IOCReport

C:\Users\user\AppData\Roaming\lib\jna-5.5.0.jar

Java archive data (JAR)

dropped

C:\Users\user\AppData\Roaming\lib\jna-platform-5.5.0.jar

Java archive data (JAR)

dropped

C:\Users\user\AppData\Roaming\lib\sqlite-jdbc-3.14.2.1.jar

Zip archive data, at least v1.0 to extract

dropped

C:\Users\user\AppData\Roaming\lib\system-hook-3.5.jar

Zip archive data, at least v1.0 to extract

dropped

C:\Users\user\fukvowbkrs.js

ASCII text, with very long lines

dropped

C:\Users\user\lib\jna-5.5.0.jard

Java archive data (JAR)

dropped

C:\Users\user\lib\jna-platform-5.5.0.jard

Java archive data (JAR)

dropped

C:\Users\user\lib\sqlite-jdbc-3.14.2.1.jard

Zip archive data, at least v1.0 to extract

dropped

C:\Users\user\lib\system-hook-3.5.jard

Zip archive data, at least v1.0 to extract

dropped

C:\Users\user\vmlpusjwhz.txt

Zip archive data, at least v2.0 to extract

dropped

C:\jar\META-INF\MANIFEST.MF

ASCII text, with CRLF line terminators

dropped

C:\jar\keuqzwqbvn\Mlncjyhbeex.class

compiled Java class data, version 50.0 (Java 1.6)

dropped

C:\jar\keuqzwqbvn\Mmwwrnygnfl.class

compiled Java class data, version 50.0 (Java 1.6)

dropped

C:\jar\keuqzwqbvn\resources\umxybpjabc

ASCII text, with very long lines

dropped

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\pruoglcim.txt

Zip archive data, at least v2.0 to extract

dropped

C:\Users\user\AppData\Local\Temp\jna-99048687\jna3285767908382047760.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\jna-99048687\jna552460949331173543.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\jna-99048687\jna822539700341149381.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pruoglcim.txt

Zip archive data, at least v2.0 to extract

dropped

C:\Users\user\pruoglcim.txt

Zip archive data, at least v2.0 to extract

dropped

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar'

C:\Windows\System32\7za.exe

7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar'

C:\Windows\System32\cmd.exe

'C:\Windows\System32\cmd.exe' /c java.exe -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar' keuqzwqbvn.Mmwwrnygnfl >> C:\cmdlinestart.log 2>&1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\icacls.exe

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\cmd.exe

cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\notepad.exe

C:\Windows\system32\NOTEPAD.EXE C:\Users\user\AppData\Roaming\vmlpusjwhz.txt

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\notepad.exe

'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\vmlpusjwhz.txt

C:\Windows\System32\notepad.exe

'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\vmlpusjwhz.txt

C:\Windows\System32\notepad.exe

'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\vmlpusjwhz.txt

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ''C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -javaagent:'C:\Users\user\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar'' >> C:\cmdlinestart.log 2>&1

C:\Windows\SysWOW64\cmd.exe

cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\pruoglcim.txt'

C:\Windows\System32\notepad.exe

C:\Windows\system32\NOTEPAD.EXE C:\Users\user\AppData\Roaming\pruoglcim.txt

C:\Windows\System32\notepad.exe

'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\pruoglcim.txt

C:\Windows\System32\notepad.exe

'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\pruoglcim.txt

C:\Windows\System32\notepad.exe

'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\pruoglcim.txt

C:\Windows\System32\notepad.exe

'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pruoglcim.txt