Analysis

  • max time kernel
    209s
  • max time network
    210s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 09:46

General

  • Target

    aadcef3f65e8b931a7dad5f7b18f86f391a355691a4a2ba0f74901e93ee4be26.jar

  • Size

    538KB

  • MD5

    a40813efca9067e4eab33ad05afc13b6

  • SHA1

    63e56f22421457984a0df15480efb85fb44e0d06

  • SHA256

    aadcef3f65e8b931a7dad5f7b18f86f391a355691a4a2ba0f74901e93ee4be26

  • SHA512

    2679bca34e2c8c42e34b7bbb327f2d5e0dadb2231fe711a2aeca100e23b4c44b2dee0aa78914ba1abcbf9b9ea21820cb513d68187e1cc83ca6408f289b0dbaf5

  • SSDEEP

    12288:sBcBk8d4xqem5B9Gi/cC24wROFNaXRB2ruB4l2VjKnefm3:mcBk+6qB5bGkcOwAOBB2ruB4g1KneO3

Malware Config

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • Adwind family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 24 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\aadcef3f65e8b931a7dad5f7b18f86f391a355691a4a2ba0f74901e93ee4be26.jar
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.81688150354728178812012862959856532.class
      2⤵
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1480614701193827925.vbs
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3968
        • C:\Windows\system32\cscript.exe
          cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1480614701193827925.vbs
          4⤵
            PID:1772
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2408985439420980726.vbs
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3660
          • C:\Windows\system32\cscript.exe
            cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2408985439420980726.vbs
            4⤵
              PID:4060
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe
            3⤵
              PID:3964
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3778675292478977604.vbs
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3268
            • C:\Windows\system32\cscript.exe
              cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3778675292478977604.vbs
              3⤵
                PID:3440
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1275087185606714116.vbs
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3640
              • C:\Windows\system32\cscript.exe
                cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1275087185606714116.vbs
                3⤵
                  PID:1692
              • C:\Windows\SYSTEM32\xcopy.exe
                xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
                2⤵
                  PID:4228
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd.exe
                  2⤵
                    PID:2600
                  • C:\Windows\SYSTEM32\reg.exe
                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v hwxXhmLnNjD /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\WdEppULGUiO\diplwmQFrfQ.bVvIZi\"" /f
                    2⤵
                    • Adds Run key to start application
                    • Modifies registry key
                    PID:4524
                  • C:\Windows\SYSTEM32\attrib.exe
                    attrib +h "C:\Users\Admin\WdEppULGUiO\*.*"
                    2⤵
                    • Views/modifies file attributes
                    PID:3280
                  • C:\Windows\SYSTEM32\attrib.exe
                    attrib +h "C:\Users\Admin\WdEppULGUiO"
                    2⤵
                    • Views/modifies file attributes
                    PID:4664
                  • C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
                    C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\WdEppULGUiO\diplwmQFrfQ.bVvIZi
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:3140
                    • C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
                      C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\Admin\AppData\Local\Temp\_0.75169977974645162536282673053469571.class
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:4140
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive434269222442386038.vbs
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2560
                        • C:\Windows\system32\cscript.exe
                          cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive434269222442386038.vbs
                          5⤵
                            PID:3116
                        • C:\Windows\SYSTEM32\cmd.exe
                          cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2524149462986790801.vbs
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1512
                          • C:\Windows\system32\cscript.exe
                            cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2524149462986790801.vbs
                            5⤵
                              PID:4524
                          • C:\Windows\SYSTEM32\cmd.exe
                            cmd.exe
                            4⤵
                              PID:1360
                          • C:\Windows\SYSTEM32\cmd.exe
                            cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8575360240285163600.vbs
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2652
                            • C:\Windows\system32\cscript.exe
                              cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8575360240285163600.vbs
                              4⤵
                                PID:1020
                            • C:\Windows\SYSTEM32\cmd.exe
                              cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3940492825976137773.vbs
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4516
                              • C:\Windows\system32\cscript.exe
                                cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3940492825976137773.vbs
                                4⤵
                                  PID:4384
                              • C:\Windows\SYSTEM32\cmd.exe
                                cmd.exe
                                3⤵
                                  PID:220
                            • C:\Windows\System32\rundll32.exe
                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                              1⤵
                                PID:4784
                              • C:\Program Files\7-Zip\7zFM.exe
                                "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\aadcef3f65e8b931a7dad5f7b18f86f391a355691a4a2ba0f74901e93ee4be26.jar"
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                PID:2152

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

                                Filesize

                                46B

                                MD5

                                d8e25751e1f108afb692c9a8058b62d9

                                SHA1

                                e2b3f3413e70dcf5f56c2393c3bf9dd2253a3218

                                SHA256

                                008d23cb003dc1313f63177e20fddf837ab61231e3185b66e8a9465839ab77aa

                                SHA512

                                d477beb17c0f3154819de8afc498b3062fdb92069e07f17915ae111a6064681b4a518e7b6dff5673f144a806aae62f33062e3d6cd4a6dc6e6710a7242600ad22

                              • C:\ProgramData\Oracle\Java\.oracle_jre_usage\50569f7db71fa7f8.timestamp

                                Filesize

                                54B

                                MD5

                                ddf66d9f67afff00907bf99c8e41521a

                                SHA1

                                7691f858b8a044c4a504075c496b80c1745efc69

                                SHA256

                                440001f477ee6236f27f502b334d086948aff176ef5fb4b841cc49ec29e455dd

                                SHA512

                                4775618d4395e269f3a0c8cc20399c94d792a5a424f89b2d95ce1d35debc721440f56816c830bc74f0d39da27db80708f20e79c128f4120c81247cad20cebee3

                              • C:\Users\Admin\AppData\Local\Temp\Retrive1275087185606714116.vbs

                                Filesize

                                281B

                                MD5

                                a32c109297ed1ca155598cd295c26611

                                SHA1

                                dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

                                SHA256

                                45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

                                SHA512

                                70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

                              • C:\Users\Admin\AppData\Local\Temp\Retrive3778675292478977604.vbs

                                Filesize

                                276B

                                MD5

                                3bdfd33017806b85949b6faa7d4b98e4

                                SHA1

                                f92844fee69ef98db6e68931adfaa9a0a0f8ce66

                                SHA256

                                9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

                                SHA512

                                ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

                              • C:\Users\Admin\AppData\Local\Temp\_0.81688150354728178812012862959856532.class

                                Filesize

                                241KB

                                MD5

                                781fb531354d6f291f1ccab48da6d39f

                                SHA1

                                9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

                                SHA256

                                97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

                                SHA512

                                3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1045960512-3948844814-3059691613-1000\83aa4cc77f591dfc2374580bbd95f6ba_a4172161-d53d-48af-8f36-a00b057e74d4

                                Filesize

                                45B

                                MD5

                                c8366ae350e7019aefc9d1e6e6a498c6

                                SHA1

                                5731d8a3e6568a5f2dfbbc87e3db9637df280b61

                                SHA256

                                11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

                                SHA512

                                33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

                              • C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll

                                Filesize

                                1.3MB

                                MD5

                                39a3de251306cbca47cf2fb10089ae9f

                                SHA1

                                cc3f3d1bc3ad172c9646961b18fe1d7bf98b59a5

                                SHA256

                                6d1c82cad959b7e4636d8fced4368f0f2c8da4ef609667396e8772ad8d63f736

                                SHA512

                                351a02453659d04a2943abc1da2b9541f97982ed3f94d288679dfd8d962bfb4b0dcdef9b06d329bdad64e032b0372733ff7d1577c49952accf86b971aed86f7e

                              • C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

                                Filesize

                                162KB

                                MD5

                                4e6dfd5867f4cea96dad1d59a0ca43fe

                                SHA1

                                6a08abc0b5a2cab00eb6d7543c661aa6620890a1

                                SHA256

                                179df744661b659d50fd6943834d81476287c2075448d2dc783fb32c69a00e54

                                SHA512

                                2565197c75eca66600a530aa6b033d4985fcb05edf73e096ebba37f06016e6ae5c4fc516a182bf674ff18e3f3b031353c9ff187a6b8804058b5d2b47c914e60b

                              • C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe

                                Filesize

                                285KB

                                MD5

                                dafb5fbb0614c19eccdab9bef8f89c22

                                SHA1

                                91ab91eb4a90f02c4950c3e5da80f3eb24bddb52

                                SHA256

                                af62c3850cd7a84db64bbaf68533e2769da619a8a4bccf0ac4836d2ec86e4b5e

                                SHA512

                                81cf8e04b595052e67db73454a67e2098e1df9353e2c3cc842b8ab2a9fa837b90a2101d5a097a6b0af0030869e788de1aa73ebb958f1428a3952ce0464db3e93

                              • C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

                                Filesize

                                285KB

                                MD5

                                7fb44c5bca4226d8aab7398e836807a2

                                SHA1

                                47128e4f8afabfde5037ed0fcaba8752c528ff52

                                SHA256

                                a64ead73c06470bc5c84cfc231b0723d70d29fec7d385a268be2c590dc5eb1ef

                                SHA512

                                f0bd093f054c99bcc50df4005d0190bd7e3dcefea7008ae4c9b67a29e832e02ae9ff39fa75bc1352c127aeb13afdea9bfdcc238ac826ef17f288d6fbd2ec8cab

                              • C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll

                                Filesize

                                104KB

                                MD5

                                6c720917e5c8ce1202a4141e8c8cfaf7

                                SHA1

                                1175d918134983d1d64a42047f4ff814054123de

                                SHA256

                                833cdbd7b221dda58ba728ee9a41cac1d6819d19bfc7336a4b86cc69a5af3695

                                SHA512

                                217f824b389547993556c26069d58eb956e87029b5c58556c2d308e48a0db2a02a057b3147fcf6ac7606f2b97ada33e2372112e93944f645137d81cc0dd32a9d

                              • C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll

                                Filesize

                                66KB

                                MD5

                                d8a6b5e5a33cb71b61964be369526704

                                SHA1

                                7788adf9163fb2ac2c85c43630c0998b0f13360a

                                SHA256

                                686021b000cd6d76b97c6f924c528293bc55dfb4ce936cfe70959eecd1665c90

                                SHA512

                                d15e5832d025a8fb17dd48b8c6d8246b93d54543ba52d40a9f97aff257847f7e05971ae927a77e12ab1625dc514a29115ce5fe9ddad18fe5fc4b0ddc2f8ca6d1

                              • C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\msvcp140.dll

                                Filesize

                                558KB

                                MD5

                                bf78c15068d6671693dfcdfa5770d705

                                SHA1

                                4418c03c3161706a4349dfe3f97278e7a5d8962a

                                SHA256

                                a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb

                                SHA512

                                5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

                              • C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140.dll

                                Filesize

                                95KB

                                MD5

                                7415c1cc63a0c46983e2a32581daefee

                                SHA1

                                5f8534d79c84ac45ad09b5a702c8c5c288eae240

                                SHA256

                                475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1

                                SHA512

                                3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf

                              • C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140_1.dll

                                Filesize

                                36KB

                                MD5

                                fcda37abd3d9e9d8170cd1cd15bf9d3f

                                SHA1

                                b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2

                                SHA256

                                0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6

                                SHA512

                                de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257

                              • C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

                                Filesize

                                8.5MB

                                MD5

                                dceeb4fb6af9bb2ea7a2eed1d921afb5

                                SHA1

                                af1463a499f7d6eed5efcb9c9515e82335e9c1b6

                                SHA256

                                6707043f0b609a0b3677cd11f6526d8ecfcbeab079a394019d648c9039e7da21

                                SHA512

                                e4688d2264dda88e90beeb394adc48064012ed458ab9015ecef744a86ab76b4f65845f77a3d02b131aa5c342e6a572f79f471b5dc8df178b2d7483c04b1f4763

                              • C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll

                                Filesize

                                142KB

                                MD5

                                2632b6d90868ff1ece67f76b86a23d79

                                SHA1

                                90ddedde02a4cc37ae361caabc36a6a686c24bd1

                                SHA256

                                86106645d9e3801911808d6343a7fead7b6e9d8b740bad63a4cd9851ff599283

                                SHA512

                                61e0581c3dde45db74383b93e56396c65435714e746fe4f000c53465e8e6750bd787b5895a987bbdbe4badb5ad3570394c82476c2b4d65099f0b923002153b18

                              • C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

                                Filesize

                                55KB

                                MD5

                                82bb3a2292372acbf8bb25e30a3e169c

                                SHA1

                                c09c134561213cd67c670f60a2c52cf947e51a74

                                SHA256

                                9c99e6591c73eda0dfd6bb9a55d0a175cf5bdb583115477cedc627fd793c3deb

                                SHA512

                                db4802fe0e3a6dc1678765af559e9c1f6e8639dd5c7c8f18f08296b1b4d15cfe748e391459253a3dde0ca2bda74c6772af262e5b194c78c6bdefbcc2c5377db7

                              • C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

                                Filesize

                                87KB

                                MD5

                                0d56a7ff632826362768b3edd5e5174f

                                SHA1

                                8b96856f8fe3175039d1a7cf3ac0910467844a08

                                SHA256

                                27cf17beab60d7f9a62aac7622eefa06eee78796db585f9ae5d3a5b5022d56a9

                                SHA512

                                b4fe51874b9ba7a2325ae3c0b96f32065f7cee7c846a9028495070f1f91cedd9445cb91248acd1ec134a72b2c07e49afcaef01b58af1dfb0ff417033c2d0e595

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\accessibility.properties

                                Filesize

                                149B

                                MD5

                                2ed483df31645d3d00c625c00c1e5a14

                                SHA1

                                27c9b302d2d47aae04fc1f4ef9127a2835a77853

                                SHA256

                                68ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf

                                SHA512

                                4bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg

                                Filesize

                                634B

                                MD5

                                499f2a4e0a25a41c1ff80df2d073e4fd

                                SHA1

                                e2469cbe07e92d817637be4e889ebb74c3c46253

                                SHA256

                                80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb

                                SHA512

                                7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\charsets.jar

                                Filesize

                                2.9MB

                                MD5

                                bfdb22624544f02100cd37cff954f64c

                                SHA1

                                f699b290845f487cb7050d41a83b85446ea202b1

                                SHA256

                                04a6bc7af4d41fda5ca6c7584df50c5d0881fada89b4788e8ee4e5919345f143

                                SHA512

                                70c5f501c5e1cc67341bb3f4d190179a79fb8bee7292ff8cca0749368ae4475387ce121e8d33adc7e4e6fad5a10eab378fff17e3da0422d4cca0837c95574b95

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\deploy\messages_zh_TW.properties

                                Filesize

                                3KB

                                MD5

                                880baacb176553deab39edbe4b74380d

                                SHA1

                                37a57aad121c14c25e149206179728fa62203bf0

                                SHA256

                                ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620

                                SHA512

                                3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\meta-index

                                Filesize

                                1KB

                                MD5

                                005faac2118450bfcd46ae414da5f0e5

                                SHA1

                                9f5c887e0505e1bb06bd1fc7975a3219709d061d

                                SHA256

                                f0bce718f8d2b38247ce0ac814a1470c826602f4251d86369c2359ff60676bd8

                                SHA512

                                8b618c74b359ab3c9d3c8a4864f8e48fe4054514a396352a829a84c9b843a2028c6c31eb53e857e03c803294e05f69c5bf586e261312264e7607b2efd14f78a9

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunec.jar

                                Filesize

                                46KB

                                MD5

                                1227482c65dc231e3607b002950f5497

                                SHA1

                                709ff3738d5da8db225818df2966f04c13cb7d02

                                SHA256

                                cfe84c5292f9ddef96fecf118377565bbaf769eee7ff4cca81652fe1134f9809

                                SHA512

                                87c4f5fa1e6dad6f2fab8a0371380fa7be9f63b05f8ff6740a4208ec115f8db9c512de9e40b4b853be35effed2804d0774c0e9426571a129cb6bdecd527cdb8c

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunjce_provider.jar

                                Filesize

                                287KB

                                MD5

                                456031723ebc7270d9bc3747cdd6daa2

                                SHA1

                                a4a61bb10ac83f201854a11750aa86e7dc8da41b

                                SHA256

                                324499cedd3f19ea621a38f42834369d7da8bdf40fcb5a345007bfa2e5987780

                                SHA512

                                b425eabd590f905aa147720aa507a0da2b31199956f21137a722fe6c8de05549d1cddbb2fb2ea1cbe34e39ce9d0eabb0502dd2a9a09f72dd87cd002765537079

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyNoDrop32x32.gif

                                Filesize

                                153B

                                MD5

                                1e9d8f133a442da6b0c74d49bc84a341

                                SHA1

                                259edc45b4569427e8319895a444f4295d54348f

                                SHA256

                                1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

                                SHA512

                                63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jar

                                Filesize

                                119KB

                                MD5

                                e0b7e0f36b9fc43d13403145db82e758

                                SHA1

                                def42078cfa315e98393c69963efb4e35e2e28a8

                                SHA256

                                4362c179bb78107777d6a0557693e65eb2b318c26642162f89509dfdab8c97fe

                                SHA512

                                5074a7ceb9621096f3bbf419d32ac260ea6d9d09c758544c2761121026c2b9db0b6617806d3b692347b685d541123f4eda99dcbaa29d9c9a2d740b22c44bf7bb

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\jfr.jar

                                Filesize

                                560KB

                                MD5

                                530b1ee313390d5d51ae8f5aa0be9070

                                SHA1

                                d5de5ee8bd7275b5b20f466ba0869251679b24b3

                                SHA256

                                bded3bbadd255c856ed7fb9900cbf0445e980a669a3aa043cf095e18539eb48f

                                SHA512

                                50671ca7de240c38921849304ae482a52ae481d0ff5a2f02aef90c20b9f49842bf2ea32b9caabde57a955b8d638a017b6b3cdd662b679a2d743e029f97b88937

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jar

                                Filesize

                                1.7MB

                                MD5

                                01408480f5c65da8c74ecfde0eed1a72

                                SHA1

                                2f1cb5df6d4879de8b0827d160e9bb281f829a3a

                                SHA256

                                fffafe7e2bacef79280a4565b5d1075320a8ec38dff7978c8fe6c033b6df49d0

                                SHA512

                                ae585f4825073da19f611bb7d11a1d075b4998bc3f7d53a67cdba778e0729e0b5134ce8fc49897f67d39e46f1209524ab53ab4551defc6a4127012e332f15d61

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index

                                Filesize

                                2KB

                                MD5

                                91aa6ea7320140f30379f758d626e59d

                                SHA1

                                3be2febe28723b1033ccdaa110eaf59bbd6d1f96

                                SHA256

                                4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4

                                SHA512

                                03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jar

                                Filesize

                                3.4MB

                                MD5

                                c5152884c2676dd45109cfeba088a549

                                SHA1

                                8fe4fd1980bdc4139491b0dd963eb830b70bb8d6

                                SHA256

                                65a6d0d74b193af857dd5252d59e8bf9214ddb360b26c1da816b029bf0cf208c

                                SHA512

                                ed8d4777609024960a7037f42937de41c434df4ff7062b43f03f0060e326bdef7917e941c9d3db5a8ec7a65f4890ef3dd53c87401f9568e6f068f2930d558e61

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\security\blacklisted.certs

                                Filesize

                                2KB

                                MD5

                                8273f70416f494f7fa5b6c70a101e00e

                                SHA1

                                aeaebb14fbf146fbb0aaf347446c08766c86ca7f

                                SHA256

                                583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58

                                SHA512

                                e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\security\java.security

                                Filesize

                                55KB

                                MD5

                                8f0e3440fffdbcaa9d26be4730492a66

                                SHA1

                                20a3e5a8ecbec20d41d7124120d264f61de96613

                                SHA256

                                b5e8205764b83f46b50187b2021de7c86a890df908a8d6c17275a68924f832c6

                                SHA512

                                c04528769ce780e730ef71803ca8191c217f571f62703daca273499b90e93101383a3699263458c205cd7a8733399c3c2ca6afc85b6843c2c5e2ba0890e762cb

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\US_export_policy.jar

                                Filesize

                                3KB

                                MD5

                                6cbca5808b4a8613d2fed6fe4a84c449

                                SHA1

                                0135b30ebec03fb69d79cdc3126e608d9effb8b2

                                SHA256

                                761aab2969883e9e5ea76df63ca404fb67673efc3f97def057f8e22517fc9518

                                SHA512

                                4d9bf052aa124d07673c601cbfb83223b87369f7be7575a13e13c0d893e57849ba11e430b7769901782c26471528dfaa130996916451e1a7e38cf28468e44cfa

                              • C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\local_policy.jar

                                Filesize

                                3KB

                                MD5

                                360663f26c5584e6c6127254b261fa0c

                                SHA1

                                aee6515eede2ad7c697ba8a61bdd9359be3319d2

                                SHA256

                                02f69a433405ea928c89a8aade74e5462282ccb9a9d30851312ed3459398f85c

                                SHA512

                                e3920d5abbbe6b0e3029ed1e0b2ce1a53da6c7e728f635b12f00b1fd2eb6151fff74b9dc85ec0c0920f7fda440c1604d24ca766cdbcb78be3425088d97e00208

                              • C:\Users\Admin\WdEppULGUiO\ID.txt

                                Filesize

                                47B

                                MD5

                                d9a1422cb07bd3d7b2da978e91427768

                                SHA1

                                a71af98d9b2df4414c52784786a8cf25bb07b51e

                                SHA256

                                97665e8057993bd88c7db7e75e5b993da452ec88624d76f9078906051e817188

                                SHA512

                                609257b439141409b3460c72414e1df5b9cf89be12941cb2d88dd9626ee3b13488659dc12c5f5032addce7357a64619f68f9c1eb6229d54c4256490abc997edb

                              • C:\Users\Admin\WdEppULGUiO\diplwmQFrfQ.bVvIZi

                                Filesize

                                538KB

                                MD5

                                a40813efca9067e4eab33ad05afc13b6

                                SHA1

                                63e56f22421457984a0df15480efb85fb44e0d06

                                SHA256

                                aadcef3f65e8b931a7dad5f7b18f86f391a355691a4a2ba0f74901e93ee4be26

                                SHA512

                                2679bca34e2c8c42e34b7bbb327f2d5e0dadb2231fe711a2aeca100e23b4c44b2dee0aa78914ba1abcbf9b9ea21820cb513d68187e1cc83ca6408f289b0dbaf5

                              • C:\Windows\System32\test.txt

                                Filesize

                                246B

                                MD5

                                3fce4726dcd4ac6ac23ac3c0bce051f8

                                SHA1

                                d89bc07f9dee52fea3809b8470bea73d196e3356

                                SHA256

                                6c2bd85a292a743fb4e5bed34c477bf7371f8d1bfc215ebcc50f914488b664ab

                                SHA512

                                c93c419d248c19a62f27028a9e278640dee664a2f8a11d4d8081f2e8cbadf6f084023ff56b9608a53c400cc84f98483c2f15c3a79c5e5525c83a91fcb0fbc481

                              • memory/1116-113-0x0000027D5B7D0000-0x0000027D5B7E0000-memory.dmp

                                Filesize

                                64KB

                              • memory/1116-1187-0x0000027D5B7C0000-0x0000027D5B7D0000-memory.dmp

                                Filesize

                                64KB

                              • memory/1116-1197-0x0000027D5B7D0000-0x0000027D5B7E0000-memory.dmp

                                Filesize

                                64KB

                              • memory/1116-1213-0x0000027D59D50000-0x0000027D59D51000-memory.dmp

                                Filesize

                                4KB

                              • memory/1116-1009-0x0000027D59D50000-0x0000027D59D51000-memory.dmp

                                Filesize

                                4KB

                              • memory/1116-49-0x0000027D5B540000-0x0000027D5B7B0000-memory.dmp

                                Filesize

                                2.4MB

                              • memory/1116-119-0x0000027D59D50000-0x0000027D59D51000-memory.dmp

                                Filesize

                                4KB

                              • memory/1116-100-0x0000027D5B540000-0x0000027D5B7B0000-memory.dmp

                                Filesize

                                2.4MB

                              • memory/1116-1016-0x0000027D59D50000-0x0000027D59D51000-memory.dmp

                                Filesize

                                4KB

                              • memory/1116-768-0x0000027D59D50000-0x0000027D59D51000-memory.dmp

                                Filesize

                                4KB

                              • memory/1116-107-0x0000027D5B7C0000-0x0000027D5B7D0000-memory.dmp

                                Filesize

                                64KB

                              • memory/1116-106-0x0000027D5B7B0000-0x0000027D5B7C0000-memory.dmp

                                Filesize

                                64KB

                              • memory/1116-1186-0x0000027D5B7B0000-0x0000027D5B7C0000-memory.dmp

                                Filesize

                                64KB

                              • memory/3140-1183-0x000002171F790000-0x000002171F791000-memory.dmp

                                Filesize

                                4KB

                              • memory/3140-1167-0x000002171F790000-0x000002171F791000-memory.dmp

                                Filesize

                                4KB

                              • memory/3140-1230-0x000002171F790000-0x000002171F791000-memory.dmp

                                Filesize

                                4KB

                              • memory/3140-1192-0x000002171F790000-0x000002171F791000-memory.dmp

                                Filesize

                                4KB

                              • memory/3140-1135-0x000002171F790000-0x000002171F791000-memory.dmp

                                Filesize

                                4KB

                              • memory/3140-1091-0x000002171F790000-0x000002171F791000-memory.dmp

                                Filesize

                                4KB

                              • memory/4140-1182-0x000002122E2E0000-0x000002122E2E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4140-1202-0x000002122E2E0000-0x000002122E2E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4140-1208-0x000002122E2E0000-0x000002122E2E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4140-1201-0x000002122E2E0000-0x000002122E2E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4140-1209-0x000002122E2E0000-0x000002122E2E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4140-1196-0x000002122E2E0000-0x000002122E2E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4140-1228-0x000002122E2E0000-0x000002122E2E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4140-1188-0x000002122E2E0000-0x000002122E2E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4140-1159-0x000002122E2E0000-0x000002122E2E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4280-1012-0x00000202003A0000-0x00000202003B0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1065-0x00000202003D0000-0x00000202003E0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1013-0x00000202003B0000-0x00000202003C0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1014-0x00000202003C0000-0x00000202003D0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1010-0x0000020200390000-0x00000202003A0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-784-0x0000020200380000-0x0000020200390000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-397-0x0000020274080000-0x0000020274081000-memory.dmp

                                Filesize

                                4KB

                              • memory/4280-124-0x00000202003F0000-0x0000020200400000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-123-0x0000020200370000-0x0000020200380000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-112-0x0000020200350000-0x0000020200360000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-108-0x0000020200340000-0x0000020200350000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-109-0x0000020200360000-0x0000020200370000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-83-0x00000202002E0000-0x00000202002F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-89-0x00000202003A0000-0x00000202003B0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-90-0x00000202003B0000-0x00000202003C0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-91-0x00000202003C0000-0x00000202003D0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-92-0x0000020200300000-0x0000020200310000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-101-0x00000202003D0000-0x00000202003E0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-102-0x00000202003E0000-0x00000202003F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1048-0x0000020274080000-0x0000020274081000-memory.dmp

                                Filesize

                                4KB

                              • memory/4280-1060-0x0000020200310000-0x0000020200320000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1059-0x0000020200300000-0x0000020200310000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1058-0x00000202002F0000-0x0000020200300000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1057-0x00000202002E0000-0x00000202002F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1056-0x00000202002D0000-0x00000202002E0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1055-0x00000202002C0000-0x00000202002D0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1054-0x00000202002B0000-0x00000202002C0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1053-0x00000202002A0000-0x00000202002B0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1052-0x0000020200290000-0x00000202002A0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1051-0x0000020200280000-0x0000020200290000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1050-0x0000020200270000-0x0000020200280000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1049-0x0000020200320000-0x0000020200330000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1064-0x0000020200000000-0x0000020200270000-memory.dmp

                                Filesize

                                2.4MB

                              • memory/4280-1067-0x00000202003F0000-0x0000020200400000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-1066-0x00000202003E0000-0x00000202003F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-2-0x0000020200000000-0x0000020200270000-memory.dmp

                                Filesize

                                2.4MB

                              • memory/4280-103-0x0000020200330000-0x0000020200340000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-99-0x0000020200320000-0x0000020200330000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-93-0x0000020200310000-0x0000020200320000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-84-0x00000202002F0000-0x0000020200300000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-85-0x0000020200390000-0x00000202003A0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-79-0x0000020274080000-0x0000020274081000-memory.dmp

                                Filesize

                                4KB

                              • memory/4280-78-0x0000020200380000-0x0000020200390000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-77-0x00000202002D0000-0x00000202002E0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-55-0x00000202002A0000-0x00000202002B0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-58-0x0000020200340000-0x0000020200350000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-59-0x0000020200360000-0x0000020200370000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-60-0x00000202002B0000-0x00000202002C0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-68-0x00000202002C0000-0x00000202002D0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-69-0x0000020200370000-0x0000020200380000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-61-0x0000020200350000-0x0000020200360000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-47-0x0000020200280000-0x0000020200290000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-48-0x0000020200330000-0x0000020200340000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-50-0x0000020200290000-0x00000202002A0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-39-0x0000020200000000-0x0000020200270000-memory.dmp

                                Filesize

                                2.4MB

                              • memory/4280-40-0x0000020200300000-0x0000020200310000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-41-0x0000020200310000-0x0000020200320000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-42-0x0000020200320000-0x0000020200330000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-43-0x0000020200270000-0x0000020200280000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-28-0x00000202002E0000-0x00000202002F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-29-0x00000202002F0000-0x0000020200300000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-25-0x00000202002D0000-0x00000202002E0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-23-0x0000020274080000-0x0000020274081000-memory.dmp

                                Filesize

                                4KB

                              • memory/4280-22-0x00000202002C0000-0x00000202002D0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-20-0x00000202002B0000-0x00000202002C0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-18-0x00000202002A0000-0x00000202002B0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-16-0x0000020200290000-0x00000202002A0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-14-0x0000020200280000-0x0000020200290000-memory.dmp

                                Filesize

                                64KB

                              • memory/4280-13-0x0000020200270000-0x0000020200280000-memory.dmp

                                Filesize

                                64KB