Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 16:28

General

  • Target

    2024-05-24_5062c4b63f8c5e2a530edee565b95ece_bkransomware.exe

  • Size

    1.6MB

  • MD5

    5062c4b63f8c5e2a530edee565b95ece

  • SHA1

    1c3bfaf5f690badb12f4d4ab65205b264a401e1f

  • SHA256

    b46bd954882f7ad129f843a821de75167b06aa296067448da9514d3b2e293de5

  • SHA512

    cada825688a8072f3718a676ca82012ba982956e2467dea4cef367db87316773b70bdba0b3313b6d591c0dac5ec1b9bfb2420c44efd873f87f2e8d030f8d7f94

  • SSDEEP

    12288:C2lWRPhhA9PRWg9x+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSN:C2lmh4RuMdIuwe3zfIe7xmvH/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-24_5062c4b63f8c5e2a530edee565b95ece_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-24_5062c4b63f8c5e2a530edee565b95ece_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:772
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4544
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4332
  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4980
  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4944
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:4672
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2856

Network

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    Filesize

    2.1MB

    MD5

    ee1c5a007d62a2ded0b7789398e733b5

    SHA1

    8b43ed9ffa2492de10abd63c5e8e3c137ee6c713

    SHA256

    2c2cebde66dae511dcb07efd44978cc892f2826b22cea26af21493d0b07e93fb

    SHA512

    f4f6bf848e4980d867609f1c2f5408b07c98a995fdcaa12ade1776056278d7b12e5985feaacd44d638f41578a1f1ac39a1f6a1b28ced50973ec6b9e533de59aa

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    Filesize

    1.4MB

    MD5

    f857322d11baa3fdbec9a64875fbc119

    SHA1

    d0eb810dea5145809e79dc41d5e178484c20d2ad

    SHA256

    d8bddce6b1c6f35c3f0be2d1a3e1df0c98cc035efb6f67c1fa94fd1442874398

    SHA512

    72715046819d870fcd2d3fc328a5e7b548c43d045b261fff83d1081c2a14cc7a2dcdef0c2150465bdd083db3445d990817af4615c6cbb947d9bfe34bdbfa92f4

  • C:\Program Files\7-Zip\7z.exe
    Filesize

    1.7MB

    MD5

    e56a1172570064ed67b1c04b2a323ce4

    SHA1

    05ce7e3e985344cab695148de6471e157b4ab89a

    SHA256

    073b719c9e719c4e80374e726e964e498b2518e4294baf236af7129c80840c90

    SHA512

    49d0e52feed2df862efcd0509fef862167415848dac525213fd0f3bd45fcda47b026469401c827cd6e0a81070de741819ee950c7715b1c82d2f1537d6151addc

  • C:\Program Files\7-Zip\7zFM.exe
    Filesize

    1.5MB

    MD5

    e770ef9f6f8e14d262ede27ddcf30296

    SHA1

    76e10ea52154744345cd8ceca7d872b3c0037336

    SHA256

    23ee963252ddf41665dda0a19d3741dd677c0878a9a49f85b75610dd74a940eb

    SHA512

    8aa5aafef249fc02b64326a134dea1509b3a18fbdf005b6e3fab56d7b549a97d849481ae4befff89458b2eea0ac8e9c7c60b24bf41108509570ca829e78a6fe5

  • C:\Program Files\7-Zip\7zG.exe
    Filesize

    1.2MB

    MD5

    8589715d7c7380d220f7c0dd57dcd463

    SHA1

    b982154c53b80c39b568a984264aa5bf27778441

    SHA256

    45388efc7f0f140c2d070e7c62fbe327aa82e4f87971d179a25f8f75837cee57

    SHA512

    0208455dce4bfd5903e6f389a26ba46bff1d8a1eb109c6411549893d7bac23aa694155ab22e9df7a2f478b34ed9da0006d67b669133abc0b46dd9e9053e68fc0

  • C:\Program Files\7-Zip\Uninstall.exe
    Filesize

    1.2MB

    MD5

    0b8c8eebfda117e68d8c462013b48957

    SHA1

    0ff7b35933631a0de47a429b16f72896d2744e29

    SHA256

    0c3806105effe04e78bae272f14f2e3cd87773ac56fc77a49976bf28ed798486

    SHA512

    6083e634a668a4dd888669e8d2d8aca5f82c9507cc5a8b10122635c73afadd27fd9c04e85696cccedf791181946426fff19a03db4fb38d833cf84571e5a85aaa

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
    Filesize

    1.4MB

    MD5

    1d0448d41f7ab8c62b8421c4b2db20f4

    SHA1

    f77b5202fa1fc9e8466f85c9867c39275f9498cd

    SHA256

    731fbf20bcf6607471709d7e4d50a952777800d964fbf8b4dd98dab5552d4e84

    SHA512

    79c04eb0da0ba993ead70ccdac4ef9cf955e9b72c3d3bab84397d0b68d43c4b690726f2f2de4e36bee541eabc56b051b18f0f2cbaf1cf31c613fbdd39516e672

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
    Filesize

    4.6MB

    MD5

    5f3ecf0d3f1fed6a3c1c4e74c7afb5a3

    SHA1

    2d9da0550bb41a45c0d0a577f0adfc42330f58d1

    SHA256

    b697c29386d76f30b6daa66b1347397cde619ed9d13385cbfc317c0c42f27050

    SHA512

    edeafcc48bca8b7e4b4af79a3602166dbf0184dc5d1f81e61931e8fd08c9108e0d36a83e01161c81d85d19d5f4fefa8fed75deea69248d9a0bdd11ae7e1bc1ed

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
    Filesize

    1.5MB

    MD5

    415530c508246ec92f9d52e76718aa42

    SHA1

    6a0206056aa0910b860f326753364721808b15ec

    SHA256

    859e77e98219fe4d9a7dc0ce70254c7e0570d4f2b9f7d3187132c34816b13428

    SHA512

    3923e0b10b89cd39dc0169ecb4135485b326748234debbceb3664bb4de8b9d00b7c04c638f6ee6ab612dd060f8b4d70fb3205362c9de8304921a1dc423f0caa9

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
    Filesize

    24.0MB

    MD5

    8aab43e63bc8fe40db4e7908066f4ae5

    SHA1

    90532fbeaf074fb05596ea136c32f3970a04e728

    SHA256

    b7a9091fbcc1d843436eae55f2ca2022861133d641387a24cf3f008940fa60f3

    SHA512

    8f84cd4a92609fd159ddad0b37fdcfc151e75b568690d6ada1e8d8bc7d4a7ad04de56e4a1c06666ea558ed5ab0c701421f7bb7dab46a8efc6359d2e55d24d3f2

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
    Filesize

    2.7MB

    MD5

    4912b288668d6ac0ddb16de1ff812c3c

    SHA1

    e3a9fa96b5628f1e34f0b103bbca45c25eb18074

    SHA256

    863b702070b5f470f5710825b9f58fb9ebd405fb17139243d323e33bbbf2f135

    SHA512

    b8211ae3926417850d45a94c1982a62419b919910fb5323728b956793e8aaf44e0fa04bb1769a4b4e46c66b43debd3e299b7074dc51909648a250b71183048a3

  • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
    Filesize

    1.1MB

    MD5

    60de999619435f11456d2a966eea8b1b

    SHA1

    02b9d6bf0730be2157fe57ca390e199e8d5e49a5

    SHA256

    295015502cfb4572f6849d8786436939eeb77982c8559c8891579b06b71105f1

    SHA512

    e4888dc02656e34bf85762bcebadd4ede24f343832bff7a9c3a62571725dd01e87244ba9d203530d7b405ee5f8bab66b3f0d8cc33deb6705dae16bdf22c9bd1f

  • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
    Filesize

    1.4MB

    MD5

    08e282bca76387df8467fc5173a9ebb6

    SHA1

    e01f5872be69fc55bf1e278ee10b1d75d59890ae

    SHA256

    198b3b863c89fdc131acd68573999712ac00df00dd6c90844b26dffc08cbc0ee

    SHA512

    80cb2847a077afa6e083742008c11ae6cb124f06e9973174df4e070f9167436a4d77cd6a4dc97fce24e1bf7996d121aebaf5fbda29e222f6771e9b3c64a430dc

  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
    Filesize

    1.3MB

    MD5

    939c7f2b07f2170bec1a783a8fdf143f

    SHA1

    f05a44cc0dd44ce08abf9c4b67fd3405fda5f5e1

    SHA256

    521bac368885b31f1ecde668a9080faa0fa80bd4d3d5e09c9b5649eb15b97620

    SHA512

    460dfea26a70a871185e76a5b79d485ce54f2f1b9271034eba8d2dcefa43fc6f4ec374d729162f7efc1c1aab4218e058d733c38fad4cdc35a182340763381f7c

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    Filesize

    5.4MB

    MD5

    4cc45365bb2886aafa5e196a5768a4ad

    SHA1

    59a7ae5bc7f7b1a0c5548e3e157ddbf80cbbb48e

    SHA256

    0b8b0a67de4b2696f573ec3d3a1671c2ccb70c45eae9c5507751355647e9420e

    SHA512

    ab0209dbe622d8569a4554363d4c07524f8a99e2b3120e7fb096768abe2ad25358d21abae1df8c83bb7e7953fc4d88e2430247ff53dd53829a1b34767d7d4a01

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
    Filesize

    5.4MB

    MD5

    3293493559d7f8586de0ca8dab336488

    SHA1

    8cddb1efda1675b8537ac9d26456a853e969d6b5

    SHA256

    262e02435c1a68d4b82fd03945747f5180b5a49db9d7e72af2a56fc177e62fec

    SHA512

    d749283be93a3f64def96381806889cb677ceb68ebacf81cbc657170adb427cde7ec17110cba6db1f51ca670139c8e42b1bda6c6f73384944e889b9cc9be4cab

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
    Filesize

    2.0MB

    MD5

    e6d985bb9342435a77122b375ab36e9b

    SHA1

    e4adeaf78dd91b21d5248b004cdb7cf9000a7f80

    SHA256

    ced9e42aed601b992cfd439b3c5fbdf0b1ba5649139827e45cde64e839f1c5df

    SHA512

    d39006ffd7a003a735bb616624d1be72a793466e581098a80f3937cb7b53fff4745d84bd925587622ce423fa01199fd3ec6225ecf2a82b8a9ce4d3c16675e5d7

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
    Filesize

    2.2MB

    MD5

    f5ff6989503a99ae9d7bd5bf474a7494

    SHA1

    3d2c149c754c498066172f36c24c2ea7af6bded2

    SHA256

    33f84dcb81b3d3168ab2ec95ae3ad1293e4eaa0e7b2732d1db24d4e919e2f803

    SHA512

    33f32aad63500e336025f574bb69e3ae72fba434285529751723a482342cf981d9770cb81b561812734dc5130aaf104685373b74aae89e55655390f7d45ce258

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
    Filesize

    1.8MB

    MD5

    a9581b1a2dfba742dffe728cf70ee0fa

    SHA1

    045102097930e0e30532d543a49a62138d44a147

    SHA256

    93a2ecf7e938a2812fb83ca8d01871beed8085dc1313d32760f14d15f7b8a018

    SHA512

    8df4ca3bd3c4caf014aa4b57bba693958f6d00ce8c208a0355741fecbb243f524f40a70454e4bc24bbdfc4dde49182d47fc1f2260c055ad54f4780218913b546

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
    Filesize

    1.7MB

    MD5

    ec74723c38a8432b4ef621575db269c0

    SHA1

    0b6c6c16c7372641a75ef52efee6355462ccaafd

    SHA256

    f644b1bd3a075f0c54a1542c76a397383d662682a93d32843fc245e14ae9fede

    SHA512

    d6712d5274d9532f4d9023e270cac3d673157be20fb1f455275458ceea1d4217a79cf614c1ca654738c0a1d33ac5801688a5eea65f56654b59558e52bede0950

  • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
    Filesize

    1.2MB

    MD5

    4b1853743d267b896dc748ec2e8c96d5

    SHA1

    0e387d476aef3c4170b8457aef320e0e951fad2d

    SHA256

    f78f5d2e6eb37aed86c1c1dee30c5d89e3214e0967e8e030f69213c9fd789862

    SHA512

    5c18609f79daf1d0ab901984bbdfe259f54e934a2aba5dd7d40007896c436cf2338a5c7963c2bb4ac36631ab6b731828cc07da12af20cf4653804a25130af675

  • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
    Filesize

    1.2MB

    MD5

    c0cc9acae2c3425ce6e1281ce7276f76

    SHA1

    9901cd95c5523e411a5e682dd2d2428451734a2d

    SHA256

    10d7d9375038f54abedad4b551a527a2611ba3c736f64750260e9c46aa5dab00

    SHA512

    c8e6f0cb94ea277ea28fd1c431e3f54ea420ee669cfb7443605b41681335e32f7a9a5e9b950dbbfa366043a9417d2b15369490413c4b2329f1af6350bb4ac0cb

  • C:\Program Files\Java\jdk-1.8\bin\idlj.exe
    Filesize

    1.2MB

    MD5

    b276021d2026bb1ee68affb1036b6179

    SHA1

    6059523629c62047c1994912f922b01f37554927

    SHA256

    c986add956315deceb6f004b2f0e4be842e30dbbca59f47b24805716ea21c7a0

    SHA512

    3b42f7c6cf4ce5983a8cc7ce2470a45c067f57755fcdd9fdb2005e36a1df4736e8c0df3f8da78dbf9591d54abd6edbe877c95fab93a319e4cf765c4aed066667

  • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
    Filesize

    1.2MB

    MD5

    85409a12f849ac86bac10f0c4647dad7

    SHA1

    c56cf05dfedcaa59280ec67eedf9a6c33640d921

    SHA256

    e79fe37aab3f2b02043006a41c345f0c48f0cde2e8b748662f1235919535b894

    SHA512

    1e6b3ee05a3d64be1b7cb83352c7bb5c295e4554b792b299623d90f75ed342ba8a5cf837ea95b5d86bf3cc97ff0f827929727fe78c04e6e170d55f3cb79dca9d

  • C:\Program Files\Java\jdk-1.8\bin\jar.exe
    Filesize

    1.2MB

    MD5

    c103d08aa3c27c9efa960338a28df63b

    SHA1

    3ccebb3ab3ceec933d0c9733791aa51fb6d1bea9

    SHA256

    c1e09eb1bc4b1f87c1ffdaae5efed5b6c8771627f38d4d828d3172172b4915c6

    SHA512

    c805a3e958519e8ef333d452f1db84df4c32be9102532652e40e455d4e4ae9d45c504074270355cd3181138f3fc6593948b14e9e993907b4b10b3ae632690a90

  • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
    Filesize

    1.2MB

    MD5

    360824d54882bafa8b46bb2e7666d0cf

    SHA1

    b45f79cd33caea1b67323f69d392f457e125395d

    SHA256

    0013c908b41d9fdd7804411252c7480395124dd0b9c3299068d1eac46cb393dd

    SHA512

    92572da39a35f3da1d9ef858547a509495a8592f68699931acc70d191f39a1196d2097171ad08e683b4f3b5c711a07070bc21680617aa45f2e26dffa6003a410

  • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
    Filesize

    1.2MB

    MD5

    3c35d5f57b6bff2fc9eb427f10ebe5bc

    SHA1

    d65d6b354fcb3dd791602b489d78fdc86ba0e21e

    SHA256

    bb023a2f8e067e30af961030a5807799afa1f1c25dadbc63ab5133ea295661f0

    SHA512

    02553bcbafb1f11e94a311917807f40421314a62f3cdf152aca766aadcaa41404d60a1d96e14390400aa97f3934a6e0e8b90bcba2e66be4cb1dcc56a30759c10

  • C:\Program Files\Java\jdk-1.8\bin\java.exe
    Filesize

    1.4MB

    MD5

    f9912e29bc3efd5118859221f6d79c9a

    SHA1

    bd6eb0b4efa553e48d8b13a122e5344994f230e1

    SHA256

    44d4e88c2b38a849d24cf88e03b0cdd2ba3a4d84a77452602f62525a27b23adf

    SHA512

    72bda9d827eba1fcc1b0715f7f6cce0d4a7c3594b186c1239de4d1a1cb688065d5a75be14a7dd9f5be01853072b290b672cc6c0b553bf2fdfdd6d1e98594bc62

  • C:\Program Files\Java\jdk-1.8\bin\javac.exe
    Filesize

    1.2MB

    MD5

    5d178fbd5e7c36875f2a22bac53a81c5

    SHA1

    85c987ee649b8ef8155a084afd5d4f77a8b9bcf2

    SHA256

    85641239433e20388ba1e01e8a4d045f7e664efb5720dda0608fc6162941f653

    SHA512

    d8fba9d7a44d7d03c988967342069611c2ddd40afc9ba520563f1504bf7a459728c4321077cc98190c2baf6cd32e67d942bb203c016f6ca763597d35b69087b8

  • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
    Filesize

    1.2MB

    MD5

    82e75e021f398db9ce6d1d77ae64e0ed

    SHA1

    1f6e9a79e044d24baa50c6b8c0dfa15949691778

    SHA256

    d2f2a3f843e4011e927961ea720ba17d888a1fa067506c11a6d46d9c75f5d342

    SHA512

    927f2b70eb8ff5ef801cd08ca6ca5001f4d0164ff24364ade4b748c660c49966b92ab2b3f7c3c51b4c9b099f38f757000eb0e2ea8b5256fc33ee66aab83b1f9c

  • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
    Filesize

    1.3MB

    MD5

    0dd10db0fe4259c08a06c450bceb3621

    SHA1

    79bb2bffde3e8d7d6f6ffc23a428c1ce9b1f513c

    SHA256

    8aec1b3af2efe028ddd443250ccf9b54850584ea8f8370bad40df077c441e112

    SHA512

    4bb74c1ff66467f6210b63149588cd8a2f87f8d0e8642724d170c88b1fc2669d3560efc7a89aca3820ca7ada3cff522cd8e27ea8812582db71cdda19c7e38152

  • C:\Program Files\Java\jdk-1.8\bin\javah.exe
    Filesize

    1.2MB

    MD5

    2b120d27af0189d44d8b51eec42c1d5a

    SHA1

    53b2325272da33e29fb2d98796cc446a8f7acfe5

    SHA256

    af01fc373c84b4d063b23a8cf6e5512cd14a881b5244b9f9d55d94924d703fed

    SHA512

    060580a64f73d3f7a2e924d9cdf21ecb476ccbe80f745ba2e22c6d34237f6e1f3e0833ebf5afe1e7528c9424e6f345bf51aec09ac22b3aea633a6d738b99ed8b

  • C:\Program Files\Java\jdk-1.8\bin\javap.exe
    Filesize

    1.2MB

    MD5

    55733f2bc5fb61694aa6a4dd527a92f5

    SHA1

    14d2d86bd9ea16772bdfa6db4a64005f579b9b21

    SHA256

    c1513f2c0cbbbd83a112dede0ed1e82d03199b1cb65577bc4372870ec0876d7a

    SHA512

    e1c8875172b3e382668204b0cf8f1e0d364b7afc80afdf11deb73c45911c3686a04f533a5a3d2c38027fd26b13b090937ee99bcf033f51a854e3530520d5e27d

  • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
    Filesize

    1.3MB

    MD5

    be431bc00248f374d52cea82cc862884

    SHA1

    d9413cbecd5c0db7d40f9b2d7b801de9ea316b22

    SHA256

    9d03b2f5bbed650774a1ab93870037ce9784a5db9aee99596c12f9be0ecd30a5

    SHA512

    6e12c3f9380ae04da62931867743583f0d4b438f2d68093c8d02a3b9178604e3795f3813f9d7b91022eba3353160af7ca401f2adf40ff5b31def268d08b45fc3

  • C:\Program Files\Java\jdk-1.8\bin\javaw.exe
    Filesize

    1.4MB

    MD5

    d7e8a2fe513be1d41251a50aa31aaae8

    SHA1

    09e7eb5d2ef6c697ed9bed0dcef49898c4d90e12

    SHA256

    c77ec84726835519a41ef917b3326706270ba564d59fa65ac11299a0b5ab8400

    SHA512

    5127ab5dc58b5f4aff96469067266728441606392d14738ba0a1b3c5a5339181367f1d34bdeca35819943407033fb4656abf2d4bb28fe384c0897f496bfdc2b5

  • C:\Program Files\Java\jdk-1.8\bin\javaws.exe
    Filesize

    1.6MB

    MD5

    5a65d70746ab7d4482083f65f062878e

    SHA1

    8909c57307da074c566134c3c4af33e449a70122

    SHA256

    8c58c1bb9150ecaf7b33d5aff186fe26724e0ca1d07725b228d8903e2146f6c2

    SHA512

    3645a5373c3ddecc9e7b44e7a32a58f272ce34ca476df01a0d5cb2c3cc840ab1386b419c715bc173a7ec7ca42380330615695e021a7f79c80446075743dd8ee4

  • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
    Filesize

    1.2MB

    MD5

    5baec06f8f8f42650252c83200029be5

    SHA1

    8e74c2e3f66a58b6867455ca6ae3ffd6eb00c697

    SHA256

    69c812f30ab21ffe47e7094a4618cb91bf798ed9b20bf50ae67d8f3bd6d914da

    SHA512

    29e8b3e2704f3151f96a0440c01c1306435c030f63f9cffe5dbc9efb70fd5d5f401b9202a89ff1287a7bf5aa04a228338e51d26df89c885c824fecf51180031f

  • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
    Filesize

    1.2MB

    MD5

    3e89a5e8ccd7d1a6a1b0deef7bb22612

    SHA1

    952e5c37f1ce1a4f6d919c2774953385357c2a2d

    SHA256

    4e70970e9229d84faafc2a4a1174a3e91f3605b23cd3f43cb75180dd2ae9bf6f

    SHA512

    b9c619fef0991a873751adcac723c94a22fb8b6ef5778665d7ad314560bddb107caa475a17bfde7b1b31cb13711b9c42a6efa09033c792986d63a72321be4d79

  • C:\Program Files\Java\jdk-1.8\bin\jdb.exe
    Filesize

    1.2MB

    MD5

    d6a34ca1a92d5962e46099a612b24434

    SHA1

    a19c96b846ccbdbc2cd1d8f7e5df99dc506f30e7

    SHA256

    d00892d53ab3243105d07f7162c700a0d5fd0c741effc541d6cc5b519d6831ce

    SHA512

    e3ff5a11d082089399670efbd718eb4f26a917b7edeedc15a1867211b6449c0689c33c97cc22707af26cb582f96eb6dd2e37805b5d4fa4c0495f666fd6629dab

  • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
    Filesize

    1.2MB

    MD5

    7ecd05f4e39c8b697bf4d2cf5d1f0c37

    SHA1

    956c6ed11b818e68fe2576b447d4f67813303504

    SHA256

    f463b735347c4a978a420119047dcd326095ccee57b7a65c1d32991b2aebfe62

    SHA512

    01628859db76bd8a7e5759ce2ec28ff68a5b790ec0da75e3bf00bca77e596a40464c81b8bd862afc2ac711a477b0041cd1af87d20361dc076053c279788f2392

  • C:\Program Files\Java\jdk-1.8\bin\jhat.exe
    Filesize

    1.2MB

    MD5

    399eff4f1863f740b58decbbeb50a94f

    SHA1

    70374a8d6d6671e4bac32dbd3a721c8707b5de5f

    SHA256

    56629a477c9884c2519328b3bc088a7f55f3fb7ae4ce774453338979494bcaa2

    SHA512

    ce6486389c40ab0bc444c52cf1a4d899f8f5250b815835f3acfeb3ac81e86d6baeeb1a8d4509959ae77bca156d7f0ddbf83f23d49dcc86d5929895408f875d90

  • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
    Filesize

    1.2MB

    MD5

    9bb2076593ff9a5c8279572e980bf6fa

    SHA1

    59b172837713af806835bbc9d3d83f0ce4e41e23

    SHA256

    687ea13bb4cfe8e3645212e6cf181e58a32e9514253c341c17430b00d67a484d

    SHA512

    d30cecf20dead439cdcd4a231e4e1bb65af68e5edef692ee47e51aa2beb4908799898387a239c09eb2ef9d0fb67741b01b70d51f5e11b7f45eae793c31c02b56

  • C:\Program Files\Java\jdk-1.8\bin\jjs.exe
    Filesize

    1.2MB

    MD5

    675ccf2c309bd67c5ffb97d241e1c367

    SHA1

    c217310800a1caef4e958d50398c28021d7ffb77

    SHA256

    413dcbe0f26641a799a033943e7eda1d457d16423c8bebc5013ceaec3c092557

    SHA512

    fdc64ad825c7d4235d80297994500311edfdbbe5595059d959b30648dca220d1d6fd27250f04e22828e30f81dc36ddd1d1f0d2553170d57b174c1619d34640ad

  • C:\Program Files\Java\jdk-1.8\bin\jmap.exe
    Filesize

    1.2MB

    MD5

    9acb9174973b9219ef13dd0da3fa2f39

    SHA1

    801d844213ad60e15faf6830be439a3c4937f5b4

    SHA256

    cbf58499f4e67619a02e8254a72b9183bd7b1c612b10bf016b44083a1303aad1

    SHA512

    5f77508eb5b44e3eceedb1fee256242047d157770112f247bb829e4feb3290be1d4a17a195b81750f5d3154f9e85bbf26deb0a5c7fb8405d7e3b90ac9fdb572c

  • C:\Program Files\Java\jdk-1.8\bin\jps.exe
    Filesize

    1.2MB

    MD5

    acdb01017f76620ee5544cf83a40b849

    SHA1

    f842e7505e2287f0ea044400c52ca9bb29d80ec5

    SHA256

    196e985d0cd264528f7171ea6a36238d67478d36ca478e20188a035869337f9f

    SHA512

    d0de95cf96423ac4645a616370cee9dfdf0c962b420905ec8d534094eedb58c9cd13992db60e6c0e011af86dd9bbb8fac79a313b8c28fd30ecdb13c9a2d2bd60

  • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
    Filesize

    1.2MB

    MD5

    59c6be739fbd9c040dc55b44a6b00f53

    SHA1

    39a917759cd568211c78ddf3a3e080b77a151b2e

    SHA256

    d1bc072abe60ca69aae48566f92fc3e4639796ccfd738e10899bc5f105e9c2fc

    SHA512

    7870959db627a0b25b0b7902f89a2875856c9b1341c4c57403c674fd4f80e04503681e01b128288124b7b8ed84484fe8ee75c5162c3529acdcc1ba1cdba978c3

  • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
    Filesize

    1.2MB

    MD5

    ce1ee80921ad885c693a9dfb6eb44cc3

    SHA1

    85f660dff11f888e62ffadbc8faaffb9d3abc8d2

    SHA256

    198832c76995c6be17bcfb01c833c756e637e9e3644cc47d461922caac274382

    SHA512

    61a35d39827ae128506b43e171cabbda5079e068709fe2467a234a5f2066478c561a56d22fe19d4b0f7bfb9898123f55bb3302d71fc4147bead72db2318bb259

  • C:\Program Files\Java\jdk-1.8\bin\jstack.exe
    Filesize

    1.2MB

    MD5

    25f1a63ed7520b44a925af02c833f8e0

    SHA1

    2a7b57c891f1a8a67752a4102ca56628e8cf805b

    SHA256

    83d9e02c58260f24c006a3bfe0167a60e70b22e40d50e74995dd27ce50e3b601

    SHA512

    56b28a9d3cf241f9e79ec8104295588b7162f45ed8ab575dd007cf46586a37c0f8710ccce0b5aba4bcaded77b78b277d59f303a13725abe2890fdd24f96b4dfb

  • C:\Program Files\Java\jdk-1.8\bin\jstat.exe
    Filesize

    1.2MB

    MD5

    aa8730671c080eed7a68bdd198b60c92

    SHA1

    7f8a4e4bbdaa767869ea19ba1c0df3740c7350bf

    SHA256

    60a10ea029078c14ba8fbc9f791bf1c7bc8a1023526f0b0c02a69402bd106cb0

    SHA512

    364ab767350d52786f85c2daf0117f11da513d7e6a91e380946a87aaa7bde4c862e2c739cf7a7bee7e5c34c3c629eb74995e45895853220bf29bc96775fd18d9

  • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
    Filesize

    1.2MB

    MD5

    1e54a4a48118013404652bb82983f767

    SHA1

    682bc0fccc3ca429fea1563a480b9c8847116e04

    SHA256

    f32c8be2ed9b121c291be8457c6a859a5e34ac45c4255653b46058855c187da6

    SHA512

    ed852ba8fa8b55b3363eac45a8a67961a240d6c5a96c4376f8417b7791d1d2e87585982b99c543ba9d47f8ba57fb43e98426a392962e6bfa630209f09f027ff6

  • C:\Program Files\Java\jdk-1.8\bin\keytool.exe
    Filesize

    1.2MB

    MD5

    50318155343bfd0819ed31950444fd62

    SHA1

    797662e091e49169173f4a22964d1a5940231767

    SHA256

    75bb8a65dd44811ebbeb4a7b68d14ce05df63420d2c2f6cb7e07e0f8d86ecab0

    SHA512

    c2bc0cd725aef90203ee9526a45247cde49e8728f732483cb2c06acf94916136fdfa89bf1d410c7b847a5b9dc320ed7d81a6aae2df631ab6e7af9a8298aba7d2

  • C:\Program Files\Java\jdk-1.8\bin\kinit.exe
    Filesize

    1.2MB

    MD5

    94d4b90447728519bdd96745476a7d44

    SHA1

    eb05b676eb7366cb66ccd831858faf5698df1bd6

    SHA256

    aa65ef04513524abeece62fd4f01a98cc46c0d3399d5cc19e48be60863611f8f

    SHA512

    3a6d67e3267a21ad6be212f1b1ca3a4fefebe94ec2657f7bc4e71cfa1b50c22ad283d91257f62ba784b938172b4bc98393e78bb51071b91758e28ebf2af14db9

  • C:\Program Files\Java\jdk-1.8\bin\klist.exe
    Filesize

    1.2MB

    MD5

    3b60695861f1313516032fe988a19216

    SHA1

    fb8433651c342b841854f90bdb0e6120065022d0

    SHA256

    e1105a64a97e84bd2a91f6b94ee5959776aff5218494a4061a1d981ce5593fa1

    SHA512

    b6aff6053c6141c36cf3fae71300991cf9bd7eb53d37becc86ec76f10bf7175a3e6957c7f89fb048537d4294feb6594f6afb70041daad2d040d04eeba5ca9c9d

  • C:\Program Files\Java\jdk-1.8\bin\ktab.exe
    Filesize

    1.2MB

    MD5

    99e9b7fdd199b3ebddb2726d0d224131

    SHA1

    95cc222fb7981ffa609e339efebd4054d1f2dc30

    SHA256

    7e36a880d3a1a24922556458b86c04f56f6fcc3f8c72f0b3e74dfd122487e6f0

    SHA512

    0e327940bc4a31da12a073c5b0e8736a77622d77bc34628aea121dfc890403ce147605bdb5f7b50a7dd4f1cfb6a08808fdb38276c46f16c051e158e62d3990e3

  • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
    Filesize

    1.2MB

    MD5

    55cc7f19d179390233042a7b7e1324e3

    SHA1

    719c7b3793fb1a3455af0a266d51ba2f694ec8dd

    SHA256

    62f274e7d17f5b7b49b9b8563e3d2dca89e06d08acec808a4ae87e45e7091a5f

    SHA512

    d475a353f67a56efaddbdb4b43c5f84c2be21e265c37a973715cddfd1cf1e9870e978cf529592aeb54231676261e67793be6adc3b3a204d419cca53199469c21

  • C:\Program Files\Java\jdk-1.8\bin\orbd.exe
    Filesize

    1.2MB

    MD5

    f2088c62fbcfd6178a81edad606cb2d3

    SHA1

    1cfef968a36d28eaed5d32e6948794d692ad2466

    SHA256

    d9326eba604f87ae4b5a55bd329a05046d516df7789f80790b9372ea2741579c

    SHA512

    8a57b2b934570e9a461ffc8c42fcf1901d065c3454d7c79da975cd583eaa96a402927fc75343040820434462651bc82bd0751151895f9554f9206fa6d1e8d051

  • C:\Program Files\Java\jdk-1.8\bin\pack200.exe
    Filesize

    1.2MB

    MD5

    56b665b0f7cf6c55ba03f07dee34303b

    SHA1

    97eb77f3795a7ad5d31fe6c50a5aeabb8208d920

    SHA256

    ef841faec622e8f4b4ff0642875e7ddd9af710cc976ac1b7f6fec9d54940aa32

    SHA512

    e31ff8b4a169f476eced77c9c2a3b5a2f670a908656bf1fcf66c1e956d5b0afce63d86c83a70584a33a15d05559dbcc3352cd61b9350a36c5b3ea68466487ff2

  • C:\Program Files\Java\jdk-1.8\bin\policytool.exe
    Filesize

    1.2MB

    MD5

    0626a7562ee813c463e15aa736b1cc91

    SHA1

    7889538f0eb0ddc3dc9643006f88e73c9ae5a870

    SHA256

    33d419823a89eeec1c484601d47e30bedfd7f26ba86af943abfe509c1b92f408

    SHA512

    fa8853293c39321ffd1d0fae58e979234b1187af13362b8b9f077fca26745b6a79774957a04b000aba50add6d86ab4f40982f1fc3a726cb9c1570df4bc4e87ef

  • C:\Program Files\Java\jdk-1.8\bin\rmic.exe
    Filesize

    1.2MB

    MD5

    93bc429c0fa9b38b33319ecd32dccda3

    SHA1

    d32fce26657e9073332c9cf9e233c0bed7e055f4

    SHA256

    5eeb8d5d55231bea8c059fd1a0b23c88bcfad55762a01287e559452dcbb173eb

    SHA512

    ec45a6678e957d45b8829e03e860e6d67ec96851456a66920b0b7ac8308bca140d060421f95c572eec25dc4243d91abceeef9c405686d466edd50f130f7c3ec1

  • C:\Program Files\dotnet\dotnet.exe
    Filesize

    1.3MB

    MD5

    eae0a49679c8cf6f27f6470311e69384

    SHA1

    28372be98790f1afbb11eea0de368e2bfbca7648

    SHA256

    10a3d7a8e1b74f7745bc6276f37ab3d0c05ed7d30d300831a389c8f2164527b6

    SHA512

    4a6ff06172a96203e139e2faaaa0760c17a55a8d72bd8d66e889e220adb5c411f0b5cf6eba304675188f6953bdc4e56461d0ee2929d75a173b8bbf749f435e4e

  • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    Filesize

    1.3MB

    MD5

    f890549e9b345b615f2615d1b59705c1

    SHA1

    ffe56df8e9257125242ebfb1d4a716732536537a

    SHA256

    d95eebc546d28dd50090998b44700910ab9381069f5c0b01eea76c4adf83d0f7

    SHA512

    c993a847147121f233d7156b454945331ad390dd55272175566836d62fd5e766b00b32d23301824f391d981bd5a5173741c24ebcb7951828e8fa81f4cfe555bd

  • C:\Windows\System32\alg.exe
    Filesize

    1.3MB

    MD5

    ad0385f2b3e44c1b8aaae419679abd66

    SHA1

    de28d61cf121361322e2791e188b10cba1ae3727

    SHA256

    79b76241f906c6c147cfda70a134c1b5dc5c5a824680b07c4b51eb5c46376d62

    SHA512

    d0d8530b5d4f99a36e881ed26817c720554cd7acb4817d292109fd8ccdb98b40ddd42c01ad4d6692a9285b1f953d02aa9781111ac5d97c260e17b30f44dc4ed4

  • C:\Windows\system32\AppVClient.exe
    Filesize

    1.3MB

    MD5

    02c1889c1bd959f48e7a5e6901e99542

    SHA1

    71d74a6aeea84be78d7093e648a442c845b827ca

    SHA256

    2f0d50421fcad5adcc46fbdf516911cc3264aae7822753630c2116f99e1ca504

    SHA512

    301d375cd996e4af0f6f772c91b96986b82ff94b38290eb3777854d90cfcbfece62cef70575cb11da2af11599636e726d9f8dea532b6490c5c4e81fb1b4d2836

  • memory/772-6-0x00000000008F0000-0x0000000000957000-memory.dmp
    Filesize

    412KB

  • memory/772-49-0x0000000000400000-0x0000000000645000-memory.dmp
    Filesize

    2.3MB

  • memory/772-1-0x00000000008F0000-0x0000000000957000-memory.dmp
    Filesize

    412KB

  • memory/772-8-0x00000000008F0000-0x0000000000957000-memory.dmp
    Filesize

    412KB

  • memory/772-0-0x0000000000400000-0x0000000000645000-memory.dmp
    Filesize

    2.3MB

  • memory/2856-132-0x0000000140000000-0x000000014020E000-memory.dmp
    Filesize

    2.1MB

  • memory/2856-76-0x00000000007E0000-0x0000000000840000-memory.dmp
    Filesize

    384KB

  • memory/2856-82-0x00000000007E0000-0x0000000000840000-memory.dmp
    Filesize

    384KB

  • memory/4332-38-0x0000000140000000-0x00000001401E8000-memory.dmp
    Filesize

    1.9MB

  • memory/4332-39-0x0000000000680000-0x00000000006E0000-memory.dmp
    Filesize

    384KB

  • memory/4332-29-0x0000000000680000-0x00000000006E0000-memory.dmp
    Filesize

    384KB

  • memory/4544-12-0x0000000000500000-0x0000000000560000-memory.dmp
    Filesize

    384KB

  • memory/4544-22-0x0000000000500000-0x0000000000560000-memory.dmp
    Filesize

    384KB

  • memory/4544-20-0x0000000140000000-0x00000001401E9000-memory.dmp
    Filesize

    1.9MB

  • memory/4544-245-0x0000000140000000-0x00000001401E9000-memory.dmp
    Filesize

    1.9MB

  • memory/4672-62-0x0000000001A40000-0x0000000001AA0000-memory.dmp
    Filesize

    384KB

  • memory/4672-72-0x0000000001A40000-0x0000000001AA0000-memory.dmp
    Filesize

    384KB

  • memory/4672-74-0x0000000140000000-0x000000014020E000-memory.dmp
    Filesize

    2.1MB

  • memory/4672-68-0x0000000001A40000-0x0000000001AA0000-memory.dmp
    Filesize

    384KB

  • memory/4944-249-0x0000000140000000-0x000000014022B000-memory.dmp
    Filesize

    2.2MB

  • memory/4944-52-0x00000000001A0000-0x0000000000200000-memory.dmp
    Filesize

    384KB

  • memory/4944-58-0x00000000001A0000-0x0000000000200000-memory.dmp
    Filesize

    384KB

  • memory/4944-130-0x0000000140000000-0x000000014022B000-memory.dmp
    Filesize

    2.2MB

  • memory/4980-123-0x0000000140000000-0x000000014024B000-memory.dmp
    Filesize

    2.3MB

  • memory/4980-47-0x0000000000800000-0x0000000000860000-memory.dmp
    Filesize

    384KB

  • memory/4980-41-0x0000000000800000-0x0000000000860000-memory.dmp
    Filesize

    384KB

  • memory/4980-248-0x0000000140000000-0x000000014024B000-memory.dmp
    Filesize

    2.3MB