Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 18:11

General

  • Target

    2024-05-15_8a8da05ac1c4427a0b00e9b1467cf75e_bkransomware.exe

  • Size

    1017KB

  • MD5

    8a8da05ac1c4427a0b00e9b1467cf75e

  • SHA1

    5b2da0b422d1af285d910b6ff3ba1b30b46665c3

  • SHA256

    fef85d15b901f78da01f8180d97a35cfaf303f7f45d0b69e0e7bef2b68f1d311

  • SHA512

    dd1f69a13356d9b190a0bd64fc90149f55c3943ba07a41953af454e62dac56939a510640085f1774ebd2d01a8167d8bf12507df714481877f28a3c01bb4d7a20

  • SSDEEP

    12288:R2lWRPhhA9PRWg9JoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVjf:R2lmh4R22JOt934J7Z6bQaj1BvUm9J

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-15_8a8da05ac1c4427a0b00e9b1467cf75e_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-15_8a8da05ac1c4427a0b00e9b1467cf75e_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3552
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4980
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4124
  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4804
  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2968
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:3132
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1864

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

    Filesize

    2.1MB

    MD5

    f14276e04ec74cb6dbeecb09e8630264

    SHA1

    48dea72deb7581a48851097922b0eecbe7d6e20a

    SHA256

    c7d5921ff728110ef4fe656cc897c2ea632405f1bf5d7183bddce2117052b374

    SHA512

    5a17c608bd2c17746d9bd21a0558e6f2979e2693d110b9684a3b0917b6bce4a93f3189f297849e0d7de6e26856174705e79ac350295b9d50e1730dbbd64ed22c

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

    Filesize

    797KB

    MD5

    ffa624250404e452aa6e6708e2ce1401

    SHA1

    049a1efae304605ed5fc23e956dbd1910ea9eabf

    SHA256

    6688c2eb991adbf8a47a12746b4227e9a313803c8bbccb91fc5ec0a54d4bbaa0

    SHA512

    3b926b907ffea4d02f402c5879a41fa20acbd22823c2976310a991ef75efe4a837092e5d5d5c285f14570785fcf4c3345f866158a9b50c57cc7c2951207ee57a

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    1.1MB

    MD5

    cd9d6467e71229e7145ce694a0335711

    SHA1

    97ecf6f25aefa52fdb6c69fdedc037a2c00688fb

    SHA256

    79ec340253f26a3f856bb02855c20a39b8afc350ef7748f16ebd667263628507

    SHA512

    0a66d4aef9803031fb0713c0c4b4cab9007ee7f3adfc4f8c8f886f54b593ae69b0300ba4b6a2dbff4f950b8fa08b36c456aee51c5e96d9936ee433945df0c928

  • C:\Program Files\7-Zip\7zFM.exe

    Filesize

    1.5MB

    MD5

    3c606493b609877b7a4d910c86fd35ad

    SHA1

    e9b773dd5859a2802509bca3afcb365dd3a38f9a

    SHA256

    8e07c58a34756b7334c7dffa0a1e1c546446b15dd48c4ae9640238f89b216f99

    SHA512

    069464afe98ca987ccd956332fae484a2781482e3beecb90b5c9dbc8fe3ecf9c3b0756f16886a4283f30403436a436a622a3508e490c991ae1618e0d91432c94

  • C:\Program Files\7-Zip\7zG.exe

    Filesize

    1.2MB

    MD5

    398dfc3a1a65acce066ee1747505ddd1

    SHA1

    6049d6c7e02004a6f86969c98c8418457d56753b

    SHA256

    15fea4df6d115fd278ce9d62d8a09a9b6880f1ba6a050ce11308ab5dcba3794e

    SHA512

    fb04fc2e05bdc517a4d3ebdb65d6cba5849a72369446302f4937d0c919b0b5848c23cb3a5554d3b7a4bcb22e75b559edf842a6d823a61a02a1bfdcb10f0aca28

  • C:\Program Files\7-Zip\Uninstall.exe

    Filesize

    582KB

    MD5

    f850ccc6d5a8738c6cc88939a9aafeab

    SHA1

    24e7200f5f25c34e4a5e0414cd2bbc9452732d8d

    SHA256

    dd0a0a7714a6ebf84783fbbb65f39e9fea1b746058861654601cb7c9d44f6238

    SHA512

    054608dd41a5cdd8f6084ec27cf21530a666affca5a99e529092aa705ba055ad76bb0214a8f947b5ece2474cdacbe8e999040e143dbc3a3060f2fff72c852b32

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

    Filesize

    840KB

    MD5

    78f5df8fd6b8276398d9758d9183932d

    SHA1

    d95e803f18d166620232a5297e20c5076de80919

    SHA256

    fd64c42675a709adecc933d9e632b9cfea4940177e2089ae05c0c42430903cc9

    SHA512

    3beb51e8552c7a352c3caa982b9bdf674b830ad7efea1f4ca95b09e566d42ecfdf985a71f053c72a558500c9aea025623c9fe006af6261d672d02f611339f729

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

    Filesize

    4.6MB

    MD5

    57a3b9e546005e399cd6a049752362cb

    SHA1

    394c933736045c028fd0a419c8051997bf1bd63c

    SHA256

    8b32e57aab09802419c0aba80e975ac3bc09ddd99336ab005eddf9287e92f2e9

    SHA512

    5c2e2a9d9b9263ae9b43a2f8008e43fbd56093adfae248eb372f645bcdca58af03ba194185e517c87cbdadcc9117bd8a37cbd2f5b4bb6f1b81957db2ac14ed41

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

    Filesize

    910KB

    MD5

    c3b88da4b0fef3d8119f5dea6cd425a8

    SHA1

    eb36f6bdda76066be9713cc681456589e09cb103

    SHA256

    fb72805a99c58c92c808a735cb6795c39d741dbce77637f69c65287ceb5fae0d

    SHA512

    334aa3622ac3f9cccdc9d0e00c3ca00f472b67082679160b5748b8ae6f95c75dc88ed6fc7464ce2459fd9b7b0c58ad0de34ecbf0e381af64250c1cd3cc3ffa61

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

    Filesize

    24.0MB

    MD5

    aae216da4cb0f74eedd97df16b49c771

    SHA1

    6fda231ca5f7912a320ad7895ed5f2a88ac20eae

    SHA256

    292256ffdc0fff792d0f3cefd1686c49a72fa003876c5a98452ec9becb519a53

    SHA512

    ce03d568e1badee3db96533312805b096fcb0dbc5f7b4c85ed99d644f44578c5d241e13eda03b987107d0eccfdc292e2b3654a6911e527451bc990f05e5b7ab0

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

    Filesize

    2.7MB

    MD5

    3e436aadba84d148dd5fd841ae23091e

    SHA1

    b92cc28bdfdcdd0855496fef90b404f73ba35a07

    SHA256

    ef48704ff9beae48e3beffe7f7e13563f4198f9cf97453c73f82ea99e53d0ffd

    SHA512

    35d2d7dea1ca892949add08ef18090c12526d7b46f4758b111d93a370d77d4937e745b5daf222cfbefcd1c390cc9469e609157da5882d7af74a99f190dbff228

  • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

    Filesize

    1.1MB

    MD5

    f96361e78bdec72dc41ac2e6bf643fbf

    SHA1

    7186ef662b446c4927953640aaa1bb35f1339a8a

    SHA256

    07f32f049ff9c63b1cec7fe0f9588a1193983425ad4f70bc7be30f802ce229c8

    SHA512

    1d30dc4281b38ed06f23f872837f6f327eb2dc6bff995cb0ff0c64264c2363e338a52a369541f2a352bf1dd9e0c8aac3bc3ea8936bbbd1ae1fcb073da6ea1a70

  • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

    Filesize

    805KB

    MD5

    c677debaeef4c81e75f00de95d42b65a

    SHA1

    ccf851b54de2dc7ef694502a1bc99abec3c380a2

    SHA256

    4491b63c750d45e2fae56445c86e25a71111a3397a28c556405babbae514ef87

    SHA512

    5dd7f9f260b5353097ced9348ced46934199ad6a831e5db39af15c55fac0e67fa3b91a8b4c3c138c78211b9787305555ad40d73e26e46deb793c8fbffccb40b2

  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

    Filesize

    656KB

    MD5

    08873c0cfd9c879ae76e43dd93572af9

    SHA1

    889f64b051ecfb211b54cb29aa7dd2cd8b86208d

    SHA256

    658c22dabd5af114aa0f4ce8fc675c6b6df6ed551b4be01dad35fb9153e41392

    SHA512

    e8d36070f912a717f7f4a716206f213ad9b2840f457658e595a288bded80d6c47333cca171d1c9b42cd2ba778c99cada3bb1d1867d051067562515a6b3df2242

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

    Filesize

    5.4MB

    MD5

    2d7353897c827b73930e6fef850914fe

    SHA1

    2d38b4d016a2bc2780405ea524ddf471f6b8b280

    SHA256

    c4ef0d9d512fb08cfaa932f03e06994c15282d61a6113144b4d737dd08ca2f83

    SHA512

    1b89932df98a6bfbb072a6a70264c6b79d0369fcadd2b2842f82dc77cd222dd62eca61714df6a0e7697054d2431ba44bf9f2d839c780a196f411f225c2fd848f

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

    Filesize

    5.4MB

    MD5

    bcfa993c4c8ac3916620f65afb5b7502

    SHA1

    51ac46eb6db9143e8a3f48ccea5d4e214b6c2b7c

    SHA256

    d1a72e20aa34dd8fb566671196c404cc4e1ea602907bc0b5bdf360501508b5f9

    SHA512

    ea7cc24d30abcf661432e76421d80bbd2149c1c5b8190fb511a1551a56ca24d0803c2e327742ebbc62a3753b7e48fed8fe00afd55799d048b822f541b12fad48

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

    Filesize

    2.0MB

    MD5

    9e8d9fc3130afe80a1753c281a761496

    SHA1

    372dbbbcdb8879936467fe5fdd51680ac83713db

    SHA256

    118eb2f759156d4f7f2f328182bf9b2dee731e91218703af2cc7172effe29a59

    SHA512

    78cdc64fcb31e03233347808f3f86311a2c086d4d70d80b817fe399cf4d06daadb11cc939dc8d0c9ffae2c5b1b49445137f9f1fc76b8e92fc3cb96d9cd8c6866

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

    Filesize

    2.2MB

    MD5

    843e3aea276186bc33749112620feeb7

    SHA1

    788ef3414996d82a4243a5feb8830d6ac8880f8e

    SHA256

    446da3e08b5cc531e108da59462aed5ea1457a42a527923898c6b139a376769d

    SHA512

    d0f7336b3d1d3f53201bfc9afa2945a5b2c33b95fd8bfbd99a7b19b149b35375077ed1d06a2c6423637050ffe55a33a6b8af13518ecd8e8b560d0045e8231afd

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

    Filesize

    1.8MB

    MD5

    bac6c860dbf3fb5379d3ce56164fd743

    SHA1

    fa4e88846180824fb10ae93050f44b7c70f61d2b

    SHA256

    c2a54998c41a8aea4347b9a32033daca05c5f45aef69f726a15e62ff054d1c42

    SHA512

    381b301fda1b31dc40757af7cc14f88869c3eecbd368ee83f174d7f76c945bf6f75e586db80df7ec9921a28403e96467879f2bbad351972a3f76a7b9967be589

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

    Filesize

    1.7MB

    MD5

    5687c8d1762e73c6e0f8683d6bff9c59

    SHA1

    2f099324327161df9cf806b5b210294d4aa4e7eb

    SHA256

    0ef02cb9b3f92db60f6cadd6dc42d18ac6ee135e593d77f6f85ae8bcd2e650a9

    SHA512

    d73c7886b3d3c106872e51f8a8cbb940c5c0b2f77fff36cedd42a27fd74691b46810dcd867dc36ccf6feb6e5bfa47473c985b080ddfe4b62fac879b0e7901785

  • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

    Filesize

    581KB

    MD5

    15fed13b411dc5c3f3c2534291f58c8b

    SHA1

    1a77063500b117ec2ab7ad00e19a5bdf4a7bd336

    SHA256

    9c66d4c881321e444d826e0611b8b940f573d1c87c7db3c97caf9028bbb9d9b6

    SHA512

    13a6c2fa0b9af764bafe204981c459c6c2f939b42dd24937ebfc4489b637fa2d5f2c8e6eb833fca030a628e7a31485fea4a17f5c9c0c85bd8bf5ee749da22de8

  • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

    Filesize

    581KB

    MD5

    e316a96470c749c0db5e171c0f58c6f8

    SHA1

    9da2e46374d4a3aa63c6a4a86e100e5f5dd06daa

    SHA256

    367d5aa845f213e9c7b9c00976e95f1eb041b79399cb89a41b53b0530d8059d1

    SHA512

    431c2236e6313b777ca4ea205b9b23dcc93278f3da7a1a3abffab8fdcfc1c7f1813e19fc7e827f422950a3761268e26a6db363a9b05c4946713631629345de6a

  • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

    Filesize

    581KB

    MD5

    ee6acce2d009928869beddb01c79aed3

    SHA1

    786b900747bbe7a226e90482ab5934fb0a43695d

    SHA256

    7da441773cc4a7b539af43783a38d5bfe5cd696014365e276e60bf857c87156a

    SHA512

    f5a61dac92a159bfb38e9aa2a1256e9962ea1de774e529d337e225273e2aa32e9ec96bc70036e4c13a33eac46b567baad77db72fbffbe59906f471208ad837e9

  • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

    Filesize

    601KB

    MD5

    9eb96f442ebc0b1a3b08c14d803b3023

    SHA1

    f134d1a048428eae10b970c0a80eee5bcef13c36

    SHA256

    12b3952e7ec3c0a1fe832b677e75a981cfb5f4f6d28c743e462310fab93a3ab8

    SHA512

    755492df406127b3bd26e2dfd8c978853eaeeb37587cd0b439ee9ef31898ff291e6355ee428cd0af0ce73b36bc55769817afd85ddb343b23e5bf351e13c78cc2

  • C:\Program Files\Java\jdk-1.8\bin\jar.exe

    Filesize

    581KB

    MD5

    a2ebf69f12cfa54cb45a93348859a40e

    SHA1

    c3b554b89392f47c1e24a4de3e33ff1c67c9e5fd

    SHA256

    b38de07a52a8b8bf2b6abeaf38aef272c365d446e379b7733bc4437473e0c66e

    SHA512

    cfc233306e292a98942d172b04bda9bebab7e45c0937fe81f6aa555d91f89b365b2604e6a66b953130a7321765eb99f8caeb08711cb7e8a92d784099de1e7342

  • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

    Filesize

    581KB

    MD5

    94f600c07739b1078230f3804760092b

    SHA1

    b94346ebccb855e249d1a5e42f5add12096858b8

    SHA256

    272a6a2d256a7def3eadceb4635739907d5cdea23503512bfe71077ea1c1f5e7

    SHA512

    48e855407c9cc33e8a44bea3934d9089d935312e952abeb3cb7806a821776205d30490099b68f23ccb99ff0534aa301e63cfcc70244a464ce8da2b120850b7ab

  • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

    Filesize

    581KB

    MD5

    c0e632b2db2d48152453f3e92ad24f64

    SHA1

    0a132a36b4f6ba283089e52c4f0f9388fa2d45f5

    SHA256

    059e19c66f7c60afe500c34a16e91a033b3eb4b6d1d14b86307ad855e6428216

    SHA512

    e397dded802b4c2c53146365d6e2ecf7ebf22f340223db2fbca8875ce1a323646b92eadcc69e89880e59a4b1605d00f0d3a37fd75ef31983187637cb674bf272

  • C:\Program Files\Java\jdk-1.8\bin\java.exe

    Filesize

    841KB

    MD5

    5605c1dad4e5847a266a7fa88a9ad433

    SHA1

    f5eb618ce97c639d15b24ee40d862f2e2ae3f98a

    SHA256

    a669b94c46494a11154f91cb5a6f494b3a61504f59ab42dc463d744cc9230220

    SHA512

    43746a9c05b0635b8f36957c17f40806457544962f4188718ba4d8173535a65da0a294815fcc4d7da4b1cfaf581cc0e22fe7696f14e0ab80908a16a4da81728b

  • C:\Program Files\Java\jdk-1.8\bin\javac.exe

    Filesize

    581KB

    MD5

    7b89290bd463478caede156e8f5192fc

    SHA1

    d9fb0c39477c3b134c82e176812ee3b4deafab71

    SHA256

    4d2c63ca6b717fd7220d2ebdae7a807674eebb4eb38ddad1fbb0e5b54912ae52

    SHA512

    f0e864fa35e427a12132799785cba9befd3b2b83b430f0cb541091bc01d8bc7fe7285cebe4511632fa324e66a2a9ba287e70385429527e301929c74e94f835b4

  • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

    Filesize

    581KB

    MD5

    0e33993161e68b63e55de61ff4981835

    SHA1

    3430f890d13eaa7f597d1e14242b4209f81b3e7f

    SHA256

    d17afb186dfa26ccf819757723ed0201421c9a768b8269f5f5bf193204c70ea6

    SHA512

    31f82e2d9a893a72d0dba99dbf44fe31fedc091f02e786417a87b008a4f73f144643ddf62f37d44799a40c49e4f2af28524072952a2ae6be602f35c3e196d8c2

  • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

    Filesize

    717KB

    MD5

    587bf308afdb6ea5bf720ea6f4a94d90

    SHA1

    116285b4f378e0d669f907c54b5e0b2c3720d821

    SHA256

    98cf7521ace34a7f1169d8cacabfa2d900b653ab031e5160fa54d7fa4e824d02

    SHA512

    642e7e50817da2763ff9879e461a88cdb406ed16850c121814bcf456bf1dff6011fe6b918b7e2b4231de8e4f528d52dae60ab2a51dfe3e216c8d51087893cbaa

  • C:\Program Files\Java\jdk-1.8\bin\javah.exe

    Filesize

    581KB

    MD5

    82cb67314bb20f2b298d6d7491047175

    SHA1

    e72eef6bec72af5a5069a040ec76b6564e02386c

    SHA256

    fd079f10aa17a086220b10f7a8ad2a7a9590d3cc49b49dfd8e3bb38b2ccb2e98

    SHA512

    190201f4cc6a8ce14faeabd1baff57fa9354e6acfcb45af22a262e69f3cd1be6ba011e223752f3b3e863cd7c02b91eaf30139e5a77a962fc3ed566273db7e396

  • C:\Program Files\Java\jdk-1.8\bin\javap.exe

    Filesize

    581KB

    MD5

    8fd1a664681f821f3dd83c268cf8604a

    SHA1

    0bd29676d82a6eb09700246c72a8c114e6c39c20

    SHA256

    074a587f4d4143bbc6920ec500476a2a4cb8525bebccfd446a5bbc721d0dedaf

    SHA512

    72ebff1de3d253eb4ed7178213007ada3177ddc855e08338c220559e9bc4abb01470989ae40f25f67fd048ddeca1d71cecc4bebd7dfe20552ecc9730a0fcd6b6

  • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

    Filesize

    717KB

    MD5

    1465a758897b7f1dbcf4e6a04865582c

    SHA1

    c30c5eed84fb1ba3a1d14fc9a71293fe58e94e21

    SHA256

    a8ed3cd2a68677ac89cebeb46f9b2a4430677efc76a53cfe39b097b3efe4859c

    SHA512

    01a4a6d5270f6b85a6f926ed40608c10cc2be6388291f198e5be0254ec0b0a07b915663b1a150db547618e0310256b0d898e36e1fd0f50ba42efab20adb95c6e

  • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

    Filesize

    841KB

    MD5

    1f1ccb30619cb08b8ab6d4d6dd367f65

    SHA1

    6f38e5b086161acb15f5a26f25492cbc67958542

    SHA256

    deec214f7dcd59f5857d8ac637c8dda8d7331733eb57bbc5d14427a657bf8568

    SHA512

    8b2744f7dd3c6b66bb3ab4fea3ea27803367be3a5ec273f5cbed7694cdd97ee6889b48be68e7e0f29a7b07f9bc932facc8fb4cdd4cc2b1db44b65382f0509b01

  • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

    Filesize

    1020KB

    MD5

    1508442c280ff5c0c740ccbcf3d9b025

    SHA1

    af12f88e837682483f0708b38e49780d51ba8f37

    SHA256

    3b422456b0f9be7b6d9833ebc7d33201d6d61a95528508b2bd9a766262428299

    SHA512

    c76c42d35cd7fe4fca074c2f882219ff3f23e9281048524882c686c0994abcd30204c552d395903d355894939aea483431cf73102e07c2a343132af8c7731277

  • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

    Filesize

    581KB

    MD5

    e4b88af68e27ef37ca1caabf43038fc2

    SHA1

    2c7f37dcd59e3629960b26bd9173ea82a640d1f9

    SHA256

    9fc2dc0fb0a3619f884f1170739afac68a4725d39afb0358b8ecc5a322fb2b4b

    SHA512

    a053d61e0fffd34f5ddf6ce25cefe6eb2d4f0d6510a9ecebfe6337ed7384f79a2adf0d18e5a839dee462c2844e0dd39d630fa6dd5b573a84f67884557a5e471b

  • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

    Filesize

    581KB

    MD5

    69b2db04f2e03f3b3a7d06a3d507d55d

    SHA1

    7e47ae54fb4c9eff1257bb84dba9b79269aaf24b

    SHA256

    6099ecbe5997b36c42c4bae3a2317f67efee490e4d27ecd0900a420bc4157d02

    SHA512

    11861d396109e2698c92d881a3730068bfe00cc804de546a7af9a57a0c89b34fa2af2563698308d5f051a4be99bdfd0fafb9456a2b1f8722115cef764a11d75e

  • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

    Filesize

    581KB

    MD5

    5620bbc8e0dba5a25660c068a1420e48

    SHA1

    dc4a957cd927f3e236f5419b1bd4c7352cdb9593

    SHA256

    8882de592cf809ae5b90c67e4ba96a882bf44e4052cd5d411df0893a4facdafd

    SHA512

    de68cad0215d2807274e8a83ee7efaa12a29f54393a645e4428b62f329b3a310472880bf8604c423aaf462a9dc7935364f5434984e4a92c4d22e1386d2ef9485

  • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

    Filesize

    581KB

    MD5

    11660e2e00c3723da6e0557fb17764df

    SHA1

    31859c26ef8902b57849b737de0f4377919d686e

    SHA256

    940db7a096781b81e46d05a69ca36e378cc7e57030590a74806546c731dceddc

    SHA512

    b95185c1ac25d46cc7a8c2d97413577c3bf3990e9b427886b005e74dcb68307c58ea26b628cfcb8822faed59987f11f47fc2439523d8ce4d68367fecb477b32f

  • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

    Filesize

    581KB

    MD5

    ba0926dafabfeac30c3ccb40294ed816

    SHA1

    b1b350701860b97836a4b28dbf3e183a0e677e06

    SHA256

    c3e8435d25d87d33bf5eaaa68155b36bdc7afc41f99caf5c2a6c58f2c253d73f

    SHA512

    7e85d75bd29fd0ec6cdf9834a75b20f1fad691ffaf855748bfb0067d72e87c713674a25e6bd89b9a8494c7d436236286f3604db2174cf3d1672dc1d641964d4c

  • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

    Filesize

    581KB

    MD5

    2a2c4e0ae38c27f19fab5cc379100729

    SHA1

    4fc63eeb828c0c8da4697a766dcf4d18bd244e5c

    SHA256

    130e5b75f5cba69310aa1f0051a0a0e3daace7b858f2c8b2cb86f27dd283ffec

    SHA512

    d4fbc8d146bd3e344b184ba48742905115d3f35b2743925f58bd21bc63e25332712672ed8cc975fc324f790756314e628227f6b18e8245b3e92bd8a1139eba7c

  • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

    Filesize

    581KB

    MD5

    66ad0bc5c89581de48b972f0b8befead

    SHA1

    a6da5005d73b1bba6e39c87ccd24dd826ac6e1ce

    SHA256

    cb9bb9ba9509c8dfc2e28b775757f602bf5088fd79381689d68c0b08787a0ffd

    SHA512

    c3e9273e7ac265b2f26c47d0475b95c751dab956d3143a9dafd8deef29979b9daa83a0a2751efde45c66172658ad29d4f2aea159a7df6ac34b946e059d38aff6

  • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

    Filesize

    581KB

    MD5

    7451f16755ebe1521991d5ce35a3c3f3

    SHA1

    392db6efeecf78337bebabc24e930304dec8ec4b

    SHA256

    762ce8e946204c879747c963c9ab3aefdeabc195309c8389b3109d0214eb7ce9

    SHA512

    00c281f0ee01b9ca7f55b55cd5b65f714c611331ad464f95c936bc6f2aa47cb4fc7301de5c06b09903df194913d4732a8706f6763a82a49df84f7da1cacf835a

  • C:\Program Files\Java\jdk-1.8\bin\jps.exe

    Filesize

    581KB

    MD5

    3427fa5df626e4fe697fd0a0e630042e

    SHA1

    de815ec5e1d6b05360ae12f1aa7846accb350a58

    SHA256

    ebe5f6420b32144a7451e5fda6db40481e1ab775293dc46d72246eee87eea93a

    SHA512

    8fba58c2298d434c509037370aae4bf18d9611d56aea890a5cc06fea161176e234efb05c763c5ee54f34334332dcf523813b8509509008f6216024b93b011940

  • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

    Filesize

    581KB

    MD5

    613812d5ef837d009db60eb66e883032

    SHA1

    b618ed2f654d584a3d04bb27953029cac6e7527a

    SHA256

    98a43718ee97af20ec5c83860d88919066ef97eabd3e7d8d71f0f6961c53b9b7

    SHA512

    73fa7e5e9f4705c5ec1e90dc422190486ffdc45486edf4f6c70a3350185dfc4126a4206479b4232620a1ed7a4903d8fe67753532cbc6a8720e2c1853e2183c37

  • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

    Filesize

    581KB

    MD5

    fea172cb34e4eae45f54829e8377836f

    SHA1

    6bbd4958825a9869bf0f33a4f793e7baeff8fdf5

    SHA256

    50982fb28c59b0ad08e403b42d3d1d241a16e75410470d1fd21b0b66cd5673ef

    SHA512

    67ef5bdcd4b41b78e6dbccc9015a1fff5285bb4080bbb93c6aad8c7a2477876158c265d499084b0d324f44eda97e043036861ecdbcf2abda6382ee4b4f4289de

  • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

    Filesize

    581KB

    MD5

    f134bdd286ba6e4f56d94812cf516e8f

    SHA1

    bd977e9e534f12735d278ec83349563e08ef8aa9

    SHA256

    58d1343dd1e52f6e42e9db52820a8121199495f62e3b1f15a060cb1bde7ecb15

    SHA512

    ce37fb1bac81db89e7a3ea8c01502eae4cf9283b4bbd5e0ccbfe83bbc40a4af00a8a856cfec406a69620308a26854eaf880a269a786a145339c46e07f428e87a

  • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

    Filesize

    581KB

    MD5

    75eef9d0f5603d427e2b3455ee2f69da

    SHA1

    5ed7297f1b62209cf511ef4e6b401971f8da1e35

    SHA256

    d914cab3d555842db1c1b5d980a8421842fde49df2fda79d2c11cdc80929add5

    SHA512

    1b5c0f2cf5b10bc5b0ccb6ce853a0fafcd0bd54d98656d67cb36ebe27d70191c5de813c3c3c8567593b7047f7a3cf4194bc4fb291fbfd4c5b560614bc6b2b112

  • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

    Filesize

    581KB

    MD5

    a876f29a2e94238c4e828fee0b0e8947

    SHA1

    0fe57ed37351854f000c3bace17b54bfd56a3633

    SHA256

    b9b81456fd32b3b724b5471959dcdaefcd64b91a88ec27015ce6b8bd359cc533

    SHA512

    440db8306260ad09aa81b78779e09e9d380e8c8c46000f6361a542540c5573c70607f4fbd74291ebf768ba051b22a6b8972963cefdc61da2fddb2581ae32621c

  • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

    Filesize

    581KB

    MD5

    51e6fed0a7d17c114bd2f2477ecc6a73

    SHA1

    01d7ad27849fbae401fcb5b6a7b66fda68eee192

    SHA256

    7f93f44f5b94c0c95847004733636bb4332426f2ab44fc7fa0e34b232e36257a

    SHA512

    48e1597186274c5ad3c9d25e74b5a448734bcbfd0b8ef6d026b91487b63cd115618fd80690fe0b4871d437f5ec6ddd012a4d20eedda19fbb96e28fc1a238f6a9

  • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

    Filesize

    581KB

    MD5

    bfa8b606bfd1eb1ccec5866827e729b7

    SHA1

    d9592a9c4fa5ae9a673707833b46fe504fe20d61

    SHA256

    e9d56194d20d66129f78d49e8deb324efb511df3cdc3b2dab5e0e2cdc37cdd10

    SHA512

    51e44b574c234d314dc6e886d0c18ca5b75194aff8fcc6fb926e255ed206466bfa681e3eccf821422cf5908135e90b74a41423e5382a19e33ff09ff055f78b31

  • C:\Program Files\Java\jdk-1.8\bin\klist.exe

    Filesize

    581KB

    MD5

    0cee1b149cf776ab2e94f6db693378f9

    SHA1

    576578e982593a2b3ecf55f51e846cb1d3d00e84

    SHA256

    0a96d66e2e16f91ea18293d63b9f0cd53d4b51dc0cbd8fc1d6aa0c56d9ed18cd

    SHA512

    209b2e7e01a0c48a01741a11ae72e0a84b76a6964b6dce47394ca15bd3a16c306be73f6db3aeb343bdb56b7e38b9e7b07a0ad2068d21c1e34456cd9b177a77bd

  • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

    Filesize

    581KB

    MD5

    3739e8e3bda779d8985eeafa574eabda

    SHA1

    b3380888a58bc0417eb8b58297f80accea454c52

    SHA256

    24cefcc375292e1b0b0d37b54b4665266fd70eed9bbd0798fd06c5fbe3fb686c

    SHA512

    ec4715fe95ea33439b1e956b9fbe51c9b55cc79126cf68cf8b2e280eec716129eace6ed39156a60eb5e4fdb8398696064bee39d9d7c142734dfcf846d24fea89

  • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

    Filesize

    581KB

    MD5

    8f6510736455bd561e30e6dce369a590

    SHA1

    394fbd937ff17099e0d55dc4e243fd5a765808f1

    SHA256

    9b9e590a3cc4a7c049ac152a947da9b8ad3fb6d2d6ae5559e14b5b146dc8bb6a

    SHA512

    e2ae49909040fd3ffac22d73ed882fbb0128a02ee70337c4b6d71bdffe0610a250b3f775e795e09525a228d7fc17560e546787d63448e9941fa7cd615bdef27a

  • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

    Filesize

    581KB

    MD5

    4105c257e1035aee4702bf45c02f0844

    SHA1

    a7984b84ace2cbdaa90e0922556626eaa28c06f1

    SHA256

    77ced986297a0f595f061800879d6dcf20b354fa5774eb088ef77573c2a226a7

    SHA512

    b74dcfdf1acf120d653e10321b903a04a962f0994f237e750f159f78a85026bd8bdb7a76570ecd7b29b24bb3403d18c9adbcbaf02a6d2cc645a42c0bd3d89424

  • C:\Program Files\Java\jdk-1.8\bin\pack200.exe

    Filesize

    581KB

    MD5

    8e286cc8b4f149eb6e9cf82606c08442

    SHA1

    aa9d834058e51c93cb14403cc8e72c5d87db6074

    SHA256

    674d76d61cd597dcae0df64b8799556929f0db7a2c554192847a9e14aa764002

    SHA512

    181d20ab84aabc01c2da0d504ed6a426afa7f1ef9b65d51b1792309c7173b94a008bd143623060e90ef6182f4da2fa0a78446afc6b012d75281a73828ef6658c

  • C:\Program Files\Java\jdk-1.8\bin\policytool.exe

    Filesize

    581KB

    MD5

    792823a730f6c0fe9d8f4dda6743e48f

    SHA1

    7aa0abd6c76522744caf2fd3b02b3e762981f811

    SHA256

    7d900566a4ecdc5242c765a81930243261f5ab7ab2dc0e7f3a1bc5cfb8f3677b

    SHA512

    39998f1b62e425a0fe3eea80f2bd0f67dac6dba849b887eac632a3f1654e2a3ee376a7eb88fe7be0810e408b43a4ab1c843b78a423e9a95943316d06e67b766c

  • C:\Program Files\Java\jdk-1.8\bin\rmic.exe

    Filesize

    581KB

    MD5

    9a892ad4fedda6a5fec10250cb0b7c73

    SHA1

    cee2c08ecec00da3241b159354d8bc30683e1453

    SHA256

    459ea6dcc0812cbacd30ec84e91b9bbff6980bd53cfe300eb1bce16e9bed965e

    SHA512

    4d07edf7696d4b7dc461fe301eb034f2101232fe652ccb577e6cd0922fc0e32279e66aec2d5881fddc962fe12b548b888fdbc613890f69eedb095b593290baaf

  • C:\Program Files\dotnet\dotnet.exe

    Filesize

    701KB

    MD5

    e6546e990cc8aa90131900d66d2d971a

    SHA1

    e0d3c0f4d8723cfbf494bc6d2b8d7ca8f7ae1a06

    SHA256

    8ddbbe43e4f6d91237186f77c0d336eb94333f1fb296aba089b1b9d63f1edffa

    SHA512

    cb632fa641a22173549da8f10154db31e725fc6b0a60a43f35c46fef49d92cefd4e7aa238b615d683a0e8dc225ed2b5a21ee09d2ccf8d94d41249953366baa23

  • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

    Filesize

    659KB

    MD5

    7e892f7021e4793f3f3a6e603c99dbbf

    SHA1

    4a56de7612e355b6fbf65683136f9e4358813a5c

    SHA256

    6925a787eb84b4af9de660770dd42756973e04b89fd216529d0d1583033de2c3

    SHA512

    671753db673338faf599180f8b1afc919c70816ea0860a75bd21022e77a7343067db7573868e6c0a527e82785d3dc55a2ea65cce67fbdefcdb3d0a23a0cc959e

  • C:\Windows\System32\alg.exe

    Filesize

    661KB

    MD5

    edbef882149538a1c0c8186fbd57079a

    SHA1

    9628feef786b7b6ecf4c0988d06038be2bc5f2df

    SHA256

    cc749de6229ab9a2cf37a81740c13d2a8cb6beccd6cce615634ec3e8c4d32d9b

    SHA512

    a94a936d616f86ac447e0318acaf82286f0e626b3ae1ba809725037326961c1f25c6cefb1ebfe1151ad1760ddcf7c6b71bf587a54292afc0b65adbf4386282a1

  • C:\Windows\system32\AppVClient.exe

    Filesize

    1.3MB

    MD5

    f7946ff5ef6dd8b9d846abdddc13bcb1

    SHA1

    d3743aa50431f4a69a9d8baa201fb58fbf470ee7

    SHA256

    0f3fd1d3ffa5d0f17645a2f60173c288a10a214bc3947f1aaf9e5be97d856af2

    SHA512

    7815865fe26a4778b92c04ae4a36fc75f048e6cea0e8963e7def950ab394616f41865776ddb1e13a9050b401df9d5b49c2abb73305ca90e0ebc25e6ff3de3e2d

  • memory/1864-182-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/1864-79-0x00000000004F0000-0x0000000000550000-memory.dmp

    Filesize

    384KB

  • memory/1864-73-0x00000000004F0000-0x0000000000550000-memory.dmp

    Filesize

    384KB

  • memory/2968-249-0x0000000140000000-0x000000014022B000-memory.dmp

    Filesize

    2.2MB

  • memory/2968-58-0x00000000001A0000-0x0000000000200000-memory.dmp

    Filesize

    384KB

  • memory/2968-52-0x00000000001A0000-0x0000000000200000-memory.dmp

    Filesize

    384KB

  • memory/2968-71-0x0000000140000000-0x000000014022B000-memory.dmp

    Filesize

    2.2MB

  • memory/3132-88-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/3132-68-0x0000000001A50000-0x0000000001AB0000-memory.dmp

    Filesize

    384KB

  • memory/3132-62-0x0000000001A50000-0x0000000001AB0000-memory.dmp

    Filesize

    384KB

  • memory/3132-82-0x0000000001A50000-0x0000000001AB0000-memory.dmp

    Filesize

    384KB

  • memory/3552-1-0x0000000000BD0000-0x0000000000C37000-memory.dmp

    Filesize

    412KB

  • memory/3552-37-0x0000000000400000-0x0000000000506000-memory.dmp

    Filesize

    1.0MB

  • memory/3552-6-0x0000000000BD0000-0x0000000000C37000-memory.dmp

    Filesize

    412KB

  • memory/3552-0-0x0000000000400000-0x0000000000506000-memory.dmp

    Filesize

    1.0MB

  • memory/4124-29-0x00000000004C0000-0x0000000000520000-memory.dmp

    Filesize

    384KB

  • memory/4124-25-0x0000000140000000-0x00000001400A9000-memory.dmp

    Filesize

    676KB

  • memory/4124-245-0x0000000140000000-0x00000001400A9000-memory.dmp

    Filesize

    676KB

  • memory/4124-38-0x00000000004C0000-0x0000000000520000-memory.dmp

    Filesize

    384KB

  • memory/4804-47-0x0000000000C50000-0x0000000000CB0000-memory.dmp

    Filesize

    384KB

  • memory/4804-41-0x0000000000C50000-0x0000000000CB0000-memory.dmp

    Filesize

    384KB

  • memory/4804-50-0x0000000140000000-0x000000014024B000-memory.dmp

    Filesize

    2.3MB

  • memory/4804-248-0x0000000140000000-0x000000014024B000-memory.dmp

    Filesize

    2.3MB

  • memory/4980-19-0x0000000140000000-0x00000001400AA000-memory.dmp

    Filesize

    680KB

  • memory/4980-21-0x0000000000500000-0x0000000000560000-memory.dmp

    Filesize

    384KB

  • memory/4980-11-0x0000000000500000-0x0000000000560000-memory.dmp

    Filesize

    384KB

  • memory/4980-244-0x0000000140000000-0x00000001400AA000-memory.dmp

    Filesize

    680KB