Install4j wizard no click5/11/2023 Name RT_DIALOG RVA 0x7dfa8 Size 0x12e Type data Language English PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced Name RT_ICON RVA 0x7bf20 Size 0x2087 Type PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced Language Neutral Name RT_ICON RVA 0x7b078 Size 0xea8 Type data Language Neutral Name RT_ICON RVA 0x7a7d0 Size 0x8a8 Type dBase IV DBT of block length 1024, next free block index 40, next free block 0, next used block 0 Language NeutralĭBase IV DBT of block length 1024, next free block index 40, next free block 0, next used block 0 Name RT_ICON RVA 0x7a268 Size 0x568 Type GLS_BINARY_LSB_FIRST Language Neutral "java.exe" touched file "C:\Windows\System32\en-US\" "java.exe" touched file "C:\Windows\Globalization\Sorting\s" "java.exe" touched file "C:\Windows\System32\tzres.dll" "tinyumbrella_windows-圆4_9_3_4_InstalledJRE.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "tinyumbrella_windows-圆4_9_3_4_InstalledJRE.exe" touched file "C:\Windows\System32\en-US\" "tinyumbrella_windows-圆4_9_3_4_InstalledJRE.exe" touched file "C:\Windows\System32\imageres.dll" "tinyumbrella_windows-圆4_9_3_4_InstalledJRE.exe" touched file "C:\Windows\Globalization\Sorting\s" "tinyumbrella_windows-圆4_9_3_4_InstalledJRE.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "tinyumbrella_windows-圆4_9_3_4_InstalledJRE.exe" touched file "%WINDIR%\System32\tzres.dll" Possibly tries to detect the presence of a debugger Source Hybrid Analysis Technology relevance 10/10 Monitors specific registry key for changesĪdversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.Ĭontains ability to lookup the windows account nameĪn adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.Ĭontains ability to query the machine versionĪdversaries may target user email to collect sensitive information from a target.įound API call directly followed by "cmp dword ptr, 06h" and "je 0000000140014407h" ( Show Stream)įound API call directly followed by "cmp eax, FFFFFFFFh" and "je 00000001400353D1h" ( Show Stream)įound API call directly followed by "cmp dword ptr, 06h" and "je 3F314407h" from tinyumbrella_windows-圆4_9_3_4_InstalledJRE.exe (PID: 2832) ( Show Stream)įound API call directly followed by "cmp eax, FFFFFFFFh" and "je 3F3353D1h" from tinyumbrella_windows-圆4_9_3_4_InstalledJRE.exe (PID: 2832) ( Show Stream)įound API call directly followed by "cmp eax, FFFFFFFFh" and "je 3F0C9C89h" from java.exe (PID: 3112) ( Show Stream)įound API call directly followed by "cmp al, 06h" and "jnc 3F0C01ACh" from java.exe (PID: 3112) ( Show Stream) Reads information about supported languages The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.Ĭontains ability to query the machine timezoneĪdversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Process injection is a method of executing arbitrary code in the address space of a separate live process. Opens the Kernel Security Device Driver (KsecDD) of Windows Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager.Ĭontains ability to open/control a service
0 Comments
Leave a Reply. |