TNWKX9Z3WCY9YXCB.jar

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 18, 2021, 9:40 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 18, 2021, 9:40 a.m.	process_identifier: 7180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 2555904 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000024a0000 process_handle: 0xffffffffffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

McAfee	Artemis!082A3C07F697
Alibaba	Trojan:JAVA/Adwind.f13b8a45
Arcabit	Trojan.Generic.D2C57D32
Cyren	Trojan.LUVQ-1
Symantec	Trojan.Maljava
ESET-NOD32	a variant of Java/Adwind.AXP
TrendMicro-HouseCall	TROJ_FRS.VSNTFG21
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.Script.Generic
BitDefender	Trojan.GenericKD.46497074
NANO-Antivirus	Exploit.Script.Nemucod.dzzhbf
MicroWorld-eScan	Trojan.GenericKD.46497074
Ad-Aware	Trojan.GenericKD.46497074
Emsisoft	Trojan.GenericKD.46497074 (B)
F-Secure	Exploit.EXP/JAVA.Banload.MRAF.Gen
DrWeb	Java.Dropper.46
TrendMicro	TROJ_FRS.VSNTFG21
McAfee-GW-Edition	BehavesLike.Downloader.cc
FireEye	Trojan.GenericKD.46497074
Ikarus	Trojan.Java.Adwind
GData	Trojan.GenericKD.46497074
Avira	EXP/JAVA.Banload.MRAF.Gen
AegisLab	Trojan.Script.Generic.4!c
ZoneAlarm	HEUR:Trojan.Script.Generic
MAX	malware (ai score=82)

A potential heapspray has been detected. 887 megabytes was sprayed onto the heap of the java.exe process (1 event)

count

3548

name

heapspray

process

java.exe

total_mb

887

length

262144

protection

PAGE_READWRITE