 6f 63 6c 69 2f 43 6f 6d 6d 61 6e 64 4c 69 6e 65 24 4d 61 78 56 61 6c 75 65 73 45 78 63 65 65 64 65 64 45 78 63 65 70 74 69 6f 6e 2e 63 6c 61 73 73 95 91 cd 4a c3 40 14 85 cf 6d 6b 83 b5 b5 b5 5a 7f ea 0f 0a 22 5a c5 ea ba e2 26 56 a8 44 11 aa 5d b8 1b d3 a1 8e 24 93 92 a4 e2 d6 47 71 e1 03 b8 28 Data Ascii: .<1-o!K C,EqKPqUJ":DpI8QGzEjS[`T6K DoPKxHPKO4picocli/CommandLine$MaxValuesExceededException.classJ@mkZ"Z&VD]$Gq(

Timestamp	Bytes transferred	Direction	Data
2024-04-25 06:39:36 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 06:39:37 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0790) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=174238 Date: Thu, 25 Apr 2024 06:39:37 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-04-25 06:39:37 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 06:39:37 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=174238 Date: Thu, 25 Apr 2024 06:39:37 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-25 06:39:37 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-04-25 06:39:47 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=65HSr++Fuo+LbRH&MD=bw4YOY8N HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-25 06:39:48 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 14c77071-8c59-4f87-88e2-5a2f6c347db3 MS-RequestId: a368f3ab-416b-4faf-bba2-c5be6611806f MS-CV: tfv8jbOpvEiYEAcp.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 25 Apr 2024 06:39:47 GMT Connection: close Content-Length: 24490
2024-04-25 06:39:48 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-25 06:39:48 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-04-25 06:40:25 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=65HSr++Fuo+LbRH&MD=bw4YOY8N HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-25 06:40:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 9dc68660-3696-4a67-a5f8-e5154f287b65 MS-RequestId: 27c984b0-2420-4123-9048-4eb57cb591db MS-CV: 4O4Nv1Cb4USiln32.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 25 Apr 2024 06:40:25 GMT Connection: close Content-Length: 25457
2024-04-25 06:40:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-25 06:40:25 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	08:39:27
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	08:39:30
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2208,i,13480584101053597956,9907863780671905047,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	08:39:32
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://repo.maven.apache.org/maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://repo.maven.apache.org/maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

C:\Users\user\AppData\Local\Temp\hsperfdata_user\6608

C:\Users\user\Downloads\Unconfirmed 382966.crdownload

C:\Users\user\Downloads\picocli-4.1.4.jar (copy)

C:\jar\META-INF\MANIFEST.MF

C:\jar\META-INF\versions\9\module-info.class

C:\jar\picocli\AutoComplete$1.class

C:\jar\picocli\AutoComplete$2.class

C:\jar\picocli\AutoComplete$App.class

C:\jar\picocli\AutoComplete$Bashify.class

C:\jar\picocli\AutoComplete$BooleanArgFilter.class

C:\jar\picocli\AutoComplete$CommandDescriptor.class

C:\jar\picocli\AutoComplete$Function.class

C:\jar\picocli\AutoComplete$GenerateCompletion.class

C:\jar\picocli\AutoComplete$NullFunction.class

C:\jar\picocli\AutoComplete$Predicate.class

C:\jar\picocli\AutoComplete.class

C:\jar\picocli\CommandLine$1.class

C:\jar\picocli\CommandLine$2.class

C:\jar\picocli\CommandLine$3.class

C:\jar\picocli\CommandLine$4.class

C:\jar\picocli\CommandLine$AbstractHandler.class

C:\jar\picocli\CommandLine$AbstractParseResultHandler.class

Windows Analysis Report
https://repo.maven.apache.org/maven2/info/picocli/picocli/4.1.4/picocli-4.1.4.jar

Target ID:	9
Start time:	08:40:50
Start date:	25/04/2024
Path:	C:\Windows\System32\7za.exe
Wow64 process (32bit):	true
Commandline:	7za.exe x -y -oC:\jar "C:\Users\user\Downloads\picocli-4.1.4.jar"
Imagebase:	0xb0000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	08:40:51
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
Wow64 process (32bit):	true
Commandline:	java.exe -jar "C:\Users\user\Downloads\picocli-4.1.4.jar" picocli.AutoComplete
Imagebase:	0x350000
File size:	257'664 bytes
MD5 hash:	9DAA53BAB2ECB33DC0D9CA51552701FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	08:40:52
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Imagebase:	0x460000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre