Analysis

  • max time kernel
    68s
  • max time network
    146s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/04/2025, 19:37

General

  • Target

    63d855658b466365a24661d02f253577d4339f1ce8f7a0ae48341b34603d7e1c.exe

  • Size

    63KB

  • MD5

    e18f648682aefe8a256079fa8de0f4fc

  • SHA1

    143819f96aba2667775f72f113e50e72a3120cf4

  • SHA256

    63d855658b466365a24661d02f253577d4339f1ce8f7a0ae48341b34603d7e1c

  • SHA512

    20a6fa78743e32824af20b1c205045b81d2ac5afc59b8efc5342a6537bef268dea456ef41f949fb428f09162c1535da56800eea3048097695eb343f03f69ae7f

  • SSDEEP

    768:VFIsjMcAON78aHC8A+XuqazcBRL5JTk1+T4KSBGHmDbD/ph0oXS9yLMQqSuDdpqM:IgAOR9dSJYUbdh9S9yoQduDdpqKmY7

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:3232

127.0.0.1:45518

summer-malaysia.gl.at.ply.gg:3232

summer-malaysia.gl.at.ply.gg:45518

technical-equally.gl.at.ply.gg:3232

technical-equally.gl.at.ply.gg:45518

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Renames multiple (1268) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Start PowerShell.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63d855658b466365a24661d02f253577d4339f1ce8f7a0ae48341b34603d7e1c.exe
    "C:\Users\Admin\AppData\Local\Temp\63d855658b466365a24661d02f253577d4339f1ce8f7a0ae48341b34603d7e1c.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\kqwguk.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4380
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\kqwguk.exe"'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5716
        • C:\Users\Admin\AppData\Local\Temp\kqwguk.exe
          "C:\Users\Admin\AppData\Local\Temp\kqwguk.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2416
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:5480
            • C:\Windows\system32\reg.exe
              reg delete HKCR /f
              6⤵
                PID:2908
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E8
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1016

    Network

    MITRE ATT&CK Enterprise v16

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

      Filesize

      160B

      MD5

      433ea3ba924e417f5957318a71884ace

      SHA1

      a4d3efc3d4a5504b1820ca3c0d2453b67a036197

      SHA256

      82c3f028979b2b8f90c3df3250b6c8eb87ba5504a4efaa7397a740c6466a6942

      SHA512

      aab0edb72f62dde5c3feee06b32e5981476ecb6c871dbdabd2db9a4be5f7ff676da644853809888b21d4bfb3da8c96f92e115540c5f3e344615b5c20398918ff

    • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

      Filesize

      160B

      MD5

      2b49f0ecf83bd094980e574d09b56f84

      SHA1

      79cad901c2e92726df952504290152cb441bc4b5

      SHA256

      ba1208d4ea6ffd9c58b8dcebad459e217ba42059c4e695f5d6b6864e54d49453

      SHA512

      a28f1c552b2d818608b1682b3e35683f04b51939ead294192152f229a4b60eab771ec0ff70eeab2d57d6cbf7083c6009aa7e23138f308ce29212f688de712dbe

    • C:\Program Files\Java\jre-1.8\COPYRIGHT

      Filesize

      3KB

      MD5

      46e39c13ffbbf6e86cc8dc63f347aa61

      SHA1

      c5ccdcbb1a0c9d94fea7f7af73f6a6d089a0e56a

      SHA256

      02e84b2aec8427a21c1a213e5e518a3dc0c38b2aa15ea4a1e23dcbdb4c1ee401

      SHA512

      d0067e8d9af291b2e1d73cd8d8c417449604a9c15a38846f1b93232a6c765f32da5330443ba4a297ac059abbd4474a0ca8473fe50ee984020ad918a5a8befaef

    • C:\Program Files\Java\jre-1.8\LICENSE

      Filesize

      48B

      MD5

      9676d8dd2bc6954519c935d6a5057628

      SHA1

      2ba42925bd22ee2c2e0bc42c3156d2db5a185002

      SHA256

      6baebcc1e2910596143539f276f972855ffa2b0199331cb43811676c1ad4f600

      SHA512

      5088d392a12ca47216d3128d054f063f6deeeb0ac55ca038a25170d70f25b03b2a36842a8175a2d56d18aecaa6f9f4f6b4c91386ce58305eb92e246ba60fe999

    • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

      Filesize

      192B

      MD5

      b3a9933e06c619abdd186779de36761d

      SHA1

      4cbfa7547b0a6508e85102973bdc731de5975eb9

      SHA256

      ef09b2df67c7fbbc1b03b754855db3cf2711374e0b416e88c45ae3f635942a62

      SHA512

      2bc8c37bb45cad8841af758105e3171e17926a52a5f6ecaa2bcf12755d17d36ca903c36a5620291d57df8ba47f76de0dbb354364f44f81593168d366bfbfc815

    • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

      Filesize

      192B

      MD5

      0868690b9838641af23174b962cc6429

      SHA1

      f82646dd74fc7759ec91f14bed28a39db239068d

      SHA256

      bd919ee6ea5a415778f1e75bc1531ae4ea612eaf025bf760c7214fd5867a2be7

      SHA512

      34d9435c54daede06ab84bfdf343db2b7855cfd9f89c403a844e04c56cab89094cf51c660ff2d64337bd9ab0a533cde2bde40aab3095509d0242bdc87c4a838a

    • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

      Filesize

      1KB

      MD5

      26ea9b7c9bc3a07305b0e9441f392ba7

      SHA1

      166628ae714f8215329818583f1e335f494a56db

      SHA256

      a1d6df5e4f2cde6604dce5116b323413669f4645a4053ec2a9905bf491da1ee4

      SHA512

      b39a1460cee66ecace030f7b065b34b04d4379126555e687f382f7041452793feb3950b7dbe3ccaf5d0ad8eff18f1f5e9637bc2bd151b44a7e6903faaa96376d

    • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

      Filesize

      31KB

      MD5

      2a693b6f07387e57c1d71c1bd7d1472d

      SHA1

      454d9e2863da902a760487f681e19f93baeb15cb

      SHA256

      af474b6497a8928391cd9f7620eecf91969cafee696702cdd2619cc3ddd1dc26

      SHA512

      85a9016edba6c9364e567c363bcef3f6ed13e97217c152ace7acee3340d6133a9b02b9f6fb90ad9f4e10cd3e333d42053f2a8015bae044afe30ec3e3928434af

    • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

      Filesize

      34KB

      MD5

      dfeb7e4d4fd545cafd9613e49f287e80

      SHA1

      3e2c40ccd0780abd0ba95506935dfa9613776435

      SHA256

      98d523405717bd079f727346daa516c5d7344eb0e2f040466a3bc3d5b227952a

      SHA512

      e2adf07ef21136cb5d93e0314a81b345ac57f5404cef143cbe55b89a5e490e4a3a5aac4cfbde7c8ce792614d0de464fc0742bdf04f81d8f7ca88fddc0cb2a504

    • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

      Filesize

      23KB

      MD5

      68ef0b36e70ca982f59b2fd245c95cc0

      SHA1

      7e47764f8f8cc44f88819d7b121a0352db73c9a1

      SHA256

      2430581a6f575b9b1fd9ae8f2559271939b210bccbd4b7da78e0566731d6d36f

      SHA512

      f76188809e61ccbb3b068113a93a439ffb6189412dd70c785efd487bc4da6c9463f043a5834da856a84e8733763f4602f11ef5f32bcec680634c6a0d99909a9e

    • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

      Filesize

      2KB

      MD5

      6cc857c5c89b7a2d408be810116cff32

      SHA1

      3def9c80fa260a6f978e59e564ca20ba22434bbf

      SHA256

      b0c9471f4fb19d0fd3929900b35fc2a874d3798564721b25a192f8e59ccc85f9

      SHA512

      6ff342a664655e033d08336a1c62507e03400c9b11b8c819449c5812e29d94854b4bbdbb8d8fe6ac5bfa34e6df7f9bce60d081dd924f1d5f0d72b83df0232e09

    • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

      Filesize

      1KB

      MD5

      11993d2acf360d97eb9d7492ebf7d5b0

      SHA1

      0e8866c4cfb1f3cd95e443362d516d5be5e1e71b

      SHA256

      c418b67d9f85c3bed151d8ba4d9d4d0ebe978c867dc385b06d40ced7e89c8628

      SHA512

      340e63f5b93264fbabf2051435801cf13547919e2eaeddff5ca76e2ddba7c6b94cc9cffc966e14a717cd7e13c739661dbbe5e12121a0373a0501885b2c4cbbf8

    • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

      Filesize

      3KB

      MD5

      280b96589182598b4e50138a394c6c5c

      SHA1

      2245c45e4ddded18b58ed12f713398fa0563d527

      SHA256

      2e22e5192a17ce03f9844a83d42c4a9aec3b0cf6eacb9241e6418cddcad03e41

      SHA512

      55fe90ac1596e1ed5458f341fd303fc560849310d5d146c8003951fb88df0a222835c407f16a9a1ab378ab2eba56e675f48d60d0c405cfa9dc65c2ec78c8b398

    • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

      Filesize

      1KB

      MD5

      f3c899bdcc3dd921f769502b05588b45

      SHA1

      1f794e371edbdb273a4aa0b590f52e27167a5c8e

      SHA256

      895c6b3397a1b84836a21967502e33f125d845223459372d7c6c66ccd705deea

      SHA512

      20b46ccaaa8cd8da80301e3019f63888e398f3adef2efef6c22324aef4a29d7b7ccc2230df8981c169a7f8c40e73e305c9c2a1006d3db1b34d46e9323a82b5ce

    • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

      Filesize

      3KB

      MD5

      8c6f34b2814f940e0236eae2e26dda2d

      SHA1

      015670f2c82ec8d6f9817f9672778188156077f0

      SHA256

      d1e75fff4c310a434cb988264ec0f75444e39352d261df7c3b6b77a3e4d2241e

      SHA512

      029351b5bb2bbafa9e3a5c951f663341705761864fde5ed03e45318a1978a270ad219c4c900302091d46043489cac3b630ddf06067cd864480160031e28df075

    • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

      Filesize

      176B

      MD5

      3991cbdbe4bfe0a85c32bcdbd6561ed3

      SHA1

      868ee5e67cdb6d95b43dffae73b6178798f03360

      SHA256

      5c1464ea622737adb105600edc608a01b14db60e073da87b37393f8883a9a4d8

      SHA512

      c8bfa5047d90f185108127788df3ea00a4042e985e7559b63b818ba752223d46923c917c43b3f87940f5991526d2d8b01bf19da2164d60be358bf97424820c1a

    • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

      Filesize

      3KB

      MD5

      4f133785eafc5a5cac5e4ec5dde3b3f5

      SHA1

      b0fe0444d25f399261d79d6ebba62f2233f0cca8

      SHA256

      cb261c23d29e0a46b2283853b2e2da80cf445a0adb1f0d86c1a43665e63c237a

      SHA512

      76f5c155c8e32ff2d991174ddb899f9c2c026a8b0b1ad389eaf6b2bb7c705c01f46903bc924b9f0e38711f72e349001d44c456387a0e2bd32e1f0089308da1ef

    • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

      Filesize

      1KB

      MD5

      4e0c35c0eb7d0076c9ba9debdcb80132

      SHA1

      13170d5c5b8328bfebea8558317318bf7b43e287

      SHA256

      3ab3930b9b8c349c391df16c6678459029eb757beae1306b800089e7b7bd8a55

      SHA512

      18b8badcf4d930bc26960d340294c609da123f8b8159c1c75d516712a5f67336cda7811ffcb289ae8d3c0bdc24ddf3006c99065c162a83c0e2647d26373b580b

    • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

      Filesize

      2KB

      MD5

      475f7e68fd6cfc5e6ad9f8e285a1d36a

      SHA1

      65a779a83b49dd265ef26af3e74ee566eb41ba35

      SHA256

      62c638b361c40949458f5c620c330d5c7b3220f52bb066c31d736dff4c4acf5f

      SHA512

      f8d818951131124f151666ff906b05a4f24b90658814a3044e71f03436af288abc190fa812cc19363311b02cb3222edc0b186cf85ed00362f244af048f0db731

    • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

      Filesize

      1KB

      MD5

      4f74120ccc0646e56ce61bcee68c5a1e

      SHA1

      784a4849f5b6e5d51d6e39066f688a445464f35b

      SHA256

      8c907d946e2b6d5fee22822509a1835a756d24f98165f5e4e0f0f7e773a860ff

      SHA512

      dd6d4cb34ddd317d9244538a64b7e07e19040acde28f1dcf2bc4b7136bb1f9b915a36f45a22ebe3260b1a412bf4aea2522b6413bca71e1a911f3d8c3d0e33cdf

    • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

      Filesize

      2KB

      MD5

      ec8c53a9ca251f836b6264c76fbbe51c

      SHA1

      bca5a2c71212749990fe080c5a3e45ab0175931d

      SHA256

      ac51c2ca0ab1534ff6969bfb5a15233347efeab975047cc868e3700203f091e4

      SHA512

      16376e9229c66368741ec4248eaf44990ac7eb8eaa6c4711eef7d4c8c3f8f8ff386011dabe99e515d90ed88a733a679385e0c22b70995b5e5c4298ab4c3b9df7

    • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

      Filesize

      1KB

      MD5

      bcd2d4427406d364f7785da462709fbb

      SHA1

      55dfee6d1135191d9204516e09d3d0ffe446e9e2

      SHA256

      41ffc02dd567a520673433c34aaf9470eb791e54d3ed21e7b1d884eab2e7029b

      SHA512

      1c16fd68e636a7fe53b29b3b19738d231fc212475dc8d6d3254508084964306334098d0cfbaa0f6740e03da767f20603841db09c011cbe58a87858cb28b71911

    • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

      Filesize

      1KB

      MD5

      3cab13640c10e82d148ba6790d4fccfb

      SHA1

      3ddf65cdf3c57c83021346af9bc8ce8ea1abe67e

      SHA256

      9cb2cf023366e9f28878ff6e8586a395628bf3735e9865e27da5bd7eb3760855

      SHA512

      8fb2242ba81c246233670d7a8dc3bd690949bb92974e79ff3b257ff84b1461c085435fb713563ac4729ca02e97246cd6c85f3a05251a72ff66662226919c2076

    • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

      Filesize

      3KB

      MD5

      46fd08b24b3bd583e52de60e2788a836

      SHA1

      46384acb4b6b5ba03fe0278b3d3cef4d50ffc76d

      SHA256

      8a4d2a2d6db7439a5a12aa6e09f8f0eac81865e1e239ce6150cc21cf821b8906

      SHA512

      e7fedf9add200657937c2a26d331ab4e3fc9936bb5d83c4d8c6a0725bd4cbe41df90b0f71010f06951853054aa549cdb24b2c592e0d4d793a3bcc5df3fe3cf7a

    • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

      Filesize

      2KB

      MD5

      222dbf2276d61ca6dd89d2d24ac4fbb9

      SHA1

      75e544b4be88e1b2b48faf553daa65b73426d6e7

      SHA256

      3046433349e22596aebe5d80531ae71ac6521b5f788f869fb046553eb905f2de

      SHA512

      c2622e938355ae41a26357bf09e78729af3569e8e2d16d6d1b70418ee228602b02883b1659b011dc679aa3defbaeaceb883cdaf56adf3bb29adb9748771f4154

    • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

      Filesize

      6KB

      MD5

      c246c2ff65021ba3d9cf60e783226423

      SHA1

      efe9a8d898fd3a542b809f4ec2683d61c14b55f1

      SHA256

      3ba7302a4e8dcc88e44044f1c0830d8bebebcfd3429615e3286e08dfe10b3147

      SHA512

      1506bb9c030577a3291f1fae5980850990feb3f99a4c53609dcebb988945cd07a3c3ed73141fe610525423aeee791334a42575e836a29ebb18aa9c7c707fe9b9

    • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

      Filesize

      5KB

      MD5

      a839427ef5ca46cd93aae275b9fbe896

      SHA1

      3690ac79bbdce24d5e77a8fd24bff28350c7e231

      SHA256

      98f5a6bd70132eeb77051b07745fa1019373a159fdb78604b4ab1230fd5b6cd8

      SHA512

      7ec14c45aa093ecf0df0953bfd06ab13f627561eeab44fe4109e122ca234213d21c0c390008e0c8a9596fe76aa4321ede111a211450ac377f1df7ddc36bf337b

    • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

      Filesize

      3KB

      MD5

      de0ec498e4edfe772e08fdfc75042e80

      SHA1

      6a143843894213152f631d7540284168a66b98b5

      SHA256

      ba6a2e00063156047e6886562cc3df75812b239f3461866716b611f880181580

      SHA512

      3ed6dc6862d59b13f00a209f57a3923ccd627376614c393809516dcf3fa74be15e22c1c8af6763b04c0eba5b08b12c5ade8ea599e9a9deeb204eb763ef611b99

    • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

      Filesize

      2KB

      MD5

      9e896f3df1a1ba13d388f5a5080af715

      SHA1

      016c6b552e5069646a3b9a1a0a459b5ca223ae32

      SHA256

      bf499398af5790ff3009570c6d1824f8bab265dd2e93518a6315cbc52255d8ff

      SHA512

      c2a9071de737b4b29f90dd37fcd75cc94e46c20bc0b51872df7b7b5b6c790bfb3ebca5aeca6957f7a67d9f97c619980a5729dac7db79cf980ba245aaf4369bf5

    • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

      Filesize

      2KB

      MD5

      e4c4cdfc1e5f9f3a9421d0560d5f15f1

      SHA1

      cfffec116d7aba89c0b378f8f165ceac0b1bbbc4

      SHA256

      a6a3bb8a048e1b9c0c74d4909799093d8bb387705d5a2c73bcf4cfd866b7955f

      SHA512

      bb4fb3fe61fd4efea2a4a9cf147804708faff4a58f2e5cd1255da335c84eab5c26d2a9b010fa31e4b367935438d227ad882a72966833bb2b700d4d5263bf1452

    • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

      Filesize

      1KB

      MD5

      7f5b448271a5e77f54ff5fd046d63eb7

      SHA1

      760986514e4943c2a1fdfef9b30a4bdd96e47275

      SHA256

      39eca40734af4fa9c820a23fd55355ee7f886de643897e6a9200f1077af06ced

      SHA512

      9fa08ca22fbfd8fafa4c05d2f46922c3d47cbaf8251cbfe19dbe91717848ef35c6e1956c6508cb1942b9f415751076fb2d25877ca09a0eb57b7ae73149e0ebbf

    • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

      Filesize

      1KB

      MD5

      6f920b88d82b88585a9bad27993779d8

      SHA1

      c3d2f0158d36346340c9d074d19439e27c1c4e31

      SHA256

      b8b495bd9ae4b747c197305f32851e920b0e0162372a3b89a04f25def4514015

      SHA512

      28d656b75680ff93394e9707b10566cf10310b46ba971aba127dc6faadf097d4a1a9f35158cd0d05020bf3671a95c3f7d359eb40e7c8d96c97febd97af691e58

    • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

      Filesize

      11KB

      MD5

      478c85ba6b198c72624d3d65e59d2971

      SHA1

      15e4d9f3b677cd3c593f09dec13a53fb616860e0

      SHA256

      55d2c01645143c051e1dc64ccebc99dcfd4d083ec181b60b77fd5938305df6cb

      SHA512

      7d2b6d0868aa903c701fd2919dead580ecc320e8a7bd4255558c6c729d42f1c5bbd1ffb7e3a1c1bad296aa2ac722033a29e50589f6f46df7db91868be66a6265

    • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

      Filesize

      1KB

      MD5

      1daf703fa0972f437ba3186af283fb74

      SHA1

      3b2502cb03b83b07c2a2f09231d86cee0a700426

      SHA256

      7ef100f8e01a4b834b0e8329fea94bb9faf7e2bffba4d6d6dd1e7e6b3606528b

      SHA512

      7288bb43639d6be8958d52ff918a82b26719558c8988c175b0e0e085343d4801987b2898d83b42c100ae1a4c0b5c886f23bfd692691f88c5d3a244707b97f24a

    • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

      Filesize

      2KB

      MD5

      e9d97c50245feb1c07c5df7700bc793a

      SHA1

      29f8f0274027cc0f215cb5b40d3fa5fd90510f6c

      SHA256

      795ce2c6d5f1b18812461ba8ec30e48a7fd9e413338aed042542a8cd6a3fe5d1

      SHA512

      fc2559e42ac5cf5ac0911ce9df965358ccc020bc2e01cf9ba759a0bc328babb90240ca180846adc889bba0c57bec084b094f38c5b16eba97a5ee08208f3a92b0

    • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

      Filesize

      11KB

      MD5

      8937dfea36e372f2420c64b8adf26c4c

      SHA1

      0610479f758d675e82c19ba606b690cc40c919f6

      SHA256

      18f413004735ca9d7e5a793c003f0a5152b49a3f2292fc64cdddf8f4491f8d9f

      SHA512

      60174398b511fda579eedaac552765b17ad811f42704487da607ebdde255d04ce252dbf2c8664e6422457a82e854c87304c8d1de652aeabe89009d6d878d5f2f

    • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

      Filesize

      11KB

      MD5

      7b26bd3652eb26a77f43bc1cc6043ad3

      SHA1

      80d10811cc86222ec828bdf6fa85dffe64584da0

      SHA256

      265d28d5ed352933b027b92a0133b8f838f67e88cbfee946041f02492437310e

      SHA512

      582163bdb7d8400c4aa76e1cc35aa3c37d478aae6ad5628dfe64769e8eec5b87857336f1b5bb6e56a98ada48357e459074f31dc54422058971b4dd4f036a0441

    • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

      Filesize

      11KB

      MD5

      e1603d1c5890e9c1744388eae4541eee

      SHA1

      a77737a8618efff6720101f578bf76002e7a99ea

      SHA256

      97a6348b78806ec5b40127aae8c2dfe7bc62a4b40ba391be46affba79da9ec8c

      SHA512

      3dad1f7824a0a61f212d97704881d37e6930dc7db9df83f37dd721afbc3501f8221f654c12c7811460d78e3134bd8a59adbefc79feb96f7d71021aece5aeca7e

    • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

      Filesize

      1024B

      MD5

      7f694faaf94e58524726386def116fb1

      SHA1

      1d00472c3c4917d99ae3136a0565189f6d08680c

      SHA256

      ec53cf163f294231c93b3918a752b8eb8a0cb4dabdba2eb2dd4b60be68c1862e

      SHA512

      1bf5b1fa9a5bc7ffea8840a585e8c8ee1d75e32bd69e07750c0203764b03e544e7c2a2212628dfbe2323ccc56e5101c6de53c17da2cd37b7f6fec715d11cfff7

    • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

      Filesize

      48B

      MD5

      3101306036c0e97054cee726af1bbf1f

      SHA1

      11481fec0f805f608fd8af5e422c92dd569bc929

      SHA256

      28a99820601be4ff792e24e4cb266903ff6d8da03e55a00da2eb1030c7bf7d86

      SHA512

      a07bb3147839d6f2b476deeb81221d33ffa98f785b54f2feb11649c8927ee497b8b1196d9336789280065172d67acc56ffaa7e6f7ccf7adaf8a0ae32de01182c

    • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

      Filesize

      48B

      MD5

      eeb69e6d8215d5cc4d556ceb811961cc

      SHA1

      27665970ea1b473243f09c471df273b1ffb08de6

      SHA256

      5de6622aa54ed031dae6ba97ce74e036009a0b48134d7a3c99b2b3fd47bc7d4f

      SHA512

      52e53ea66afce7af094dcf06a5529aef431d4286ddc9bc9fb11d35256168952401ab5b30e66432888aa40cc01df286370dd78c85882c5b792beb49913c657d33

    • C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

      Filesize

      584KB

      MD5

      53b86baf4cede026965d86c1d6343cc2

      SHA1

      c000d65cdbda778adc781c21dd374929c65e6a27

      SHA256

      8cfc393fc295f90a27658342e5ad03b60271a5b5ea3da71120bd32643f4cefaf

      SHA512

      e6fd4c1e02eee6fbb824132548f9adfc216ad1e9b7680bcd109054e9e7c13dce2b6e71091fa371ea75a3f0dbd70dc7d5c0aa496ce9f3ec23d93f352c3cd5512c

    • C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

      Filesize

      584KB

      MD5

      a89a7cabc84cba4caa60066421a8c388

      SHA1

      66fd0a479efa0325756148bb8696e45164b3e141

      SHA256

      5a048f44c61fd5b8b1b0ee74b8d010d4256ad7327838ef8114475aaf7440a07b

      SHA512

      1bd27aafe4a4a6182c5cddebf29a3e43093ed3076cc66bb486f1949e5e2bb64c76a45a66e7fe70640de93b2a0de58c61ca920ce3ac26b4bead5e3b0e43f7afd9

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cyeato2i.og1.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\kqwguk.exe

      Filesize

      11KB

      MD5

      ca3a11797356314fb7c6cb5b3c81a190

      SHA1

      64d3be3c4ad6f828eff903b7190a2f702fde709e

      SHA256

      56d1877b7b003047a3b7a6aad3b79b7a5d53412fa65a473318ab967e398b7f79

      SHA512

      67b0c17ad428b7da0a8dc591f8b72a14b6aac1cbcacf591307e5e7eb134f169d9a24d474fdd13ce6b92f26413e1d2866d8a1f93a00a09b7b7d342db7b5d2bdc4

    • memory/2416-3797-0x0000000000B50000-0x0000000000B5A000-memory.dmp

      Filesize

      40KB

    • memory/3048-0-0x00007FF87D213000-0x00007FF87D215000-memory.dmp

      Filesize

      8KB

    • memory/3048-3492-0x000000001AE10000-0x000000001AE42000-memory.dmp

      Filesize

      200KB

    • memory/3048-3-0x00007FF87D210000-0x00007FF87DCD2000-memory.dmp

      Filesize

      10.8MB

    • memory/3048-2-0x00007FF87D210000-0x00007FF87DCD2000-memory.dmp

      Filesize

      10.8MB

    • memory/3048-7-0x0000000002CD0000-0x0000000002D04000-memory.dmp

      Filesize

      208KB

    • memory/3048-1-0x0000000000A20000-0x0000000000A36000-memory.dmp

      Filesize

      88KB

    • memory/3048-12-0x000000001E810000-0x000000001ECDC000-memory.dmp

      Filesize

      4.8MB

    • memory/3048-11-0x00007FF87D210000-0x00007FF87DCD2000-memory.dmp

      Filesize

      10.8MB

    • memory/3048-10-0x00007FF87D210000-0x00007FF87DCD2000-memory.dmp

      Filesize

      10.8MB

    • memory/3048-6-0x000000001D0A0000-0x000000001D116000-memory.dmp

      Filesize

      472KB

    • memory/3048-185-0x000000001EDE0000-0x000000001F1E8000-memory.dmp

      Filesize

      4.0MB

    • memory/3048-8-0x000000001B640000-0x000000001B65E000-memory.dmp

      Filesize

      120KB

    • memory/3048-9-0x00007FF87D213000-0x00007FF87D215000-memory.dmp

      Filesize

      8KB

    • memory/5716-3686-0x0000026F62C30000-0x0000026F62C52000-memory.dmp

      Filesize

      136KB

    • memory/5716-3667-0x00007FF87D210000-0x00007FF87DCD2000-memory.dmp

      Filesize

      10.8MB

    • memory/5716-3644-0x00007FF87D210000-0x00007FF87DCD2000-memory.dmp

      Filesize

      10.8MB

    • memory/5716-3826-0x00007FF87D210000-0x00007FF87DCD2000-memory.dmp

      Filesize

      10.8MB