Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 04:44

General

  • Target

    046689b33237297e1c966538eb6ae968_JaffaCakes118.jar

  • Size

    670KB

  • MD5

    046689b33237297e1c966538eb6ae968

  • SHA1

    e4788f57c8dc9d6516ca4b73f7cb49ff40a90b66

  • SHA256

    7cbeaddc814678cb1a8745a6962007f572dfde41fed0203355e1d4679f159a9b

  • SHA512

    883a1ec508263bdf175abdca78ddf02b3e90bb5dd890859432e2df0b5cd8533b6ddae872d181a659512fc24c52060e22281d514fce2d02d821922daa9d7ef4a9

  • SSDEEP

    12288:2X6zh4UEcOShSOlyLRSPPh+5Wycuk7GPvsY3zcl15GdM4:jz/EcOSzllk5WyZEYGEJ

Malware Config

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 24 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\046689b33237297e1c966538eb6ae968_JaffaCakes118.jar
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:2164
    • C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.1864773387903382017692915408035870.class
      2⤵
        PID:4808
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4757185916198781734.vbs
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1980
        • C:\Windows\system32\cscript.exe
          cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4757185916198781734.vbs
          3⤵
            PID:4896
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6949262142702871009.vbs
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4940
          • C:\Windows\system32\cscript.exe
            cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6949262142702871009.vbs
            3⤵
              PID:4564
          • C:\Windows\SYSTEM32\xcopy.exe
            xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
            2⤵
              PID:3276
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe
              2⤵
                PID:3332
              • C:\Windows\SYSTEM32\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v rLyLJOouDuN /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\GxOLIiZIRlJ\RiSsNdNKqMn.anCOFl\"" /f
                2⤵
                • Adds Run key to start application
                • Modifies registry key
                PID:2416
              • C:\Windows\SYSTEM32\attrib.exe
                attrib +h "C:\Users\Admin\GxOLIiZIRlJ\*.*"
                2⤵
                • Views/modifies file attributes
                PID:4584
              • C:\Windows\SYSTEM32\attrib.exe
                attrib +h "C:\Users\Admin\GxOLIiZIRlJ"
                2⤵
                • Views/modifies file attributes
                PID:5008
              • C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
                C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\GxOLIiZIRlJ\RiSsNdNKqMn.anCOFl
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3940
                • C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
                  C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\Admin\AppData\Local\Temp\_0.07061226503074891698725329362688983.class
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4932
                  • C:\Windows\SYSTEM32\cmd.exe
                    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5278767168077388534.vbs
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3480
                    • C:\Windows\system32\cscript.exe
                      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5278767168077388534.vbs
                      5⤵
                        PID:4704
                    • C:\Windows\SYSTEM32\cmd.exe
                      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7869484444974077321.vbs
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2180
                      • C:\Windows\system32\cscript.exe
                        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7869484444974077321.vbs
                        5⤵
                          PID:1636
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe
                        4⤵
                          PID:1644
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4620703661586598993.vbs
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1452
                        • C:\Windows\system32\cscript.exe
                          cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4620703661586598993.vbs
                          4⤵
                            PID:704
                        • C:\Windows\SYSTEM32\cmd.exe
                          cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2179946197741309005.vbs
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2524
                          • C:\Windows\system32\cscript.exe
                            cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2179946197741309005.vbs
                            4⤵
                              PID:4268
                          • C:\Windows\SYSTEM32\cmd.exe
                            cmd.exe
                            3⤵
                              PID:3060

                        Network

                        MITRE ATT&CK Matrix ATT&CK v13

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Defense Evasion

                        File and Directory Permissions Modification

                        1
                        T1222

                        Modify Registry

                        2
                        T1112

                        Hide Artifacts

                        1
                        T1564

                        Hidden Files and Directories

                        1
                        T1564.001

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
                          Filesize

                          46B

                          MD5

                          ad65684ccc23797999aa06aaf998fa71

                          SHA1

                          5159b9ee52c4d6ed04c4848e9693ebf59825913a

                          SHA256

                          099935d36d9a1eefe598cd076097aa7b7f315fe40bc6d9529ce5d83b24d55cd2

                          SHA512

                          bb0e7fb70a7a82cf77ac409c46ba2055deb2fbdc8f1b9dd86af8dfa9c33242a6b0c51d56a29fe3dc808c0cfe8dde1b4ab2ee38c35597a705391669a40abe4cbf

                        • C:\ProgramData\Oracle\Java\.oracle_jre_usage\50569f7db71fa7f8.timestamp
                          Filesize

                          54B

                          MD5

                          e27ff4bd750dcbbed8ba17d836bcf2e8

                          SHA1

                          44a83207bafbc02fd7cd1bfa5420d6e73debafbb

                          SHA256

                          3a7213443036bcd29cdad10f5b86fbcba847861f33c9061db47b8720c71204f9

                          SHA512

                          f0ef857bcfb802966ca300d491077d0a4e619c1acf2ec956c4961952f122b20c266ab81fd31e2af0c8ad4efad177483f9cceb655f6dc249b15a5752b5a4f2696

                        • C:\Users\Admin\AppData\Local\Temp\Retrive4757185916198781734.vbs
                          Filesize

                          276B

                          MD5

                          3bdfd33017806b85949b6faa7d4b98e4

                          SHA1

                          f92844fee69ef98db6e68931adfaa9a0a0f8ce66

                          SHA256

                          9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

                          SHA512

                          ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

                        • C:\Users\Admin\AppData\Local\Temp\Retrive6949262142702871009.vbs
                          Filesize

                          281B

                          MD5

                          a32c109297ed1ca155598cd295c26611

                          SHA1

                          dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

                          SHA256

                          45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

                          SHA512

                          70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

                        • C:\Users\Admin\AppData\Local\Temp\_0.1864773387903382017692915408035870.class
                          Filesize

                          241KB

                          MD5

                          781fb531354d6f291f1ccab48da6d39f

                          SHA1

                          9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

                          SHA256

                          97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

                          SHA512

                          3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-17203666-93769886-2545153620-1000\83aa4cc77f591dfc2374580bbd95f6ba_54631303-6cba-4b22-b333-215df416769a
                          Filesize

                          45B

                          MD5

                          c8366ae350e7019aefc9d1e6e6a498c6

                          SHA1

                          5731d8a3e6568a5f2dfbbc87e3db9637df280b61

                          SHA256

                          11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

                          SHA512

                          33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

                        • C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll
                          Filesize

                          1.3MB

                          MD5

                          88533755e937c3f8075e4fb9171518ed

                          SHA1

                          32190e58f984abbbc9c258dbc2113e54efcbd456

                          SHA256

                          3bf975bbb65d9af983cee29afb32fe8e260bb9063f7948a132dcf9edfc1bf5b2

                          SHA512

                          0cf01dfdf5b48e735b9b008355968e869d199e2dce534cb3fd3d68578b68e7c1a46727f87927ee84eb1fbab6b9e90b4a98f0c91837f384f257249fb43fbd97d6

                        • C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll
                          Filesize

                          162KB

                          MD5

                          583e8b42864ec183c945164f373cb375

                          SHA1

                          5ec118befbb5d17593a05db2899ee52f7267da37

                          SHA256

                          9bc9178d3f4246433fe209a0f5ca70e77568e80c928268c78f8c8b00107ce6ed

                          SHA512

                          1feaac37bac19bde93171ebda2e76a65e9d5472a503b05939f6977b3a4d94d131298f3989dd048d7617ecd69cf09db7ac986fc39f0df9f56c84ea01726d0c898

                        • C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
                          Filesize

                          285KB

                          MD5

                          1562e15220d8771fcb11b9a5b234a970

                          SHA1

                          50ec8e4e7125bda147a1b2ccc2b2827db2dc3479

                          SHA256

                          366199821c1efede3f7112d21da045fd6bf38b56fb3da1ae9d6493c4ddc1861f

                          SHA512

                          a07873f0a5381d202a6439a3245dd51f405cdcec4a9d40ff6ffdd4670a3b218008f7288a89e2a7455782c677d4c661bda96e62f813ce7d8c1f20a6c4c7c2b31f

                        • C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
                          Filesize

                          285KB

                          MD5

                          122e34bfa3146ef9ae5a51fdc744353f

                          SHA1

                          f0cc2294fe150a4cceca8a3da8615edcc4eb20e4

                          SHA256

                          dd2169db3358ccdf4a4a185e4a22955c989eaa3b9d3e0e6025599b8fa173c968

                          SHA512

                          306341e00598f02a70d3edc6ef666cb64982f1e31e5c0a1304977a1700c95395c1c7f0857ae8056853370eced0bd2aeafc72da804a65f98c1422929b7c431700

                        • C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll
                          Filesize

                          104KB

                          MD5

                          818fc60312c5ef0010e1a0367019005c

                          SHA1

                          bec6ce9b8330bd90c6f0527aa01871ec6b2ab018

                          SHA256

                          b090636931f9b5767c2a2c82ca4e5efbf65ce1a79630b48dea47ed01e1d81988

                          SHA512

                          43339d3407aaf85fa94aa3ff22ed3f457b29c93403a7ea19abbec50d4b5fee14fd415e70ac856a84c76530571a5a03eb8c5eae558edad6a64fcc3a3755dc3d5c

                        • C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll
                          Filesize

                          66KB

                          MD5

                          4c8dbf6bb8438a43adecb07b90ec37d4

                          SHA1

                          d33ac1a59b79a8894f0225eca238b6c40649145b

                          SHA256

                          35b203dbdf6716bd7e35a66127acb5ae7d869388ee3778e8a956d1b54bfd15a1

                          SHA512

                          fc08a1390c87fb077758887cd89acec0326ac5332cb380771d8d0edd9e810c8e7fad43ad5800577307cad4ffb3007266d5cf56c7c726bac3939d908ac86eff8f

                        • C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\msvcp140.dll
                          Filesize

                          558KB

                          MD5

                          bf78c15068d6671693dfcdfa5770d705

                          SHA1

                          4418c03c3161706a4349dfe3f97278e7a5d8962a

                          SHA256

                          a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb

                          SHA512

                          5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

                        • C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140.dll
                          Filesize

                          95KB

                          MD5

                          7415c1cc63a0c46983e2a32581daefee

                          SHA1

                          5f8534d79c84ac45ad09b5a702c8c5c288eae240

                          SHA256

                          475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1

                          SHA512

                          3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf

                        • C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140_1.dll
                          Filesize

                          36KB

                          MD5

                          fcda37abd3d9e9d8170cd1cd15bf9d3f

                          SHA1

                          b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2

                          SHA256

                          0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6

                          SHA512

                          de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257

                        • C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll
                          Filesize

                          8.5MB

                          MD5

                          36e3e370db5f0b66689811b41f1a8445

                          SHA1

                          7fcbe290c3a6a0827b77af78115a1b4bc834d685

                          SHA256

                          9f28a06990d2ed1d14130072109e37e733b3a7d4922e325e679dd4d917741550

                          SHA512

                          f93bc4ca946e383ee1edfef3c7b5574585d23d660a4cc3db5b6b203f6111a3fe1f245d583ca53852888ac67812fb6efd0d121d0643180875baeb0d7b811d4db9

                        • C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll
                          Filesize

                          142KB

                          MD5

                          fd3dcda8909ec5575b3b0acf6f219585

                          SHA1

                          4ae6dc79730e54231ff1f970515e3a16a4287fa6

                          SHA256

                          f70ceddab71854c9c59f412cec6be5d6b918a1b2ee23f7952354a00b71cc407a

                          SHA512

                          16b24f09943b7b92a92adfbdac6a274147e9eb54eae5a2d24eb07129dfced0b9b4f2ddaff6cf3e21c295af99f4b676be9084d72a1493d6c3cba9c91535a4bfb5

                        • C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll
                          Filesize

                          55KB

                          MD5

                          0fcda2fc9a161614e68d74f4d9eecc2d

                          SHA1

                          d3734149ff561209aa9e851ea958012e20ce41da

                          SHA256

                          b1cf5a699d1a48691c2fe8dfad1c8c8aa1c4013c52b4107bad905faf037ddffa

                          SHA512

                          5402af47558721f084f5f05264e160bd43ebe265c2d2e3b415c2a0ea7bf9adf7aebb76e2c12dcf93ae5bf10d00f4c80aa3a97f35c02eb3279df9c675f3a037bc

                        • C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll
                          Filesize

                          87KB

                          MD5

                          2ca64779a19ba733a408edd9511b7c37

                          SHA1

                          99ad8571bc8cd48efba19a48066c0f0dd321ecc1

                          SHA256

                          c3c3365932d865e111972184ae12dc3853dc7e5d6df2f474dbeee5faead92cd3

                          SHA512

                          0822bb0e4d18115d325f3981ad15cb036d5a9f845d2c68975c5e9164b5fbdab0fdd4e882d3b8001f58271b7b38cba9bdc1299ccfab00ce0321f396aa8bf248a5

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\accessibility.properties
                          Filesize

                          149B

                          MD5

                          2ed483df31645d3d00c625c00c1e5a14

                          SHA1

                          27c9b302d2d47aae04fc1f4ef9127a2835a77853

                          SHA256

                          68ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf

                          SHA512

                          4bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg
                          Filesize

                          634B

                          MD5

                          499f2a4e0a25a41c1ff80df2d073e4fd

                          SHA1

                          e2469cbe07e92d817637be4e889ebb74c3c46253

                          SHA256

                          80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb

                          SHA512

                          7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\charsets.jar
                          Filesize

                          2.9MB

                          MD5

                          a5b8d1a15884d8450ec905fc08d6e1d2

                          SHA1

                          472cdfe3f3bf1e719e3bc73f008f26960d2a74fc

                          SHA256

                          94e16e5ba8033fc3cd2a2e731b6326958dfe7c9b70fd4826eb2c0709a656d83d

                          SHA512

                          3eee8ff3e969161d551903a1687db379f516ddfe4bec35c508964012a58895a45a36d4efcd06a60448f3ec764c4f3dd7e317445c32e23b8c888b68361747e330

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\deploy\messages_zh_TW.properties
                          Filesize

                          3KB

                          MD5

                          880baacb176553deab39edbe4b74380d

                          SHA1

                          37a57aad121c14c25e149206179728fa62203bf0

                          SHA256

                          ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620

                          SHA512

                          3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\cldrdata.jar
                          Filesize

                          3.7MB

                          MD5

                          963f24960961ab867557b3e9efe1372e

                          SHA1

                          b8df19f50c65e30b7c30a75e3a04ec6269ad232b

                          SHA256

                          2f82a0aab474994cf8fc675fca5b728cb1c3462b25f1476314ed37f4cbc79c8d

                          SHA512

                          7293b78e72a8249fab531155537fdd031973290c85250fc64dda426133259fdddf7125fc4f866e8664da1c0833f6d4587ade83215a012c99b6089f802f9d3ce9

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\localedata.jar
                          Filesize

                          2.1MB

                          MD5

                          dadc23608176ecb608f037166109b0e9

                          SHA1

                          69fd572644039f0c59bee19e1868c3d6996184fd

                          SHA256

                          bed4a65067fa3324b93066f8aa76b5e269f098b2195d1e50cf1810f162660bb2

                          SHA512

                          da9dd758fb9d29472a6ab4fd295cb208243984a8dd0d33bc1dba668d2880113aa34d6d34a2b33243fa213929b4b4639c2a8d0c261c482d0986cf5ddf224c4cfb

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\meta-index
                          Filesize

                          1KB

                          MD5

                          af03d781ec85caa0f45e6e29830ce112

                          SHA1

                          ef3dd2f731903182e47cb83cdf275f5f0e58b3db

                          SHA256

                          8c55ed28260fcd7fd4e5d68e871a735148c01a711545602c2c26aa9d6653c05c

                          SHA512

                          df080f8c206ba125f5ce4129640fc05e9fc5b00fd87fe08866bbc7b67f5caa3ec2792dd874d49253a70ea0a9c3856c2e8ba4c39728656854a290cfdf6ba683a3

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\nashorn.jar
                          Filesize

                          1.9MB

                          MD5

                          73cb1970c4e1393759644e89c862244a

                          SHA1

                          2c685a68034803ac4f698bca0dd78e988976452f

                          SHA256

                          313a35b84eab1ab8fd09c2730045cdc361ea05d57629b25005f1a8f66a0cd11a

                          SHA512

                          cb3240df148444226fc6aad7b3eb5a7f7d8578e7957ccadf90b093630982002130c9a5d9d198648a63029b953bd1e8b487eb392e1b23d0760d9ed1d151c4e485

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunec.jar
                          Filesize

                          46KB

                          MD5

                          5aff6406c285d0ef2e8d7946b2eb01f8

                          SHA1

                          fef27bfeff7242ea820c90665d684fcacd770505

                          SHA256

                          6507274374d7d50eb6bf5998288760988deccc16ed7934ad8a182c2500f0405c

                          SHA512

                          c94f1b7d30d74914ed973892f8f3200a20206caeec41e99feef9b58b9e4354260b396eb464e2162d740315f000d7bd1c811ef7520301fdc65dcfd0af648deb65

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunjce_provider.jar
                          Filesize

                          288KB

                          MD5

                          d48c3b0a549c1b0a72cc5bc63a4cc979

                          SHA1

                          542d860693da662555cea10986e533e374b52326

                          SHA256

                          a5d33f76829de19bd1eef234cf148c1f984707480befa81b4811bad21886a050

                          SHA512

                          f8f8e949bfc809a8504d810ceb4e75aad27008aba9aba27bc84dba77ebb7c05f8dc7f8a33b83d51d0872f9ce43ede3f26a51e9fc8eb17558c72b684c2bed73d6

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyNoDrop32x32.gif
                          Filesize

                          153B

                          MD5

                          1e9d8f133a442da6b0c74d49bc84a341

                          SHA1

                          259edc45b4569427e8319895a444f4295d54348f

                          SHA256

                          1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

                          SHA512

                          63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jar
                          Filesize

                          120KB

                          MD5

                          99247d1d5370a784e438416e599abe36

                          SHA1

                          2f958cccadeb2d991e41edccece08bc1a64368cf

                          SHA256

                          f5700ffd6842bff801307c09e02ce3ca9792eb2cd4d34e79563bf77ff44ae531

                          SHA512

                          e3380e411f1b7219df659cbb4691cf3cd23c66f4af428f3b71539e579b6c2ce8209fad949f3909337a89282fd5c1d1eacf2a1acc34ff129c69c7b0bdb1b65a35

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\jfr.jar
                          Filesize

                          566KB

                          MD5

                          9868c5f7a74f603107ecdb43a367d91b

                          SHA1

                          6b5499786196c71c7c2ff63d1f15d70b4c0164a8

                          SHA256

                          8660a4dd44225c06a79afb5e8015a74cd610c50c777b4b2737008d179b69dd83

                          SHA512

                          1740c646cc0b83398ff0aa6c7b297cd4882840c9cae28fbac4914617764cc21c2026539b7eaf9209fff8d3b1df89a09299021f43910c07e434060434461daa8e

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jar
                          Filesize

                          1.7MB

                          MD5

                          6b4188fce8bf2334732741b2f3c3c864

                          SHA1

                          95dfc9d9709f9b6e7fce99bc02a3bc7d1fde75d8

                          SHA256

                          46599d42d2c0b9bc6484a5b2d5a53bb5d9b238bef9c87f006acd61cc52bdb0ff

                          SHA512

                          59cbc0820e01fcf7a62675aa9bece9afd2ca20c3cca4b7033394c398e669b0b7f7ec5ac97486fecfb6fa48187b7faa0fb1fb5987e93c6a0a5e85e99b9ddda590

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\logging.properties
                          Filesize

                          2KB

                          MD5

                          809c50033f825eff7fc70419aaf30317

                          SHA1

                          89da8094484891f9ec1fa40c6c8b61f94c5869d0

                          SHA256

                          ce1688fe641099954572ea856953035b5188e2ca228705001368250337b9b232

                          SHA512

                          c5aa71ad9e1d17472644eb43146edf87caa7bccf0a39e102e31e6c081cd017e01b39645f55ee87f4ea3556376f7cad3953ce3f3301b4b3af265b7b4357b67a5c

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index
                          Filesize

                          2KB

                          MD5

                          689c0cbde7697f43642bf1134f4b70af

                          SHA1

                          307db1c4a9570f01479dea98f6b5bd33a1deb759

                          SHA256

                          6bd7ea02b9456a3730755e76d4ee1ccc04c524e93366cd74d7f42ac628d4ec77

                          SHA512

                          13afe0797d9c2c7ab8721fbedab42225b41f45059a9167c046a11e1bf6e03ad82accaed42884dff335b66ec41d3608d0d0bd06582af51634a81550c81baff2fb

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\net.properties
                          Filesize

                          5KB

                          MD5

                          8bc6628d01bad30798440cc00f638165

                          SHA1

                          fd9471742eb759f4478bb1de9a0dc0527265b6ea

                          SHA256

                          31ce7ce29c66a1696a985a197195b5e051b2c243ea83e9d1de614f0c4b4f7530

                          SHA512

                          8da3439774a07a6309f985d1a29dda5383975bbdf6b8e2809bab69a2c44f65d3de2a546231ed6e183864193f834c9a7042fdcc4ee10181d0bd3891363032c242

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jar
                          Filesize

                          3.4MB

                          MD5

                          181737fb6fbc7447670c89c22262199c

                          SHA1

                          11150f5ba9782d8550fd1a3d6eee889a0ca66da0

                          SHA256

                          9dafdd0afd9f6aab6eec3f130d0c85bf5507b8535b063e17c8fa4924773470b0

                          SHA512

                          8daad658207f9e8fd937254c453fb4be8b488cc061ce9e41df83fbd228193da9007feed3bb3ff12188c41a6b733d2851933d276d68d03f8edec3c3de602ca60a

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\rt.jar
                          Filesize

                          53.3MB

                          MD5

                          644137cf0708bdcfadd32296f28c2c70

                          SHA1

                          f42ada87824f49449a94c5e3ff1e0cbcb3d445af

                          SHA256

                          bf417af0d7b3c7894d3515371fbbb7ea581e084bc2e4acb99709aff564f2a5c6

                          SHA512

                          b438cc97a3e18635a33681c5ca8aa680fd89b40557ae5f20b3715a43dad7d96d5be57e87e01acec2f849e51fbf4cdf6e88354cdae84e3f3b9b8e1e051c3acb0c

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\security\blacklisted.certs
                          Filesize

                          2KB

                          MD5

                          8273f70416f494f7fa5b6c70a101e00e

                          SHA1

                          aeaebb14fbf146fbb0aaf347446c08766c86ca7f

                          SHA256

                          583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58

                          SHA512

                          e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\security\cacerts
                          Filesize

                          119KB

                          MD5

                          b1bbf74302a435d5ebf58da4603ac646

                          SHA1

                          619dee6611df8d50b4772bc54ddbd60480957540

                          SHA256

                          d73ef918232772b67571456746b37ac11aa4c259207336dccf2f5c5aea8879d8

                          SHA512

                          8722d1d7903274673d122e566d1dd48be68acb32fa7d5666eaec47c37183796628e5370a80a3eef99f8a4df819535a317a6f82402463da530d71f07c9f4b7fdb

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\security\java.security
                          Filesize

                          56KB

                          MD5

                          29b34fe1ee5b9329374ad1ef7587c7d2

                          SHA1

                          2fc188499d923a0fdbfa4ad93ac70699d0effaf8

                          SHA256

                          cb4819328a486176a862a35ca9ee504acb8e793bcf5ae2011e7bd89633ee6233

                          SHA512

                          45f2cfc937861863485b16f663d409890ec8d53f171cb67f356a13c2d34e7a1c8e01114dcbcc28a557a82c4cd51d2c1fcfa0570559236f5705547537a2c498a2

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\US_export_policy.jar
                          Filesize

                          7KB

                          MD5

                          12f971b6e65cbc7184701235469f0339

                          SHA1

                          06cb165157c5e0078b872c48707a1328b1dcba19

                          SHA256

                          84e035372ca8979bb4a387428a74942ffc7248a0e61988b7033b5b266cd187c8

                          SHA512

                          58646fc81de2e4750a3259d79a207a8cff2dc6692f178a63d92a453fc408c8d1088007ef4e93157d1017be706565716a0236039dbac848c40745a0ad89c4d0de

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\local_policy.jar
                          Filesize

                          7KB

                          MD5

                          109bd5e32ffeb9454bc0dd2bfdff57a7

                          SHA1

                          c3a06b4a9e24d511d6ebb5465b30083cab4a7a28

                          SHA256

                          86563bc645c5ff0e998c2bb38a75a0edb337ed188e56adf57bb51a2c5415dfef

                          SHA512

                          5a336d98c646cac2ef9499c04a29bcba55d8647d26a431dd98eb81a34cc0b29bff32dce63fc012a9b77110ba45f931911b6c674a018346916a1e12d5a6410bc1

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\tzdb.dat
                          Filesize

                          101KB

                          MD5

                          53657d061c8233bde2dc4d98918d7f89

                          SHA1

                          fe5e2734aa810c3212a5078996deb357137b61f0

                          SHA256

                          612bade1c96fd5658fc1d881405381b99124d4f548a1604ac7a869235e6f819d

                          SHA512

                          0fe2756fe720e207cc4cc3d9c82be8da96568111e79f68fef47e58a874af4a3c4b7b50745b5763a52f11e6bfc57e1043098c2156356e36b18345dbe70fa7b75a

                        • C:\Users\Admin\AppData\Roaming\Oracle\lib\tzmappings
                          Filesize

                          9KB

                          MD5

                          62bc9fa21191d34f1db3ed7ad5106efa

                          SHA1

                          750cc36b35487d6054e039469039aece3a0cc9e9

                          SHA256

                          83755efbcb24476f61b7b57bcf54707161678431347e5de2d7b894d022a0089a

                          SHA512

                          af0ddb1bc2e9838b8f37dc196d26024126ac989f5b632cb2a8efdc29fbce289b4d0bac587fe23f17dfb6905ceada8d07b18508db78f226b15b15900738f581a3

                        • C:\Users\Admin\GxOLIiZIRlJ\ID.txt
                          Filesize

                          47B

                          MD5

                          b473b4a922c8a1caef8d5c4b7bbc1b40

                          SHA1

                          39a48a135c7ce37dd4a5e01aeb6a7ec26439f99e

                          SHA256

                          34cb25d329866ffe548ef05e3571747d6ac2c949b3e16831fd0146b17c6a5fde

                          SHA512

                          8cc9ecbe1d760fc1a18d09187cfac1cda28118798960bd6372c3d14c718a8e661bae1c626a799c7d438cb69d5981f2c1fe3fc7f11c9785248cbafa989d290416

                        • C:\Users\Admin\GxOLIiZIRlJ\RiSsNdNKqMn.anCOFl
                          Filesize

                          670KB

                          MD5

                          046689b33237297e1c966538eb6ae968

                          SHA1

                          e4788f57c8dc9d6516ca4b73f7cb49ff40a90b66

                          SHA256

                          7cbeaddc814678cb1a8745a6962007f572dfde41fed0203355e1d4679f159a9b

                          SHA512

                          883a1ec508263bdf175abdca78ddf02b3e90bb5dd890859432e2df0b5cd8533b6ddae872d181a659512fc24c52060e22281d514fce2d02d821922daa9d7ef4a9

                        • memory/2632-10-0x0000021FDE4E0000-0x0000021FDF4E0000-memory.dmp
                          Filesize

                          16.0MB

                        • memory/2632-104-0x0000021FDE4E0000-0x0000021FDF4E0000-memory.dmp
                          Filesize

                          16.0MB

                        • memory/2632-165-0x0000021FDCCE0000-0x0000021FDCCE1000-memory.dmp
                          Filesize

                          4KB

                        • memory/2632-164-0x0000021FDCCE0000-0x0000021FDCCE1000-memory.dmp
                          Filesize

                          4KB

                        • memory/2632-191-0x0000021FDE4E0000-0x0000021FDF4E0000-memory.dmp
                          Filesize

                          16.0MB

                        • memory/2632-156-0x0000021FDE4E0000-0x0000021FDF4E0000-memory.dmp
                          Filesize

                          16.0MB

                        • memory/2632-155-0x0000021FDE4E0000-0x0000021FDF4E0000-memory.dmp
                          Filesize

                          16.0MB

                        • memory/2632-126-0x0000021FDCCE0000-0x0000021FDCCE1000-memory.dmp
                          Filesize

                          4KB

                        • memory/2632-129-0x0000021FDCCE0000-0x0000021FDCCE1000-memory.dmp
                          Filesize

                          4KB

                        • memory/2632-12-0x0000021FDCCE0000-0x0000021FDCCE1000-memory.dmp
                          Filesize

                          4KB

                        • memory/2632-105-0x0000021FDE4E0000-0x0000021FDF4E0000-memory.dmp
                          Filesize

                          16.0MB

                        • memory/2632-160-0x0000021FDCCE0000-0x0000021FDCCE1000-memory.dmp
                          Filesize

                          4KB

                        • memory/2632-195-0x0000021FDE4E0000-0x0000021FDF4E0000-memory.dmp
                          Filesize

                          16.0MB

                        • memory/2632-197-0x0000021FDE4E0000-0x0000021FDF4E0000-memory.dmp
                          Filesize

                          16.0MB

                        • memory/2632-200-0x0000021FDE4E0000-0x0000021FDF4E0000-memory.dmp
                          Filesize

                          16.0MB

                        • memory/2632-83-0x0000021FDE4E0000-0x0000021FDF4E0000-memory.dmp
                          Filesize

                          16.0MB

                        • memory/2632-454-0x0000021FDE4E0000-0x0000021FDF4E0000-memory.dmp
                          Filesize

                          16.0MB

                        • memory/2632-48-0x0000021FDE4E0000-0x0000021FDF4E0000-memory.dmp
                          Filesize

                          16.0MB

                        • memory/2632-31-0x0000021FDCCE0000-0x0000021FDCCE1000-memory.dmp
                          Filesize

                          4KB

                        • memory/2632-21-0x0000021FDE4E0000-0x0000021FDF4E0000-memory.dmp
                          Filesize

                          16.0MB

                        • memory/4808-154-0x000001913E9C0000-0x000001913EC30000-memory.dmp
                          Filesize

                          2.4MB