ID: Sample Name: OVERDUE_INVOICES qrypted.jar Cookbook: defaultwindowsfilecookbook.jbs Time: 11:58:04 Date: 14/05/2018 Version: 22.0.

Transcription

1 ID: Sample Name: OVERDUE_INVOICES qrypted.jar Cookbook: defaultwindowsfilecookbook.jbs Time: 11:58:04 Date: 14/05/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Software Vulnerabilities: Networking: Remote Access Functionality: Persistence and Installation Behavior: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Lowering of HIPS / PFW / Operating System Security Settings: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Network Behavior Code Manipulations Statistics Behavior Copyright Joe Security LLC 2018 Page 2 of 443

3 System Behavior Analysis cmd.exe PID: 3412 Parent PID: 3016 General File Activities Analysis 7za.exe PID: 3420 Parent PID: 3412 General File Activities File Created File Written File Read Analysis cmd.exe PID: 3452 Parent PID: 3016 General File Activities File Created Analysis java.exe PID: 3480 Parent PID: 3452 General File Activities File Created File Deleted File Written File Read Analysis java.exe PID: 3536 Parent PID: 3480 General File Activities File Created File Deleted File Written File Read Analysis cmd.exe PID: 3592 Parent PID: 3480 General File Activities Analysis cmd.exe PID: 3648 Parent PID: 3536 General Analysis cscript.exe PID: 3668 Parent PID: 3592 General File Activities File Written Analysis cscript.exe PID: 3688 Parent PID: 3648 General File Activities File Written Analysis cmd.exe PID: 3776 Parent PID: 3536 General Analysis cmd.exe PID: 3784 Parent PID: 3480 General Analysis cscript.exe PID: 3812 Parent PID: 3784 General File Activities File Written Analysis cscript.exe PID: 3824 Parent PID: 3776 General File Activities File Written Analysis xcopy.exe PID: 3904 Parent PID: 3536 General File Activities Analysis xcopy.exe PID: 3912 Parent PID: 3480 General File Activities Analysis cmd.exe PID: 3948 Parent PID: 3536 General File Activities File Written File Read Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 443

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 11:58:04 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 9m 12s light OVERDUE_INVOICES qrypted.jar defaultwindowsfilecookbook.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Run name: Number of analysed new started processes analysed: 26 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: without instrumentation HCA enabled EGA enabled HDC enabled Timeout MAL mal64.evad.expl.winjar@30/1237@0/1 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.jar Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtQueryDirectoryFile calls found. Report size getting too big, too many NtQueryVolumeInformationFile calls found. Report size getting too big, too many NtReadFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Report size getting too big, too many NtWriteFile calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: java.exe, java.exe Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 4 of 443

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of 443

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox Signature Overview Vulnerabilities Software Networking Access Functionality Remote and Installation Behavior Persistence Summary System / PFW / Operating System Protection Evasion HIPS Debugging Anti Analysis System Evasion Malware Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2018 Page 6 of 443

7 Lowering of HIPS / PFW / Operating System Security Settings Language, Device and Operating System Detection Click to jump to signature section Software Vulnerabilities: Exploit detected, runtime environment starts unknown processes Networking: Found strings which match to known social media urls Urls found in memory or binary Remote Access Functionality: ADWIND Rat detected Persistence and Installation Behavior: Drops files with a non-matching file extension (content does not match file extension) Drops PE files May use bcdedit to modify the Windows boot settings Creates license or readme file System Summary: Dropped file seen in connection with other malware Creates files inside the system directory Classification label Creates files inside the user directory Creates temporary files Executable is probably coded in java Executes visual basic scripts Reads software policies SQL strings found in memory and binary Spawns processes Uses an in-process (OLE) Automation server Submission file is bigger than most known malware samples Uses new MSVCR Dlls Binary contains paths to debug symbols HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Copyright Joe Security LLC 2018 Page 7 of 443

8 C:\Users\user\AppData\Roaming\...\javacpl.cpl, PE32 dropped C:\Users\user\AppData\Roaming\...\dcpr.dll, PE32 dropped C:\Users\user\AppData\Roaming\...\jvm.dll, PE32 dropped xcopy.exe 213 dropped 87 other files (5 malicious) unknown unknown Drops files with a non-matching file extension (content does not match file extension) started cmd.exe cscript.exe started java.exe started 16 cmd.exe cscript.exe ADWIND Rat detected started started started Exploit detected, runtime environment starts unknown processes cmd.exe ADWIND Rat detected cmd.exe cscript.exe started ID: Sample: Startdate: 14/05/2018 Architecture: Score: 64 Dropped file seen in connection with other malware started java.exe 13 started OVERDUE_INVOICES qrypted.jar WINDOWS cmd.exe started cscript.exe Tries to detect sandboxes and other dynamic analysis tools (process name or module) started started started cmd.exe xcopy.exe started 1 started C:\jar\com\...\TwiggenOverregulated, COM cmd.exe dropped started 7za.exe 501 dropped C:\jar\com\censual\...behaviorgraphentriceKami, DOS dropped dropped C:\jar\com\censual\...\StridulateBotryoidally, DOS 8 other files (none is malicious) Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Creates guard pages, often used to prevent reverse engineering and debugging Malware Analysis System Evasion: Tries to detect sandboxes and other dynamic analysis tools (process name or module) Found dropped PE file which has not been started or loaded May sleep (evasive loops) to hinder dynamic analysis May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Lowering of HIPS / PFW / Operating System Security Settings: AV process strings found (often used to terminate AV products) Checks if Antivirus/Antispyware/Firewall program is installed (via WMI) Language, Device and Operating System Detection: Queries the cryptographic machine GUID Behavior Graph Hide Legend Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious Copyright Joe Security LLC 2018 Page 8 of 443

9 Simulations Behavior and APIs Time Type Description 11:59:09 API Interceptor 2x Sleep call for process: java.exe modified 11:59:21 API Interceptor 8x Sleep call for process: cscript.exe modified Antivirus Detection Initial Sample No Antivirus matches Dropped Files Source Detection Scanner Label Link C:\Users\user\AppData\Roaming\Oracle\bin\JAWTAccessBridge.dll 0% virustotal Browse C:\Users\user\AppData\Roaming\Oracle\bin\JAWTAccessBridge.dll 0% metadefender Browse C:\Users\user\AppData\Roaming\Oracle\bin\JavaAccessBridge.dll 0% virustotal Browse C:\Users\user\AppData\Roaming\Oracle\bin\JavaAccessBridge.dll 0% metadefender Browse C:\Users\user\AppData\Roaming\Oracle\bin\WindowsAccessBridge.dll 0% virustotal Browse C:\Users\user\AppData\Roaming\Oracle\bin\WindowsAccessBridge.dll 0% metadefender Browse C:\Users\user\AppData\Roaming\Oracle\bin\awt.dll 0% virustotal Browse C:\Users\user\AppData\Roaming\Oracle\bin\bci.dll 0% virustotal Browse C:\Users\user\AppData\Roaming\Oracle\bin\bci.dll 0% metadefender Browse C:\Users\user\AppData\Roaming\Oracle\bin\client\jvm.dll 0% virustotal Browse C:\Users\user\AppData\Roaming\Oracle\bin\client\jvm.dll 0% metadefender Browse C:\Users\user\AppData\Roaming\Oracle\bin\dcpr.dll 0% virustotal Browse Unpacked PE Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs Copyright Joe Security LLC 2018 Page 9 of 443

10 No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files Match C:\Users\user\AppData\Roaming\Oracle\bin\Windo wsaccessbridge.dll Associated Sample Name / URL SHA 256 Detection Link Context Ship_DocsX XXBLX384_pdf_.jar Tax Invoice.jar jar Product Specification PO.doc nc.com/images/bbbbbb bb/invoice jar Proforma jar sjfcplkzk.jar jar cenovnik.jar vav2duep9c.jar zbqfs1n7s.jar bad.jar wowik07mv.jar jar tiwit.jar 71DXX.exeQSQ.exe a6f75b5b4f7a49657b6cafffbde06 malicious cf84a39cc246f d6307ee c35229e b fe44d0814bc malicious 5af4ab014002b0e4bf903ae c5966e08 b21c6a312f46085d591c9b1b880 malicious e26f4a4f416738c929646d81d900 a829195d7 f70ab7562e2279c68ba4f8d7a897 malicious ccf6216ed1c8e69da10a650ba8c 7edece2ed malicious 09a69d56590a140ecde8e1cceed malicious ff6141afa67c225e5640e da73cd3c9 c3abf2c78674aae73b3f6ebf6d83 malicious 94fbd3ac06c053dab8dde3d9322 d c malicious c6eb0e72a0c malicious 8d9b894b0251bf858231a0a107e 3cc29aeede 754e38b e66510a68846 malicious a6cb52a a110a5b356a9a 8fb659ce1e b30fe3ba0d2472b4f89714ce0c69 malicious 90576dafe6a0aff78d1da8c f5d1b5 dac5b25ed447e764d536bd1a154 malicious 3c bfda1a6ca66f207f15e a b 5a48320c3e3dd5976aaf59ff2dfe7 malicious eb431590c fb62d71f89a4 0fb3e03 16d23e425ced47509cae61d92c9 1dc1f295928ab79accbcae6dbb2 c80bac45db malicious c1eff22424b6768bafb98930f144b malicious cf2be2dfb7cf654cff c9f 01f89a19d84d39e8d1e9540ffdd8 malicious 85f9b077c9ab d7d6 dd1f467e2 Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Copyright Joe Security LLC 2018 Page 10 of 443

11 Match C:\Users\user\AppData\Roaming\Oracle\bin\JavaA ccessbridge.dll C:\Users\user\AppData\Roaming\Oracle\bin\JAWT AccessBridge.dll Associated Sample Name / URL SHA 256 Detection Link Context Swift copy _ pdf.jar CONT_WX_BAS.jar FULL ORIGINAL DOCUMENTS 2FC1.jar FnRoEYlPgUU.Ptfypi Ship_DocsX XXBLX384_pdf_.jar Tax Invoice.jar jar Product Specification PO.doc nc.com/images/bbbbbb bb/invoice jar Proforma jar sjfcplkzk.jar jar cenovnik.jar vav2duep9c.jar zbqfs1n7s.jar bad.jar wowik07mv.jar jar tiwit.jar 49Order List.exe 71DXX.exeQSQ.exe Swift copy _ pdf.jar CONT_WX_BAS.jar FULL ORIGINAL DOCUMENTS 2FC1.jar Ship_DocsX XXBLX384_pdf_.jar Tax Invoice.jar e27ac656a0ca2cef5f55b91cfadd malicious ae093353eed4d91750a705c bfbb47 5fe771916df7152c4d1a9d04d325 malicious fd3e69f6daa1e381f89d62565b10 80be3563 ae745fea5d6f51bd4ab5a913fe4fa malicious 08933bd78e9d04b5f2ce1e65cfe1 b7f9c5c d20233fa82e1b3b3c33e7069a1b malicious a2ca92631c52ece8393bf51f0d62 224f62b1d a6f75b5b4f7a49657b6cafffbde06 malicious cf84a39cc246f d6307ee c35229e b fe44d0814bc malicious 5af4ab014002b0e4bf903ae c5966e08 b21c6a312f46085d591c9b1b880 malicious e26f4a4f416738c929646d81d900 a829195d7 f70ab7562e2279c68ba4f8d7a897 malicious ccf6216ed1c8e69da10a650ba8c 7edece2ed malicious 09a69d56590a140ecde8e1cceed malicious ff6141afa67c225e5640e da73cd3c9 c3abf2c78674aae73b3f6ebf6d83 malicious 94fbd3ac06c053dab8dde3d9322 d c malicious c6eb0e72a0c malicious 8d9b894b0251bf858231a0a107e 3cc29aeede 754e38b e66510a68846 malicious a6cb52a a110a5b356a9a 8fb659ce1e b30fe3ba0d2472b4f89714ce0c69 malicious 90576dafe6a0aff78d1da8c f5d1b5 dac5b25ed447e764d536bd1a154 malicious 3c bfda1a6ca66f207f15e a b 5a48320c3e3dd5976aaf59ff2dfe7 malicious eb431590c fb62d71f89a4 0fb3e03 16d23e425ced47509cae61d92c9 1dc1f295928ab79accbcae6dbb2 c80bac45db malicious c1eff22424b6768bafb98930f144b malicious cf2be2dfb7cf654cff c9f aef4d a040da1a8e6c4 malicious 3a67eac3d627236feec8ebe3aafa de6d0c6c0 01f89a19d84d39e8d1e9540ffdd8 malicious 85f9b077c9ab d7d6 dd1f467e2 e27ac656a0ca2cef5f55b91cfadd malicious ae093353eed4d91750a705c bfbb47 5fe771916df7152c4d1a9d04d325 malicious fd3e69f6daa1e381f89d62565b10 80be3563 ae745fea5d6f51bd4ab5a913fe4fa malicious 08933bd78e9d04b5f2ce1e65cfe1 b7f9c5c a6f75b5b4f7a49657b6cafffbde06 malicious cf84a39cc246f d6307ee c35229e b fe44d0814bc malicious 5af4ab014002b0e4bf903ae c5966e08 Copyright Joe Security LLC 2018 Page 11 of 443 Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse

12 Match Associated Sample Name / URL SHA 256 Detection Link Context b21c6a312f46085d591c9b1b880 malicious.jar e26f4a4f416738c929646d81d900 a829195d7 Product Specification PO.doc nc.com/images/bbbbbb bb/invoice jar Proforma jar sjfcplkzk.jar jar cenovnik.jar vav2duep9c.jar zbqfs1n7s.jar bad.jar wowik07mv.jar jar tiwit.jar 49Order List.exe 71DXX.exeQSQ.exe Swift copy _ pdf.jar CONT_WX_BAS.jar FULL ORIGINAL DOCUMENTS 2FC1.jar f70ab7562e2279c68ba4f8d7a897 malicious ccf6216ed1c8e69da10a650ba8c 7edece2ed malicious 09a69d56590a140ecde8e1cceed malicious ff6141afa67c225e5640e da73cd3c9 c3abf2c78674aae73b3f6ebf6d83 malicious 94fbd3ac06c053dab8dde3d9322 d c malicious c6eb0e72a0c malicious 8d9b894b0251bf858231a0a107e 3cc29aeede 754e38b e66510a68846 malicious a6cb52a a110a5b356a9a 8fb659ce1e b30fe3ba0d2472b4f89714ce0c69 malicious 90576dafe6a0aff78d1da8c f5d1b5 dac5b25ed447e764d536bd1a154 malicious 3c bfda1a6ca66f207f15e a b 5a48320c3e3dd5976aaf59ff2dfe7 malicious eb431590c fb62d71f89a4 0fb3e03 16d23e425ced47509cae61d92c9 1dc1f295928ab79accbcae6dbb2 c80bac45db malicious c1eff22424b6768bafb98930f144b malicious cf2be2dfb7cf654cff c9f aef4d a040da1a8e6c4 malicious 3a67eac3d627236feec8ebe3aafa de6d0c6c0 01f89a19d84d39e8d1e9540ffdd8 malicious 85f9b077c9ab d7d6 dd1f467e2 e27ac656a0ca2cef5f55b91cfadd malicious ae093353eed4d91750a705c bfbb47 5fe771916df7152c4d1a9d04d325 malicious fd3e69f6daa1e381f89d62565b10 80be3563 ae745fea5d6f51bd4ab5a913fe4fa malicious 08933bd78e9d04b5f2ce1e65cfe1 b7f9c5c Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Browse Screenshots Copyright Joe Security LLC 2018 Page 12 of 443

13 Startup Copyright Joe Security LLC 2018 Page 13 of 443

14 System is w7 cmd.exe (PID: 3412 cmdline: C:\Windows\system32\cmd.exe /c 7za.exe x -y -oc:\jar 'C:\Users\user\Desktop\OVERDUE_INVOICES qrypted.jar' AD7B9C14083B52BC532FBA B98) 7za.exe (PID: 3420 cmdline: 7za.exe x -y -oc:\jar 'C:\Users\user\Desktop\OVERDUE_INVOICES qrypted.jar' 42BADC1D2F03A8B1E D3D49336) cmd.exe (PID: 3452 cmdline: 'C:\Windows\System32\cmd.exe' /c java.exe -jar 'C:\Users\user\Desktop\OVERDUE_INVOICES qrypted.jar' com.angelican.breadthl ess.botticelli.unaffixed.succindurni >> C:\cmdlinestart.log 2>&1 AD7B9C14083B52BC532FBA B98) java.exe (PID: 3480 cmdline: java.exe -jar 'C:\Users\user\Desktop\OVERDUE_INVOICES qrypted.jar' com.angelican.breadthless.botticelli.unaffixed.succindurni cleanup 02E26F23B FB5E33DB36BF08C) java.exe (PID: 3536 cmdline: 'C:\Program Files\Java\jre1.8.0_144\bin\java.exe' -jar C:\Users\HERBBL~1\AppData\Local\Temp\_ class 02E26F23B FB5E33DB36BF08C) cmd.exe (PID: 3648 cmdline: cmd.exe /C cscript.exe C:\Users\HERBBL~1\AppData\Local\Temp\Retrive vbs AD7B9C14083B52BC532FBA B98) cscript.exe (PID: 3688 cmdline: cscript.exe C:\Users\HERBBL~1\AppData\Local\Temp\Retrive vbs A3A35EE79C64A640152B3113E6E254E2) cmd.exe (PID: 3776 cmdline: cmd.exe /C cscript.exe C:\Users\HERBBL~1\AppData\Local\Temp\Retrive vbs AD7B9C14083B52BC532FBA B98) cscript.exe (PID: 3824 cmdline: cscript.exe C:\Users\HERBBL~1\AppData\Local\Temp\Retrive vbs A3A35EE79C64A640152B3113E6E254E2) xcopy.exe (PID: 3904 cmdline: xcopy 'C:\Program Files\Java\jre1.8.0_144' 'C:\Users\user\AppData\Roaming\Oracle\' /e 361D ED11A6F1E51BBB4277E) cmd.exe (PID: 3948 cmdline: cmd.exe AD7B9C14083B52BC532FBA B98) cmd.exe (PID: 3592 cmdline: cmd.exe /C cscript.exe C:\Users\HERBBL~1\AppData\Local\Temp\Retrive vbs AD7B9C14083B52BC532FBA B98) cscript.exe (PID: 3668 cmdline: cscript.exe C:\Users\HERBBL~1\AppData\Local\Temp\Retrive vbs A3A35EE79C64A640152B3113E6E254E2) cmd.exe (PID: 3784 cmdline: cmd.exe /C cscript.exe C:\Users\HERBBL~1\AppData\Local\Temp\Retrive vbs AD7B9C14083B52BC532FBA B98) cscript.exe (PID: 3812 cmdline: cscript.exe C:\Users\HERBBL~1\AppData\Local\Temp\Retrive vbs A3A35EE79C64A640152B3113E6E254E2) xcopy.exe (PID: 3912 cmdline: xcopy 'C:\Program Files\Java\jre1.8.0_144' 'C:\Users\user\AppData\Roaming\Oracle\' /e 361D ED11A6F1E51BBB4277E) Created / dropped Files C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c7c46.timestamp Size (bytes): 51 C:\Program Files\Java\jre1.8.0_144\bin\java.exe ASCII text, with CRLF line terminators Entropy (8bit): Reputation: 6A9271BFCC1239DBB2DAFAD0DFECF291 E5D AFD61E9111D580AB0599D AA6FCD53F3FDCEB2C5D0E770832FEA991418F825BFC1C8CE624AF56FE E CB3F556C04EF64BD0F4132E56A842AA49E29D0D E A698AEE73047DB9364DB3D41 FAE76348C99CF25AB31608FD43AA5C3B8DCFC low C:\Users\HERBBL~1\AppData\Local\Temp\Retrive vbs Size (bytes): 276 C:\Program Files\Java\jre1.8.0_144\bin\java.exe ASCII text, with CRLF line terminators Entropy (8bit): Reputation: 3BDFD B85949B6FAA7D4B98E4 F92844FEE69EF98DB6E68931ADFAA9A0A0F8CE66 9DA575DD2D5B7C1E9BAB8B51A16CDE457B3371C6DCDB CF1497FA868F6 AE5E5686AE71EDEF53E71CD842CB6799E4383B9C238A5C361B81647EFA128D2FEDF3BF B5B0C47A058 FECAE7829AEEDCD098C80A E moderate, very likely benign file C:\Users\HERBBL~1\AppData\Local\Temp\Retrive vbs C:\ProgramData\Oracle\Java\javapath_target_827509\java.exe ASCII text, with CRLF line terminators Size (bytes): 276 Entropy (8bit): BDFD B85949B6FAA7D4B98E4 F92844FEE69EF98DB6E68931ADFAA9A0A0F8CE66 Copyright Joe Security LLC 2018 Page 14 of 443

15 C:\Users\HERBBL~1\AppData\Local\Temp\Retrive vbs Reputation: 9DA575DD2D5B7C1E9BAB8B51A16CDE457B3371C6DCDB CF1497FA868F6 AE5E5686AE71EDEF53E71CD842CB6799E4383B9C238A5C361B81647EFA128D2FEDF3BF B5B0C47A058 FECAE7829AEEDCD098C80A E moderate, very likely benign file C:\Users\HERBBL~1\AppData\Local\Temp\Retrive vbs Size (bytes): 281 C:\Program Files\Java\jre1.8.0_144\bin\java.exe ASCII text, with CRLF line terminators Entropy (8bit): Reputation: A32C109297ED1CA155598CD295C26611 DC4A1FDBAAD15DDD6FE22D3907C6B03727B BFE34AA3EF932F EB53D032F5E7CF6D1F5B4E A255F32E DC86FE02ECE9FE3B F80BE07A34126B2C75B41E30078CDA9E90744C7D644DF623F63D4FB E345B3351C4D3DA C67FC6ECC887 moderate, very likely benign file C:\Users\HERBBL~1\AppData\Local\Temp\Retrive vbs Size (bytes): 281 C:\ProgramData\Oracle\Java\javapath_target_827509\java.exe ASCII text, with CRLF line terminators Entropy (8bit): Reputation: A32C109297ED1CA155598CD295C26611 DC4A1FDBAAD15DDD6FE22D3907C6B03727B BFE34AA3EF932F EB53D032F5E7CF6D1F5B4E A255F32E DC86FE02ECE9FE3B F80BE07A34126B2C75B41E30078CDA9E90744C7D644DF623F63D4FB E345B3351C4D3DA C67FC6ECC887 moderate, very likely benign file C:\Users\HERBBL~1\AppData\Local\Temp\_ class Size (bytes): C:\ProgramData\Oracle\Java\javapath_target_827509\java.exe Java Jar file (zip) Entropy (8bit): Reputation: 781FB531354D6F291F1CCAB48DA6D39F 9CE4518EBCB5BE6D1F0B5477FA00C26860FE9A68 97D585B6AFF62FB4E43E7E6A5F816DCD7A14BE11A88B109A9BA9E8CD4C456EB9 3E6630F5FEB4A3EB1DAC7E9125CE14B1A2A45D7415CF44CEA42BC51B2A9AA37169EE4A4C36C888C8F2696E7D6 E298E2AD7B2F4C22868AAA EB7DB220D8 moderate, very likely benign file C:\Users\user\AppData\Roaming\Oracle\COPYRIGHT Size (bytes): 3244 C:\Windows\System32\xcopy.exe ISO-8859 text Entropy (8bit): Reputation: 3DC1BFBD5BED75D650AD0506A0DF5930 8E B9BC4B6AAD357B8BFAAB6A518FB82E 621F7616B5E8538ABBC26667F28C25650A5B239A4F1ECA981F5DD60B8DA9B589 74F077BC149AA459E480B5EE CF67CD17D290E90F0A6045F687C42DD4E9F12133CE2459EAF905BD053E5E BA587C042040C84DA9CD2A26E415FC388B148 moderate, very likely benign file C:\Users\user\AppData\Roaming\Oracle\LICENSE C:\Windows\System32\xcopy.exe ASCII text Size (bytes): 40 Copyright Joe Security LLC 2018 Page 15 of 443

16 C:\Users\user\AppData\Roaming\Oracle\LICENSE Entropy (8bit): F46AB6481D87C4D77E0E91A6DBC15F 3E86865DEEC0814C958BCF7FB87F790BCCC0E8BD 23F9A5C12FA A32872B7360B9E030C FB27DD A5828C AC2C14C56EEA2024FCF7E871D25BCC323A40A2D1D95059C67EC231BCD710ACB8B798A8C107AAD60AAA3F14A64 AA AB86A481141D9A185E22CE049A91B7 C:\Users\user\AppData\Roaming\Oracle\README.txt Size (bytes): 46 C:\Windows\System32\xcopy.exe ASCII text Entropy (8bit): F B959AC5E8B89EB8C245C4BD F90331DF1E5BADEADC501D8DD70714C62A CF8DB76FB8071FD19A A42F2AB42B27A3ADFD9EC58981C3E88D2 E9136FDF42A DF0B4BA363655D97F A3B3A40DDB40EEFF D A500CB9C 9AAF887B73EEAD A0C0A693 C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME-JAVAFX.txt Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): UTF-8 Unicode (with BOM) text, with very long lines 4F31CD1A5D86744D5F00666D9A57AD2A 17D0B343CFB2E54BBEC7AF17F247A8BCB72D946B 7F841E514BA8D2F30D90C63C8CD93AC516428C9326D571F9F3EFBAE8BD72BA96 D DFA3B22B4B510A98DE091B30D2ACB1DC32784C A048C5EB862EDD376C2B4FC879E49D72634 EEF6863AA7F24C9A7E7CEF9FD7A F1 C:\Users\user\AppData\Roaming\Oracle\THIRDPARTYLICENSEREADME.txt Size (bytes): C:\Windows\System32\xcopy.exe UTF-8 Unicode text Entropy (8bit): CD63A2745CDFC4E6EB7B40A16AFC F98566F2BA5523B3CFF BB59252F9 DC3982C5EE4CB1AEFDA63468C19D8AA60C80CD9FEC7E F78AB29BC9FB F99D2A6AD507CE4DF7DF183D5EAC82861FB79555EEC0EB6207C E2618C56636E7385D63A890B41 CFA590C38908BE7D5DA8FB1550DFF0CFBF093 C:\Users\user\AppData\Roaming\Oracle\Welcome.html Size (bytes): 955 C:\Windows\System32\xcopy.exe HTML document, ASCII text Entropy (8bit): A329F25E9CC132C673CD134E8134B0D 634D69FDD1E9B824A1E92DA00FDB6201A6D302AC 6F3F130AA22B3CBEAD959E5CF0F7F626B96539EECA56BED60768E91A C CAB0D1CD1F351D977F82953C1AB1BC99DAFE543D81DB702A1F30527DD7E33BD99219CDC21D C C39E AC185F82DAA3F526A4 C:\Users\user\AppData\Roaming\Oracle\bin\JAWTAccessBridge.dll C:\Windows\System32\xcopy.exe PE32 executable (DLL) (GUI) Intel 80386, for MS Windows Size (bytes): Entropy (8bit): Copyright Joe Security LLC 2018 Page 16 of 443

17 C:\Users\user\AppData\Roaming\Oracle\bin\JAWTAccessBridge.dll Antivirus: Joe Sandbox View: 5AC1ACB7FA3D3CF55C1E460D9BE8AB47 BB669135FAA8ADF24AA8ECBCAF5BA84A0DE5A9BF EA9D437D0828D399B7FA57BD25F18FC42A0423E35DB0314DB3DC2DF497C9F219 EA37D04B0CDE218123D4275B4A1D7B4010EA00A85D598EBD87ED E13192CED C 76A67A8FE3A630A3F1D198EE32D2BDEE83E E true Antivirus: virustotal, Detection: 0%, Browse Antivirus: metadefender, Detection: 0%, Browse Filename: Ship_DocsXXXBLX384_pdf_.jar, Detection: malicious, Browse Filename: Tax Invoice.jar, Detection: malicious, Browse Filename: jar, Detection: malicious, Browse Filename: Product Specification PO.doc, Detection: malicious, Browse Filename:, Detection: malicious, Browse Filename: Proforma jar, Detection: malicious, Browse Filename: sjfcplkzk.jar, Detection: malicious, Browse Filename:, Detection: malicious, Browse Filename: cenovnik.jar, Detection: malicious, Browse Filename: vav2duep9c.jar, Detection: malicious, Browse Filename: zbqfs1n7s.jar, Detection: malicious, Browse Filename: bad.jar, Detection: malicious, Browse Filename: wowik07mv.jar, Detection: malicious, Browse Filename: jar, Detection: malicious, Browse Filename: tiwit.jar, Detection: malicious, Browse Filename: 49Order List.exe, Detection: malicious, Browse Filename: 71DXX.exeQSQ.exe, Detection: malicious, Browse Filename: Swift copy _pdf.jar, Detection: malicious, Browse Filename: CONT_WX_BAS.jar, Detection: malicious, Browse Filename: FULL ORIGINAL DOCUMENTS 2FC1.jar, Detection: malicious, Browse C:\Users\user\AppData\Roaming\Oracle\bin\JavaAccessBridge.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): Antivirus: Joe Sandbox View: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows EE E3C57E6A6AF2AEFC ECDD16C309B3C5EF4CE87175D86A EF0FA1AADCD0BF072A90D28990FB31DD29D70FF8FDA31A7974DE1FB A03D9E C5CE8EBB1D02B7B01F4587A21EE6512FDC282A80A7E E9FAA2FB253DECD 3556D8614D25492AE7FE238475DD36DC FF8A794E79 true Antivirus: virustotal, Detection: 0%, Browse Antivirus: metadefender, Detection: 0%, Browse Filename: Ship_DocsXXXBLX384_pdf_.jar, Detection: malicious, Browse Filename: Tax Invoice.jar, Detection: malicious, Browse Filename: jar, Detection: malicious, Browse Filename: Product Specification PO.doc, Detection: malicious, Browse Filename:, Detection: malicious, Browse Filename: Proforma jar, Detection: malicious, Browse Filename: sjfcplkzk.jar, Detection: malicious, Browse Filename:, Detection: malicious, Browse Filename: cenovnik.jar, Detection: malicious, Browse Filename: vav2duep9c.jar, Detection: malicious, Browse Filename: zbqfs1n7s.jar, Detection: malicious, Browse Filename: bad.jar, Detection: malicious, Browse Filename: wowik07mv.jar, Detection: malicious, Browse Filename: jar, Detection: malicious, Browse Filename: tiwit.jar, Detection: malicious, Browse Filename: 49Order List.exe, Detection: malicious, Browse Filename: 71DXX.exeQSQ.exe, Detection: malicious, Browse Filename: Swift copy _pdf.jar, Detection: malicious, Browse Filename: CONT_WX_BAS.jar, Detection: malicious, Browse Filename: FULL ORIGINAL DOCUMENTS 2FC1.jar, Detection: malicious, Browse C:\Users\user\AppData\Roaming\Oracle\bin\WindowsAccessBridge.dll C:\Windows\System32\xcopy.exe PE32 executable (DLL) (GUI) Intel 80386, for MS Windows Size (bytes): Entropy (8bit): B47DE013C131DEABC5A5CE73876E C0F0AE34A594AE4903E4DA2889BCB30CDCA60DA9 B2C96DF9961DCCE06BB40185ADE8DA3CC5FBD839DCE92EB0B38CD0D21ABE2D9B Copyright Joe Security LLC 2018 Page 17 of 443

18 C:\Users\user\AppData\Roaming\Oracle\bin\WindowsAccessBridge.dll Antivirus: Joe Sandbox View: C DD66A2319A59E FFAF9D3D385B0B2F3A89575C06ED40C21A4B426579BEB3A88 BC9C962EC4D0A63182DD16DED6E4EC8A8F2CFC0EB4D6AB2 true Antivirus: virustotal, Detection: 0%, Browse Antivirus: metadefender, Detection: 0%, Browse Filename: Ship_DocsXXXBLX384_pdf_.jar, Detection: malicious, Browse Filename: Tax Invoice.jar, Detection: malicious, Browse Filename: jar, Detection: malicious, Browse Filename: Product Specification PO.doc, Detection: malicious, Browse Filename:, Detection: malicious, Browse Filename: Proforma jar, Detection: malicious, Browse Filename: sjfcplkzk.jar, Detection: malicious, Browse Filename:, Detection: malicious, Browse Filename: cenovnik.jar, Detection: malicious, Browse Filename: vav2duep9c.jar, Detection: malicious, Browse Filename: zbqfs1n7s.jar, Detection: malicious, Browse Filename: bad.jar, Detection: malicious, Browse Filename: wowik07mv.jar, Detection: malicious, Browse Filename: jar, Detection: malicious, Browse Filename: tiwit.jar, Detection: malicious, Browse Filename: 71DXX.exeQSQ.exe, Detection: malicious, Browse Filename: Swift copy _pdf.jar, Detection: malicious, Browse Filename: CONT_WX_BAS.jar, Detection: malicious, Browse Filename: FULL ORIGINAL DOCUMENTS 2FC1.jar, Detection: malicious, Browse Filename: FnRoEYlPgUU.Ptfypi, Detection: malicious, Browse C:\Users\user\AppData\Roaming\Oracle\bin\awt.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): Antivirus: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows E3EF9F287C58089FF07EF3 88EE48B36422A9269C469C36B801932BD6906BF5 4C4BF1FDE6365A4FC265257BFA61CE3300CD0C5C1E904C40C0065EE8E97F39C4 CC585EE0D6D2243C481B98B5D9B48807FE149DCB9B28B F14B38DE394D2FEC0429F523CCCD88D971288F 8BE692CEAA0DB081DDE36DACD8FB49A6EF9E30 true Antivirus: virustotal, Detection: 0%, Browse C:\Users\user\AppData\Roaming\Oracle\bin\bci.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): Antivirus: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows E32EFDF4BDAE1464F979912F1404C5BD 08080E4851E88B83995B F6FDC6311D2 3A01155AAF37F23ED8EA04F25D72EBA98AA7415DEDF9D40BE378F28D4BEE63CD 8ED83FFCF5AEBEA7D730FF4D4B F212D0FB0B1834C928E29B93E875573F02B12E F99DE32B0F9 C5661B6E5B295B BC0F5968CC04A true Antivirus: virustotal, Detection: 0%, Browse Antivirus: metadefender, Detection: 0%, Browse C:\Users\user\AppData\Roaming\Oracle\bin\client\Xusage.txt Size (bytes): 1423 C:\Windows\System32\xcopy.exe ASCII text Entropy (8bit): B A9E9E AE9C5FA 238B369DFC7EB8F0DC6A85CDD080ED4B78388CA8 37CF4E6CDC4357CEBB0EC8108D5CB0AD42611F675B926C819AE03B74CE990A CA93C8CF762468DE668AD7F0EB0BDD3802DCAA42D55F2FB57A4AE23D9B9E2FE148898A28FE22C846A4FCD F1EE5190E74BCDABF206F73DA2DE644EA62A5D3 C:\Users\user\AppData\Roaming\Oracle\bin\client\classes.jsa C:\Windows\System32\xcopy.exe Copyright Joe Security LLC 2018 Page 18 of 443

19 C:\Users\user\AppData\Roaming\Oracle\bin\client\classes.jsa Size (bytes): Entropy (8bit): D3988B18B4B48049CD465CD6CFFA 4F480BA8672A677BCBDDB FA A36F98B AD5EB6318D AA35EF67EEAFD16AB335710A517C 34B05CF0546ECA F9ADA5664A73200D0160C0FCC1689FFA2B36B52AE4BE4D484726CDD232FBEC31EDC A821A4AED8E EC5373A0279C83891 C:\Users\user\AppData\Roaming\Oracle\bin\client\jvm.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): Antivirus: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 57A10918A05BEF3961ACF A4FC413D5A32D494E3CCFB2B8F3DCF96BB90808 B7D99D8FDAA0FAD10FAF4C5AA6EEB1FC84DF4D1933EA A6ABDE EFC64A6B43EE50F9EF404545F50431A38441C10B0DABA6AA A84671DD52B66790C7EEE22B33FDDB 986B28CEDAE5C1A58B5F30FFA0B2B5AF893C4C true Antivirus: virustotal, Detection: 0%, Browse Antivirus: metadefender, Detection: 0%, Browse C:\Users\user\AppData\Roaming\Oracle\bin\dcpr.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): Antivirus: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 5C4AB5C8D9FC9D96ED1420CF5FFECFE4 3B68B2C1EE2FB2E973B4CAA0DEE7F7DBF CE247418D8D454FFC0DF04EDC50A1A65A4CC3D5969CE66DB55169EEC85877BA F6689A26AE1E57CBEEF84CBE3FE1FBD812FC474FAD6BA5E8D4DFE0E8C99BDC8AF7CB D93CFAF EA969E34ED373F1CE8BFA AD12C7CF020B true Antivirus: virustotal, Detection: 0%, Browse C:\Users\user\AppData\Roaming\Oracle\bin\decora_sse.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 3080ABA90CFF63D5C5A33C854DCE27F3 D6E5E7A045A187EDEC8AA6E689010C2DDC73F608 7E1ED9E E8C10EB60094BFB659942BDE0764DA19AB041CE F 55FF028A571F D70E3020E03C09F4115DA1F47E2AA2E47455EE02823A2BD589C7C5AD06EABDFCC519DCB 19B3698DA79AB22AB844F000AD3DEBA98790A2 C:\Users\user\AppData\Roaming\Oracle\bin\deploy.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 2CFE0B1492EB6FEBBE2F1D4E09B4872F 1C780B589B2D71D6D0B2B5BF0C2E440A90A00A7D B28FF7067B128F35A3F71A17F85D59687C EC5C31A016F38706 A90D4C4DDE4A464A2CAB2C5C5B63C553C5C7FEE6A4415F17685C FCA8E248D81FD0530CACFDD02F9D CC9D1F996D5D1F E4B20DB3AF4E7E034E Copyright Joe Security LLC 2018 Page 19 of 443

20 C:\Users\user\AppData\Roaming\Oracle\bin\dt_shmem.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 8CE4069A52BC41A4E834A8E38753FA09 5C0FF B5D067B23B C0987C0D2 625CFB08B5B909BBF D8744B974FE E6F2CD4BF3C1580C935 2BD484384DDDD55FEE6789F4EF086EF7F8AD4E7D9956C207B6587E24BA1AB665AA19A8C094A12CF48A71F79BB 84A15C5EAD859EE94FF47F1F9AD4B7B84CEC10B C:\Users\user\AppData\Roaming\Oracle\bin\dt_socket.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows D322D0D FE34A84FAD8C08FE 458DBF55127E52AD7B76591CB50771CBF0D7C58B F51F7D5A39992D BE208D516D3C515757A AAEE7CB552 56C892B17B30CACC8E1D5CF09B5E522826A1B443691E75894C13AB94C75F88A4B26EA392B2EC5A99BFF3EDBD4 F8DC518B29E10F7BBEA8697F8AD4A127B025B2F C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\deployJava1.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows C0A01372F7A1D107EE F669AAD 8C770048CF9B BBA66C4A1E4DE9CD6B4 E596EC4273F111D8D FEB F8296EE04A85C A656F1 64D25B8CB45B7367FC4BFD8F4D6567FB0B8D25D D18CA91D B13D75F568D62E4686C9FAF9850 A45E37C29B9816BFF5A12BBD85B6BB08F4371 C:\Users\user\AppData\Roaming\Oracle\bin\dtplugin\npdeployJava1.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 8EE9808AED44873E6C2F578196A53715 D6428D E3DF67C70C511E1A2284DD863FF 4C503B185348C669BD20E5852C5AD203AB6B905F97FB5A7A3474C B 27D27FC942C220CAE003A917F5769E6B59B87F7E535AD B1705A2FBE34DBEDFF4A2875E6E C06 EDB284E41CADDC6912C1B8D459751A93458BF C:\Users\user\AppData\Roaming\Oracle\bin\eula.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 6E2AECD DA90BED5B849A53 48E88361B85C61D36EC0FE A5AC4F75C8C 893CE6B2475F12EBCE25711B51D4ED8045BCB F9AA8F71414 D17F7D8F0771FC74B4BDFEF9E C34DF413CF0C CAE7AB82438FFC236306CE21F583A6F20FDE2B 0E602DE444016DAB0DFE660E4E000C9368B76 C:\Users\user\AppData\Roaming\Oracle\bin\fontmanager.dll C:\Windows\System32\xcopy.exe Copyright Joe Security LLC 2018 Page 20 of 443

21 C:\Users\user\AppData\Roaming\Oracle\bin\fontmanager.dll Size (bytes): Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 25CCA16EE39023C5A7DC09C321A5FCF5 FF755F58244E0753D737C9325B9F42FE59CD9B65 82C2757D3210BFE13677A0A286E4BB926DE25385E5F325B49338D5BD09C821C1 2736F2F1F345CD1CFEE241A212DCB879D53AFA65596E05ABEEC6638ECEB6C42DFDA6A2F92AC71A4ABF6D304A FBE85E41916A3B01AED5B73D1415DE1D8FD70725 C:\Users\user\AppData\Roaming\Oracle\bin\fxplugins.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows CDF176E141AD890AA8D8A269CAC60BA3 2C339BFFDA4E07FE3DC4D FD5F5FBAA 93ADB78853E427471E48AEFAB4A9103C6AC3B7D233931C D1EECAD8519 3F5029A52DAE00E3D4FE696155AAA D848A CEB34F33FC3D7E455D86FF0F3F8FBB5E8D44F3AA EAAAB22D700467C38E8B C C:\Users\user\AppData\Roaming\Oracle\bin\glass.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 77BACEC88AC4E3C8D95FF07FF3A2B7BE 256C6640B9C C029C6EEF285FCDB2F66C 9F91A2E7BE21317DA8D61D80691FF E7435C35CD348F7A97845A93BD AE19C912D DF8DA4C31873A5571BE8EC40C52AF66812E298F9D249809BF0B0FFD0DD517BB0A9AA1EA1 B9F25C6B0FB76F692134C5776A B64B C:\Users\user\AppData\Roaming\Oracle\bin\glib-lite.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows F5A84D9F CFDFE409644AB DC56DD147ABBB77EF54080A8FC47AA658E B20F2376F99CB9C36E1CC3F88DB91CF7ED7449BD092F4FF982FC6BF3C691676C 70B53088A2FE2B2F01AFABB800A6D F9116B03870C91DC9CD1CF96B092B22713EDCA3C FB21 D08D75F7A2D4ED998E636BD07C E0 C:\Users\user\AppData\Roaming\Oracle\bin\gstreamer-lite.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 0D8ECAE61AAFB195F02134CD2E618B59 67A037AF6116B858B4CFD3AC1F141861F6FFCB3C 87C4B4556AC731C37EC B25EE065252DDCBE351B37BB020A470DE47F4 70D320428BE43598A DE0F312A97A6332F6F0081CE675EA6D0B4DA1A3523ED43DFC8F288FD262A9322 BA10B3DB08E8924B11BFC1BD89DDB3BEDFC3A C:\Users\user\AppData\Roaming\Oracle\bin\hprof.dll C:\Windows\System32\xcopy.exe PE32 executable (DLL) (GUI) Intel 80386, for MS Windows Copyright Joe Security LLC 2018 Page 21 of 443

22 C:\Users\user\AppData\Roaming\Oracle\bin\hprof.dll Size (bytes): Entropy (8bit): B105B9E5DBE91945F95A0AD1708B205 BF535181CC646D19F E404266BEF5D91D0 2773D91DF28EFE4FDF FE AD FC86C02E34FBB1D2D 4E8F4D0316A0F6308FCEF846B73FFA98FF67D F90861B7C466166E7F564DD0D85E440F ACE68600 EF1D22B0727B8C3F722A3B937BFCD85CE86D C:\Users\user\AppData\Roaming\Oracle\bin\instrument.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 281E338EEFD2121C835C572063F2942C 58E E4C CFBBA2F6247DA25C20A9 CC51833EF9C42D096090B6F7CEB88B91829DC9D0603ECB963042B2F6F9ED3B3C AFFB6E15756A3A09A0DF0FE584BEBB16A96A5F7967A57B422EC093D9D96C043F409A317EFBE197C360EF06FD71 005F436046C6345D434B342371F42C50910F8A C:\Users\user\AppData\Roaming\Oracle\bin\j2pcsc.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 8E2E4E995DF27609BEFB F18D 1A048A6BC0B7CDF5A2376D748D3E1B7ACDBEC7A0 7DACAFF6289A9887E F3A412CBC229C92A3E76691EBB3CEBA5A69DA 72BBACD85EC3F0766A17F844BF890E57E40B32675CC08CA4BAA3D559FA81C6846C7235F592FB B0 5AE3671F B67E3957C518449A80C80 C:\Users\user\AppData\Roaming\Oracle\bin\j2pkcs11.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows D6026C2B6A839DD DCA20B CDE737D8E169FDE876C280DA9DD78500F840BC5D 127A152EA4F71BF2862E39E90FF98A6FAF057AF8A845A75680F80202ADF A02FE84680E3E EC92BFBC82AEE DC5C2A035B1A282AAC7BDF2EF76A293A27631E269 C62991CAC6E12C092FDAC D81FE4B88 C:\Users\user\AppData\Roaming\Oracle\bin\jaas_nt.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows BB3B769F9AEF7B70F575899F44FA934F FBABBC8E506F3401FDB45A55A2F84C6BA8E7AC94 2F32FF27565E4FD290E75CB76B BB3489BF6CAB69D5B9D5FC883BF7A F842DA4CA3E7E0A7963FD7B658BEA47BE4AA58DF66F972F24C EC22FA908CAC67FA900D 505CFFD87835D0D042133A0FD81256E708A0FB C:\Users\user\AppData\Roaming\Oracle\bin\jabswitch.exe C:\Windows\System32\xcopy.exe PE32 executable (console) Intel 80386, for MS Windows Size (bytes): Copyright Joe Security LLC 2018 Page 22 of 443

23 C:\Users\user\AppData\Roaming\Oracle\bin\jabswitch.exe Entropy (8bit): AF5D1B2BE539A2D210A598E693A F753CC6C DE71C7CC82230D7CBE02A0BA F1E12F28C9DD7F8FFE2B94B6D0C8F EC0A71FC0A1BA239573DE97A E69BE640F57B75DBDFE18E097B00DDF6C007E73986D96448D9E0B96FF06A38463E5A3CD87E0AF5F6C8CC49EE C2184B9EF7883CF14C2152B6BD21B644ACDACF C:\Users\user\AppData\Roaming\Oracle\bin\java-rmi.exe Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (console) Intel 80386, for MS Windows 690C4C406DA F43B5E0ECC019C F8F5E5E CA159124FB AA7ABED F0D3F4F204FE11EF39DB3FFC0D37D81E13CEA54C5AA 8C01F2B9040B13C957DE38BD9AB2662B50CF62F31E1E06D7E186F B FC06B8C5155F2E06DDEB9 FDCA415B431A2AC2E711937EED7F75C7F2BA0 C:\Users\user\AppData\Roaming\Oracle\bin\java.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows D4A44B AC50623F FE1B0B783558DBA430193D17ED4BFFEFF0033CB 8F519A123E54D0CA719B221562E326614FAAC1864E1F911DCBD60A415E89E05F 38117BB4C063058CD7C3B5D76F8B75F2BF1DAD04F58F3A4A5797E57B0A8D EC6C1B8ECF02BAE FB0A30570FF8288C351290A99B075B665CC4 C:\Users\user\AppData\Roaming\Oracle\bin\java.exe Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (console) Intel 80386, for MS Windows 02E26F23B FB5E33DB36BF08C 5B52DF44ADAEDEF8DF26A2C1CE0A700D8BE84FC5 74E3A20C7CE578D6E FC FE8BCFABD3F5E1629ED4E 396BD F882CD36C8DEDCC669B07AFFDD7280ABC4E14E38DDE93D86D84565EC15621F570998A159CA52 C6C63E07A8C6829AD2526DC298B6E0A3E3F5B1 C:\Users\user\AppData\Roaming\Oracle\bin\java_crw_demo.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 85A FB6F6D93862CA04E68DB3 C24E2186CB7C F07EB06EB7B2B6CC82 1AE3BBFBE8A818B8EF5B9F686FAA1098F47022FFA F9F9F9AE4EE7C9E2 5EECE50EE4CDE9ED25700EF6E12D69AB712EEE50DA0FC896F48D68D434BD97DDD1E65A660C2A5B61B28E354F EC9BF1D31FC558B944EF4C5532C55279C08ABF2F C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.cpl C:\Windows\System32\xcopy.exe PE32 executable (DLL) (GUI) Intel 80386, for MS Windows Size (bytes): Entropy (8bit): Copyright Joe Security LLC 2018 Page 23 of 443

24 C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.cpl ECC258D C992E0317B477 4D70E4DB47F9D6329AC463C8C32DBD81CE6F44AF AE5AA1C0F4C8537EA BAB2CEE76A9FF96581CA D139A E3F7F92FC626CF6054D2B1A D194BB27C5CCE42C44040DDFD684D3A077BE6320E F2BBA7E76FD FFB77252EA8B21BAC286F6EE86D27122 true C:\Users\user\AppData\Roaming\Oracle\bin\javacpl.exe Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (GUI) Intel 80386, for MS Windows DB21CE7E022FBA4A25F5ACBF 330B2DC60592A8EF98505F3BB9842DA72639C37A A232D7829CE3494D447C8FF338F4CAA4282B DCD87B71C64609B7F0C3B 9A1A13D0041A5AC A3B6B83B5D25AF1AA912BC78ED5E F8E2C83F76D0A20EBFDE040EBF84 E9DD674E718163C1CD77763E0BC2C3B947E434 C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows DD5AB5B8D417D25BD53DC56E57B1FA7A E3FFD CB77841FE6E9A8AAFBF3A1D BF2AD6AA41D4B FF6923BF1AF3251A0A3679E85D91CA19CFEE3729BB2 15DD88281F1B5242F F509B1AA07F0DEF139A2D9EA821D51BA630D329A5A478CD9230AB0AA1635B3BF4 71AAB02CA0E881F142A49859F56ED8DB65D7E C:\Users\user\AppData\Roaming\Oracle\bin\javafx_font_t2k.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 13BBFC8DB65E08D4A0C01AAD663D548E 2B69D25934E2E2A54C91BAE38A20965D44D1BD18 575A9EA499B28E0C8BDE0CF02514B81B337CD5B96E4A89724E5D DABE 2ACA80DBFAEA3529A50E5CDEF345436C523621B0BFC0274D0BF43AE F918696A669204B918971E70 DCF47C2EA1A8F67DA062493A06FD27DB1FBF3 C:\Users\user\AppData\Roaming\Oracle\bin\javafx_iio.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows C35A3FABE304041EC992A634F 5AE4FA29E92642D344207D4FE86C85EEC1B2A15A E9C0BC532B78549C384FD F4AE04C041CDEB76DD14DD776D5307CB45A2 E580B44AB5661DBE13BC3DB78083DB2ED999CE3D7ADB340613C687C94C66519BDEAFCBBFCBB30198C7D2E9B6 868B61E09CFFDCD153BD597B610A7DCA2BDA53D6 C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe C:\Windows\System32\xcopy.exe PE32 executable (GUI) Intel 80386, for MS Windows Size (bytes): Entropy (8bit): Copyright Joe Security LLC 2018 Page 24 of 443

25 C:\Users\user\AppData\Roaming\Oracle\bin\javaw.exe F233D34C98F6BB32BB3B3CE7E740EB84 0B2CA11540B830AE37F4125C9387F8C18C8F86AF DE326CF3151BCEBCFA89BD380C CD85F3791E81424B27EC D050562B7212ADDAF042ECDDB145AA2D598B48C7A7E848F6809EF1612C63F3EE03F3B37FBFDFF D74C B68DD3C6F EB8E3FA8D6A2A6CA646D8 C:\Users\user\AppData\Roaming\Oracle\bin\javaws.exe Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (GUI) Intel 80386, for MS Windows 55561AC10D64539FA634E4FCB14D83DF 5C8885EAB1B7F9A63BDADC309F0E07957D259AA5 CA681963C7EDFBD7FF84D6A3FD6325C291CD5BF2D953D388065D78A3CDB08BAC 0957EE9480B62681C5F709A4F080DD2F9E633EA1CD2BE7B5A4AADD9F BD70BD7C9E2A5A0BE F4BD924EA098D75C81DF017DB293E3FA6C925 C:\Users\user\AppData\Roaming\Oracle\bin\jawt.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 0820D1B8828A57A20C1F81654F7D5FD3 67BAA79F87A068E78C CA2C1DBCEEC60C7 563D B4DA7F647D9F9BC7E0F076ADB76518D A546C736ECDD639 9FEAB80F9A753D29A269AF22AB6FD457E B6DCC0FD1C3A8F566CBEE75AFC5A516C0D9D5325DF707E783 7C91FB526F8A8A13BAA8ACD66BD0727AF20B1FA C:\Users\user\AppData\Roaming\Oracle\bin\jdwp.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 4612C44E5DFF2F46220B33FA385DB681 7FCD70F589D1B1DAC2A85D105C F426B A8F53E3FFFE097EAA3737E8FD67AB8C113BF588AF4C67CEC82CE2DF7B1AD03F5 BD6117C D65615D63FE96BC79709B54BF65C4B9BD9C5F1BEC878A33277C5C1FECFBC84D2496CF9776 B A628E01A D8BF42A9C7C7 C:\Users\user\AppData\Roaming\Oracle\bin\jfr.dll Size (bytes): C:\Windows\System32\xcopy.exe Entropy (8bit): PE32 executable (DLL) (GUI) Intel 80386, for MS Windows 06F8890A926E2A27CEA332CB2AFAEB4D BA BE2B3CF66EB98E0C44B3B0F7C4E 97F457160B38194D58D1F4ED B0F8B00A45CDF916A5F684D97977D77 2F FA8A04A4D1ADF1BB4EAA7591B3A8FA68B76DCBF5E61D790F5CE6D7782B1CFB2AF4DC2D3B655FC94 5EF218D4F1D541EFA95D3579A6A A345EE C:\Users\user\AppData\Roaming\Oracle\bin\jfxmedia.dll C:\Windows\System32\xcopy.exe PE32 executable (DLL) (GUI) Intel 80386, for MS Windows Size (bytes): Entropy (8bit): BCAB8A90CD05CFA4ECC9EE87F20 Copyright Joe Security LLC 2018 Page 25 of 443