cc145cffd3b576ee0332364a7e08b500c55705f6cee34490fd4af55fbe9de561

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
Size

76KB
MD5

716fe05f591f7ee9df184a12e099b4dc
SHA1

f9441f278e109e12190f4b7c8bcf75277ac8e1be
SHA256

cc145cffd3b576ee0332364a7e08b500c55705f6cee34490fd4af55fbe9de561
SHA512

8682e4fd4df0220e9a4c2a2a80aee77b3d865cc5b5caea3c42653e7b77c116516709054b6a7500047124cc660fc7273c4d3c1574bc83de80abfda3152b8cae18
SSDEEP

1536:ifQbLDbiGP7XppGEOmjW7Q+Hq0HkANjBiL/GDsjgikNuVC8OVtf:v3biGPtpG8jWNHfXhNNuUf

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\Q:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\Y:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\E:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\R:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\L:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\K:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\R:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\T:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\V:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\X:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\G:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\H:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\G:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\Z:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\P:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\I:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\O:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\M:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\Q:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\W:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\Y:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\I:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\J:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\J:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\S:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\W:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\K:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\L:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\V:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\T:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\Z:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\E:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\N:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\M:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\N:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\P:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\U:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\X:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\O:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\H:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened (read-only)	\??\S:	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dpapimig.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\RMActivate_isv.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\RMActivate_ssp.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sdbinst.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Utilman.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xwizard.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WerFault.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ComputerDefaults.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\forfiles.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\printui.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rasphone.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sbunattend.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\user.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WSManHTTPConfig.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\runonce.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\waitfor.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\xlog.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\EhStorAuthn.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mstsc.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\PhotoScreensaver.scr	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\RegisterIEPKEYs.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Ribbons.scr	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\TpmInit.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dpnsvr.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\instnm.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msra.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\net.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\schtasks.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\syskey.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\syskey.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wbem\WMIC.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Dism\DismHost.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dvdupgrd.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\PhotoScreensaver.scr	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\PkgMgr.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wextract.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wininit.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dpapimig.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ieUnatt.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\openfiles.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\PushPrinterConnections.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\bitsadmin.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\clip.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cscript.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msinfo32.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\colorcpl.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\esentutl.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\iexpress.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\recover.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\chkntfs.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gpupdate.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wbem\WinMgmt.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dvdplay.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mfpmp.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\upnpcont.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cliconfg.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMEJP10\IMJPMGR.EXE	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\shrpubw.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\autochk.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DisplaySwitch.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msdt.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\WMPDMC.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a\vds.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-control_31bf3856ad364e35_6.1.7600.16385_none_99424f610bd169de\control.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\replace.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_d18028273214fa77\SearchIndexer.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_9d06e2f6f1e51f98\ctfmon.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrmUi.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-atbroker_31bf3856ad364e35_6.1.7600.16385_none_cf7705f47fa8cd65\AtBroker.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\2bd538d545e15452202ef3b41080e2ce\ComSvcConfig.ni.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.2.9600.16428_none_f937400aa65f97cc\iediagcmd.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-systray_31bf3856ad364e35_6.1.7600.16385_none_f327d2f6575da8ce\systray.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7\rpcinfo.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-openfiles_31bf3856ad364e35_6.1.7600.16385_none_e6fcbd244bb7bf74\openfiles.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_netfx-ngen_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_4c193e6507471ede\ngen.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-compact_31bf3856ad364e35_6.1.7600.16385_none_55ea2c71cf438ffc\compact.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_fafb502abef1be40\convert.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-networkprojection_31bf3856ad364e35_6.1.7600.16385_none_3fbc74d90a6e33f8\NetProj.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-netsh_31bf3856ad364e35_6.1.7600.16385_none_5f774c61592c67c3\netsh.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-fax-service_31bf3856ad364e35_6.1.7601.17514_none_0b499f2c96e8f6b2\FXSSVC.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_6.1.7600.16385_none_975df0a6f5a54628\gpupdate.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_11.2.9600.16428_none_0a3fe92b38dd8c45\RegisterIEPKEYs.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\setup16.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\SvcIni.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehshell_31bf3856ad364e35_6.1.7600.16385_none_95955bd51390781b\ehshell.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-eudc-settings_31bf3856ad364e35_6.1.7601.17514_none_b84dc938eed78546\eudcsettings.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_netfx35linq-linqwebconfig_31bf3856ad364e35_6.1.7601.17514_none_b532bb17fea7ee9a\LinqWebConfig.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_44aa873ff9136c27\RegisterIEPKEYs.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\write.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-security-vault_31bf3856ad364e35_6.1.7600.16385_none_4d5e025e54ba15f8\VaultCmd.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_6.1.7601.17514_none_625ebded763bbe23\ssText3d.scr	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_51bcbc61a5466a58\CertEnrollCtrl.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.7600.16385_none_db2b15bfcf64f104\iexpress.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.7601.17514_none_e292664733bd5af6\ie4uinit.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_6.1.7600.16385_none_5ae7f926deb5de01\rdrleakdiag.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_6.1.7600.16385_none_5aad0353642dd29f\SystemPropertiesPerformance.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\ehome\ehshell.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-a..ion-telemetry-agent_31bf3856ad364e35_6.1.7601.17514_none_3092574c7d41010b\aitagent.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_6.1.7600.16385_none_d03cc6bce93bce83\TapiUnattend.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_6.1.7600.16385_none_63dee2821fc69fce\bridgeunattend.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-regini_31bf3856ad364e35_6.1.7600.16385_none_684b2e15d381ea25\regini.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-tcpip_31bf3856ad364e35_6.1.7601.17514_none_bfab9b4ba5f934f9\netiougc.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_177a088436382a34\unsecapp.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\SvcIni.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_6.1.7601.17514_none_6fb51b358e21d75f\TabTip.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-choice_31bf3856ad364e35_6.1.7600.16385_none_c33d412fed16819c\choice.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-es-authentication_31bf3856ad364e35_6.1.7600.16385_none_419312c477ec702a\EhStorAuthn.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\Narrator\4cc02fad33053737088d4c18267ca0a0\Narrator.ni.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\NETFXRepair.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_6.1.7600.16385_none_4befc8eb38093bb1\cttunesvr.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_6.1.7601.17514_none_d71fb1d63f05ef22\WFS.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_6.1.7601.17514_none_71c62979c253e895\RMActivate_ssp.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\chgport.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-driververifier_31bf3856ad364e35_6.1.7600.16385_none_ba42313afe0efbbb\verifier.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_6.1.7600.16385_none_58326e688d4907c6\WFServicesReg.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-taskmgr_31bf3856ad364e35_6.1.7601.17514_none_16699919077609d2\taskmgr.exe	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2200	1604	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe	29
PID 1604 wrote to memory of 2200	1604	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe	29
PID 1604 wrote to memory of 2200	1604	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe	29
PID 1604 wrote to memory of 2200	1604	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe	29
PID 2200 wrote to memory of 2400	2200	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe	30
PID 2200 wrote to memory of 2400	2200	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe	30
PID 2200 wrote to memory of 2400	2200	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe	30
PID 2200 wrote to memory of 2400	2200	716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Users\Admin\AppData\Local\Temp\716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Users\Admin\AppData\Local\Temp\716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\716fe05f591f7ee9df184a12e099b4dc_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
148KB

MD5
57c3fa0057e30f24e9fb5123b6590f3c

SHA1
d20720f7e205d95b65ad7236cd88ca95e8b265be

SHA256
2e5b92b1df89e63a3f5f9884ed3607b2a6ccfbf62ebd8c1ed06b2d56a920d664

SHA512
959e4a7d13a05a9b3bc85c30cee8958a9011eca5416f8c8d4d50a8094e692a7a9f5396586962de36c28bf340b43e0dbe2d3279e3b1c7945670b6b07470a28d5e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.1MB

MD5
c823e5fe10519a60b9c8bd8659b0fc95

SHA1
a4c0b8a00a56aede40de2a326f7484674c9f4113

SHA256
478d17f5acbee3a5d2641ef4beb2d2dc54f89844976f8d5709b5a68acea686ef

SHA512
a39199e1fced530e9f493558a717722afc1552afd5399507540396bc9254447f59d0f735984a749ffc60458acb5f7f11180fad3de03ef659b7b24adfaa23bd10

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

Filesize
821KB

MD5
9f44a8b7ce783ba01b854de142e672da

SHA1
282c5e26f872c51e4639f679ed5d08748b350e25

SHA256
4c3d74e115d99e791a85c1816b6b265a6651221e915d9228b2702ed9ba79e4c0

SHA512
35824ede8e82cc7bc54521a6dccd14e765c1303c26b537470c896a63ec2a9b2b6007686414bfc58814353dbd8b50ea654ace2d03917a49d124b144faa9bb2a45

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

Filesize
509KB

MD5
af93998395b69d8fd64bf5d9027b493f

SHA1
1afd3163174410b91c96c70b65a5e20177afe102

SHA256
fc5b66996fd28ee1d92fe93c4c09fcdc92b07d78278c730381088f0c46524c6b

SHA512
36f7d0fa1417ec5c2863c5f779969ef6a744804158a71a275311f5a437f601c0c94e004177a12829a30b903bdd574bedde5a7df2bcd8f8e4a095d054c6bd2fb5

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
546KB

MD5
f1ab69dd385704400952b4b8a9892cab

SHA1
7ae23cbe285de20a4c18356ec8f450d1079211b6

SHA256
9d35ed8f6bf87db4191b9351724d111fcb6a2a62862776d9f2ca649aac2b3a84

SHA512
0e87d8a756683c4144eb3464601045733df9ade4a50cb0a72296881ad20ac53c3290ee6a74292aac2e2e75734a2dbb3828fd76f5500369071934a0a2b3ec4c3b

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
932KB

MD5
62cd08230fe5e3eca30e7459eae0fadc

SHA1
c2d97fef2b14ff803c007eee7e6b7bd63383b395

SHA256
d300766943f4bc6ae5b352a2cb7dadd654939b77e4cf7e4809826876ca2a2da2

SHA512
0fb084fa238dc577a773e4b3c5206b28b87d302aa850fcee8e4ec2c5931fede71f9b1ddee7377d5691098467882097c955c01221ae63be157f0319daece431f3

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
686KB

MD5
cc8be2fb547da9f4b9db0e48c25870c9

SHA1
951447032ae392c91b5293ae946d1807fcde67c6

SHA256
b89e37b57edc3681b7e1e7eb4c681d3c04db97b87158e585c133a864bae84672

SHA512
f84904f55365b2372cd48f87b56277b479ec752dd847c55176571cec02c6b6f9ce3dfc9e6f6d3eb8774679097389912efbd996a8aec02ecdec838a4d49a685e7

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
16KB

MD5
2d0408b52df807a0d8a499edd8ce8972

SHA1
d48ee5b23e9c42fc1edf2ca4986c4ddfc5a2d692

SHA256
543306bc471c1555e8f364e4222e5945a64dd365aefe05ea15c343e1c5be7489

SHA512
1efb4d57e6b715857eed4cbce499df73046d44adf70a759d13622aa0c245797778e87e8fa629b3bc907c531245c3de33677d6ccb12efcf72ee9aa6e3a05756fb

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE

Filesize
120KB

MD5
d0c35d0565a1c206534910178dfe8bc6

SHA1
9dc4a3f745e6d35873a4190cf3f5e13dd9bcb742

SHA256
5965f0feca02d96e63f624af468f9507c8bd7e7c7f82125c78478600116887de

SHA512
347a245c26a5da1c38c5e7a958fb7ce0b8b886fe59a431c3895f4ed129f8be7d013e02c84bea92f311ccd50351f9747123f1b63d50e40c3d56227fd6eee963b2

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
4.7MB

MD5
936cd56aa9943b8b1bebd1c12170bb2a

SHA1
c63cc87df1c16dee6ce3943ae6deefad75a1f683

SHA256
d2146af11c0513a86d70bd2da84053ac99b52b8dc1f9d2617f720ba8370924c2

SHA512
fa29e007c67dfa29f1863ea85a02454622ec5ae5f53a352720f41746061c3765ec0520c72741a3af7dfd3192641e65bd6803cde458f0147047c62a42c276f5fa

Download Submit
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe

Filesize
99KB

MD5
ba94edee1ae0bebe4dfd7448409ad5b9

SHA1
0a95076481c0136052d4801d23bb8aa82569e1c5

SHA256
967193b9e8ba0f1fa30d232d92ebc98564bf53079fb0345556fdc40754ea6c49

SHA512
7a7ec1f5de47dd945a415b8cad19ebe7e83b6c07e229c524d4fa0010967aae7ba154ce9e5afe2ceed6feec54a785304d4f8d36e80f8c2eaead57ad1f16dba784

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
4.3MB

MD5
13735d7dc9f85c7abe56c07854bc2e24

SHA1
c2150fb1273f27fd13a11792dee64c4d5d6cfcf0

SHA256
edd3ff158cd412bac868204e1e33d03ac1ca0f309bd53587253ae36874952104

SHA512
8c8d4415bce4f67d4d8a4996efdafa765157f1da6ac3baad709aa554f6e9de297b0ff202958b9b3e1530d135831a68004e1bc665f91ad9ad5948cd828b4560f1

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
1.6MB

MD5
3d5b4502061101d15c62a77409f8699f

SHA1
8c4510ff3a37542203a85fc20bbda3ccd1f66381

SHA256
2050c5860b5c908f2128a36ad4cfb42b52226cb0b3eec169cdb47da9d4d237ec

SHA512
815b4b381f76ad5a0e0392c82e1c529bc665747dfdbb0a0ce6046b8b233c21b7d2bc56976a63c98571b628aa6d2e7741b331356df3797d751399c8c7423ea2e6

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
1.6MB

MD5
bdad8081655372eb30fc5ace3c985bb5

SHA1
170f5579e456333020ee28fe32232431338e2207

SHA256
eb4dae3f089dde646eb4633f7ea2448b964e3e3f2fc6ad9317250da2bc2c639d

SHA512
fcfa00871786585e1bcfff1aeb0a5c92403d22e691a357dd2994ae507bb7a73c2715f59b8b20a65f905dc21146fa83110e09efeadd53c2a37b18eba3b62d9b8d

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
1.2MB

MD5
a349322df1f4a23986e6cb740d6fd6f4

SHA1
c93662557005a0b2e4b1b482e281ad10fa463092

SHA256
d337714c8d71ee6a8d0629a4b38d4cccc12c10f34c1cf9b3bb3a89be3e86d447

SHA512
5b508a1f2dd986a0f61aa1f53bb4f8da5c37df2eead5a54ea653e508438995e3bd8d25aa23fafe9af22d14365a0844e96af9fc9d552f6e4fce8a047a4da69b63

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.8MB

MD5
15b54d432ba1ba7bbdf446f556f3298f

SHA1
9169a78c6177aa0e6dc8466c1ae9197528e183e0

SHA256
36c01a50a18c3b91d879b4c8fc3c01f694c1d984b7ab538ca7ecf89d0010229f

SHA512
9e8126e172ccaaf925909f2d61d13ea0a5c36ed8193e0ea4f2c02648790368e5c759f2a81c4b92a9349a7955eb14ab809fc7666ab057e2539c179f8cd89b1371

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1022KB

MD5
84eb6969091591568e40f3c76aba0157

SHA1
19aef98880dfd9b8e980c9c284413a4a8b7972ce

SHA256
5e4cb422a8ba419bf74338427964b1953b9402f13b1b2d23fa25370bd5f0fb24

SHA512
289ec249ac2b4cc1d4ed302a8e05d254588f29333676d8e14497e3183e175891759c4386586ca41c369dc7dc0d1cf8698136dc4cde6a41897e43e3b18e23ec15

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe

Filesize
18KB

MD5
6daaf4ce6fd2bce09becc3af69d1b6b6

SHA1
fee62fbff0fcf7a14fa652ac5b5b390471f5f3ce

SHA256
4f431049b5fdcd8a1b416a5d602f42bc96ca3186fc59c18f219eda46d68b5140

SHA512
63c36b154fb912503a1bb6c9be2cae5ef9a03100db1a04ec701034bfb5d7546464eaafe1cb678633f820e3c4d283e5b847dbf73dd9cbc2f2ab6675944694a84a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe

Filesize
18KB

MD5
ecc1a9fb1e3670800b2662e464fa1636

SHA1
e889aee12e9151ccdaf3e2fbeaf412b6d2186dd1

SHA256
4e12256a7ca7cb55d616125d86e7dc522e1bec78fee5eaf432b20ed8b4615262

SHA512
4d79d593115537c4f465d265dcdf99a601d26436c22740af4f1dcd34e6fffa3f3af0331297cb069a008f8d1a98f5f81016fcb3d8b9eaa12f9da0b0d269e93002

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe

Filesize
18KB

MD5
a2ae3d91430479f6bfbc3bbd150719a9

SHA1
fbc5ebbafa573346bf66243affd3e9ebdc9e8f11

SHA256
c68aead063c44b14c412363c4494e14f829837b539fdf72aa9a2708f1ea5affc

SHA512
f09c6d7c9cc8e85b3210aecea2e9f794d5c84b789b29c80d6a8871c0d7090f9ef3e8d600e5966f945bd6b99624fa189a76c0014da7587cd9cf2f94e440f7da5c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe

Filesize
18KB

MD5
74671256ae201ef6d0b55300beef7bba

SHA1
14240ec767ffa01aacbd58f17edae24d03fe7f3f

SHA256
08e6a4019bcb93eef7f2740f887345ab81c1ab913587772c77b3c1ad1cb85827

SHA512
015b8fb956a8999b07a9f4152c793e2403319fb6fcd6ac6351c62d7f4a6ec55c3212dd4dd93c21d1a4f2a090e8fc0bc63aacd62f46ee4f2545822f87b75809d1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe

Filesize
56KB

MD5
41f2665cd7700fc81d9fdc874966d12e

SHA1
d6175cdc9a68b695a14c10256eff82c5c78b7768

SHA256
f7febfb0f2a574c7e6cb6e8721db08149889345c8c7242f8a0ce468ccbf53281

SHA512
84281df5af93573b4bec2e60581e366d154048f540edddcd5d7510b67aad732603ff3b97b14e8fcc7b99c95b013d557d3d36a6a78a50382deda5ddbde4a8bb0c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe

Filesize
18KB

MD5
4f75120da8cd9e383605d91e9cd3cde4

SHA1
06ad732a49adfa0f71aa6ca78eb52b38aafd51a8

SHA256
4d0aa44bd1204ee6ea876cca716f496576e6df0e8467e2a016ddb2a88c389b46

SHA512
670e68dcd0cde71ba3f3a21534e95b5ef9caa3d8a75477924dfd714d8d7f354a3abd69cc2705514d5947008664bb0cb7f1eece3e1872e71c88acf99c76763c9c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe

Filesize
18KB

MD5
c01fb94bce227cb03afb4b786c64c747

SHA1
39191167011c8812a71a6082e82f9feee3a86f72

SHA256
57e4a86fbb5ae5315c550586ee8c474bab363485ad18e823cb3de4577c03e249

SHA512
723520ddd4488d52814868d80a92d810339786144042f2d9efff76a442bce058c488721df3b6aba5a1cff2cc4cd3cee40048767817648177d137f95854b0d37c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe

Filesize
18KB

MD5
0d9729df3930f7eb1dd133301bee785c

SHA1
a348a5c316a3a432a0aa880a8f34540f313e58be

SHA256
b66997a310435d32c2180f41437ee7f8b9fb5e68ea3c56a294b625989bb640ae

SHA512
fbc9a7262d3df08842370623e98f5e922aea2fa7cdf9f8cc2bba0749f29e56268da475a931dc8ccd29f6299084f68b1fa9fb4d6cba206445bdc54d2f50d0a043

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\java.exe

Filesize
187KB

MD5
e40b3cded5f1ddac5c58d67505e5276f

SHA1
dd9f6f3c26633aafb08995b0a120eebcf322dc68

SHA256
f2285409ae0bc1df62e4f529ad0dd013e803ffe8b146a5be0df6b777bf94d237

SHA512
4462100276ec0ecd6aea7c594082d6d5df024e9302e49613bbdd6d35832dda140b8c9eeab87fa7909dd8a31bd7a405a6654047a3fd2f3a6f86c51d291efe72bc

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe

Filesize
18KB

MD5
59643b363e1b1065e36ff272e89167cc

SHA1
c7f1a3c6e982a423578da84d7176fd035d863b06

SHA256
6ad78491d7d855b393d3402ec6c210d1f417682412f4a92b9425f56cbc5a53dd

SHA512
677281bc5e5af28963360e9cc5b0e98e33574424f4152715b03cd8d60c11a04b5ff48fbe39d1c71f673ce1430080d94fcd3680fe8a370221708c39a93f14a8c6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe

Filesize
18KB

MD5
b4e54893b623f5bde411d8695f73e645

SHA1
12ae2651b5b2fcc31f0427086a84481c7dfeb920

SHA256
004317b51094366c58a6a26ef240772c93859c4b340a74c5f4343e8e46a8c7e5

SHA512
2b1f3740f5bbf4addec69461e250873382540109963009325c07c0e20fe88adac56bd67964365b9093f675f53bfa62af40e043b38b1a614a8e2fe82f7117effa

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe

Filesize
81KB

MD5
c44a5dafebe6087f6b3540499bbf67c9

SHA1
345fe3f822d2adfc4499f276311e35b588665be7

SHA256
0f5d9b83eb70b53c6ad94e0ed21e1c9a2611fa1bf1e6f2726da476532a694e81

SHA512
c5a7332aeaf4edbc2655f157b9e0c909e8e2fd8c32ddf94de980fd64d94d9432904427c09440f3ca71d112b0fe4563b393351f90bda6902a5f9a51ba2c6158a0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe

Filesize
18KB

MD5
dbb9287af3cbedb732bb17925bf3edee

SHA1
213e5b4d2369843300e6bb709395abbf48beba7d

SHA256
cc379ff035baacf8edc677b384009a4549b744977233ae02033740ded067571b

SHA512
4788fdd87449b8abb182018704c969943bd83a78b2403b3c89f9e2b9be19fa514e35ee93ed901ec3d71f75353b493500441f7242b691f99fbfafb73adaf2f3c9

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe

Filesize
18KB

MD5
ab8c22aa8d469142cea4ced317533383

SHA1
e6373c19a791c37d43d6885a076ba0583c2fd6c5

SHA256
b159b4a19fe2e24359b7e803059f03c71fa99ba3bf215fdb0764ea22d577c2e4

SHA512
15221dc584f1af4945a0d5937b332fc778807b8b42dd56f2196cd9acb436cf0a16040721ef584d09af6990f30b36da912e9a7af1b92d38b4036186e8fce5f173

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe

Filesize
187KB

MD5
7716c0feadf489536f530acdf1f57745

SHA1
7a0c769d40e48becde754428f3542d4dbec0fd19

SHA256
a50a60228d54762ed36854c4730cbab50b8e6759310c1dfac6059e6fe956ad5f

SHA512
9c167e3a0be56872ccb9208d043f6656d818a33e9357f9f0a83270c597f079a17f79205d52383171ecdac1fb79e2e5f80cbeed09e20722922117651c47d6a8e0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe

Filesize
315KB

MD5
bc00684f1738dc46bd45472879f2c50e

SHA1
34ded13e2ed9180198c4b9ab823d055a42cf28ce

SHA256
f1c7cba4fdb5a78b957052037fc2d8f010fbf0feb7d83c4691bb6d8b38cbdace

SHA512
de489f0ef74c81bdf965129c87e2231b8f57936ccc747f8db3b7922b54a5dfa1a4d7dc13722e7540da7ab91a453957b6471a6f755be90dc2ddddbe3b0086d7be

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe

Filesize
18KB

MD5
e8ade7fd48699ec93748cab0b0b06eae

SHA1
7d64edd522fc66994b3321535eae850ee6668055

SHA256
a165a08d2ae06af279242934e5d6aa1ab2a4711d821961b3e0cb6c7227786c09

SHA512
5b184776e5bbca58a80df0b60b0389e27ba0ae58fd449b7d1c9400f37d6daa847272057299d732525501bbecda92b88ee060ec4fe4acb1a4723a55e2c7ea493a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe

Filesize
19KB

MD5
5a618835479291527ee37266d34b13f1

SHA1
008a624def6248d64a7b7e2c69531ad26a6589a1

SHA256
9b871c41ef56abd6e37805f22c33acd9ce671228b6ffef92585bb96876732fdd

SHA512
77e35189c8ddfead85d9417f2e44fe6841b362aac96b0a6a98ad2be66d4ec83faed54bae409a34dc9aa3a25684e48c8b3d4f07707a28d8c58bdc9e42f7ae3ea0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe

Filesize
18KB

MD5
75d44b6b58cec9a9b6bc428b8b581024

SHA1
9c9a6eb6f185e9e0bee460d03069ea32223ae128

SHA256
29d86ea996da480b63a81d533c0d079266ea0830a1166f28c424423554ee1cf5

SHA512
da19e553c0cb5b6f897e50a3374a6a9820c5d21a3e9f7acdf2eae4d162a972cef8f0ba63b55a86108ec36938d8005dbbcace9918418c988e18a1e7b972aeb353

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe

Filesize
18KB

MD5
307f48a2b736f6321f0315ad6e5fa2cc

SHA1
09f397d555cb5387804b8105911b84ebbc2b8d67

SHA256
764724c21b97c8ca8830d45f45a29e62f3be8a806242a0c1ec08745f9d0843cb

SHA512
3616695deed49f4b6a8ac52eb814b382f3db7f215791c080f8fad40b748855ca40791875b7da20eea13a3a176e1227bbf455ab8f532fe5a1b90a9bf031045d13

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe

Filesize
18KB

MD5
34563d95ff0ff1596bfd775b79363536

SHA1
fc4014b2c81b2fef3891acfea1485d6ff5deac67

SHA256
285b29ec611419bd328c4d0416d6c9818ea7cc74189a1c8b9c6c8045227155d9

SHA512
2476a8cd888543be8dff0bb2d627a0e3fd57357390a2b01f9a4a4c706ee88235db26823eb8492035ce66e5f6c836be8d8470badd4131325a06614e1dd1ea1a43

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe

Filesize
18KB

MD5
748e7fe3baac2b12c76ae54795568c50

SHA1
36d3e8a0313c8c9f2f30be2ccc220f179c94c0af

SHA256
95d47365904de24bb702b2be9c70cbed6d1daf6566bf929e29896ac1168408b1

SHA512
e8c478d36b245230dc9f019726ce27c571588d6218640487d32950e3d70e0c6eb97e5027d2d6dcb482219ba9243bf44fccff87f87dc691681b3d67e8b332e71c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe

Filesize
316KB

MD5
d338ccc25c64278e9ead744dfed9fc81

SHA1
776af197b1eb80ab2d43a9c320259450831c9d96

SHA256
ef8312bc0a6bfd209e5665c88f300d441143292dc40b00621edc1156a1947554

SHA512
13090381ed4c877b6a63be096000de0515f2b1378663e94b802b3a9da05ecee3241d566805c086ba335af7d4dd4e1f01dfd76789c5ec94901e74d2bf16b7c5cd

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe

Filesize
18KB

MD5
44d68be465419dab282f468ac94ab9bf

SHA1
548006d82f42d8433a000ca729d41847a90975fe

SHA256
e8017c01305f167f6aae41f4f75868f46d5dd89bda2ddb5d85d36a4a289d7dec

SHA512
d8efeb114a2b759fce6b60d4f2825437a32f8bdb36e904e3b89a6c120668a217c616d8343391a35e00c29b2f13929c8948df952d1e29747c309b2283900f047b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe

Filesize
18KB

MD5
d141a145bfbbd0b0b7a12be16a18850a

SHA1
09f142b5d850c199cfd937aa968feb953d4aeac2

SHA256
9bcea2bd35860b6df3b5737750fde6ef67ac28396629a26e356a53945bcd5103

SHA512
4d51ca598d376663bc82d742baedb1b117ed5587dd3910d0deb6d7a3e94f0428792c4e4e801971f67ac1a8fb2921b87c16e0018791a7e0ca7923f091f0c69a64

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe

Filesize
18KB

MD5
a46d03075b0a745d540e4399b7ab0f42

SHA1
acd70405caa1f7b9dc61202e9cc32975763670a2

SHA256
8fe3e2b38c429d003ec9fc4b26cfa39d1536dfa63152e76c66de572c473bb7f6

SHA512
62542021656bc01a38ccf9ec0f9a765eab5f3b98d01c3048999b89b21d19c00eab3c38a3d4c5cdee04f710444f32628519361397cc2e8009a65b4b2caf4e03c5

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe

Filesize
18KB

MD5
9417c8a909e4df79d854785aeb61e623

SHA1
d5628ed7124b77358da4808e6185ee3dd4af8d2e

SHA256
009c17d399f64dbb6aec5220455c6d00e982830774c4d213dcf4d45b563f8949

SHA512
b8a24e2cf8682aa8aaa12bb5366302cab4b769b15318d1f31964ff5f29cfb877dcbfafe469a2caacf831081b843dfd6ab1bf663646339c02a34a5d8fc115433e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe

Filesize
18KB

MD5
676f00d37d2373ab8036db6d15d2a5db

SHA1
5a8bd07297da6c3b8874506e6677da0046144d80

SHA256
6bc3eabec2cb4d92ec5faa3e579405755cbd4e7568d0a0db45671c65309f8ef9

SHA512
5e6fce0768ac2e40f734ecbe4a97475d4844e5b70a86d4bccd9ca682227ac1e54635a6397ad9715ca561d9ee2e4e0c959b5fc252eade7e6f0f6c0cacaca2db40

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe

Filesize
18KB

MD5
908eb7e3d8f22b378da122625182a0e2

SHA1
9bbf7797642c3c7e4b1aaa544bf9ad629737683e

SHA256
356c5d20230bd5a2c8bea43b85e2efcbab080b834a82a68114cafdb88baa3042

SHA512
f2ae6b3f763b5135289c23629ca69ec8bc9dd47e6d22a8863bac6a5b782bb1cccf872ffdb4cb96ecc322e7b38d5ade03ba2e650c6c7f4ba9bc1cd1a54b1c6623

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe

Filesize
194KB

MD5
50573f755c9ffcaf8472322bd6aa45e1

SHA1
c2a6684032fbf322d707ddcc3a6322ed16ca60de

SHA256
3c134a1994106c73a7f0a71e75f2b4ed8c5a74ec99f21bf60773fabd4ab66e3f

SHA512
7b81764ba99460e894e8f513d2e2efef8f8f6ae2b79ca0bbc86cc7b242533f8513a21fd8cdfd8f2d5ecd5d7b141889ef6cef8596b018cfad2cf9666f7f2c6f9b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe

Filesize
18KB

MD5
d5ac3a6a822c985e568b7aee4bb8f23b

SHA1
c44089bcf9796fd9b25635e24bdbdc80f0f35361

SHA256
d1898cc5bc6b8a76ebdcab4fc32949b5ed9a30640675356c001bfaf14f7031f0

SHA512
bdc83f10ac59f03ec73bf79caf3dac6ff3bab0764e8b35d4001ad909f2bd91b0cab28d9181f4ce2a71caf9c703ff9e2b7bff58b791e01bd57cf2ebc8ad2d6a9a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe

Filesize
17KB

MD5
61141880517e14c0a30975dbc43b19c6

SHA1
15bff3c13de5281f99ca487806d1b89d794dab41

SHA256
3548f873e1713f56651870a6090650a51bf5e5ae1348c5311a2299e801e4c578

SHA512
4066b70340301ba34f15be8254552fea45029bfb102448b031e29681ff3a1520c39153cb0419333b642e9ad89fd1b442920a9d85182592947cfb225828d03b41

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe

Filesize
18KB

MD5
df0b8b7dfcb572c1e03a543de931c760

SHA1
b9e58381d59e6453d1367577e5bcb328e21a0a4b

SHA256
37744d5185110464f6fea4a24d2bba1c5ee761b3ae657ec81251d7b7bbcd9edb

SHA512
09a0cd37bf69b07324ae17cc8c33d5ab17227ffe57a8545f305dba0a31e38b4b4e5a34b53d755df109e2ed81a4ed38b5a7df57d989f7b95a0a89f1c513f5c86d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe

Filesize
18KB

MD5
0e1d7a0621a5ea95e6551111f3e8083c

SHA1
30a42b1174d650fcedbc605f4d8e13b6ede89099

SHA256
f66e354353c4ddb62fcc8c04a9bc9d4052f36b47ad315cbc943ba8f9b776fe65

SHA512
f5127e7caf5bf0355061b3a45f687a060dc7f8c2176d90ff7d4a3360ab22c4df6d0e7fd5642c3d76081df76c8cf16ac7b6be5068517282158258045f74245b99

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe

Filesize
18KB

MD5
b86517380344e13d7afe7b67f9886ef6

SHA1
d6619ee79b3d7101ca9f4fb1aa87fb7228108f64

SHA256
3b5cea41a466e199002ea98d0ebb55a74345538819f2bc27f3eda3ad02b2bd1a

SHA512
d3cd9a3693a0a029fb0416232eb4679cd74b27a872a10c171a3ff73e16e9f1f6888aa1b3b77421a3651d22d547662a67258d3e81a94830850fdf85fc7d4a8923

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe

Filesize
18KB

MD5
8bc4ee8a31c8ed3710751f6eb728f6a1

SHA1
76b5e0d37440dc7f9fcc179e40c87cc57c73e624

SHA256
84f96b14fedd3841d4dd100471aad686bbc7a92a04b0255b9ad89e6c62ba2533

SHA512
83c131dac871ba38608e66188bafe6dfe8d3c10058cd03c9532f5330f1f7c2e11546d9c2ec7a84f03c07ee059ac6a491b0f2ce6db83d451821acce2e214fc693

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe

Filesize
18KB

MD5
fe20237fe579869475c2adb3e6ac1cc4

SHA1
d3347ad80a596d4d1799b8313d57902ff9566eaf

SHA256
fa795096614ff9e3c0148334ef6f97a58e10b766750d1992fab7b499715fb113

SHA512
e88e1f341f425b593027afa22464c01459db6116383f4d014174e368490ce0d1005901fc995caf150311f5f1180950ef365dc309da47b5dfb924811b0315c878

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe

Filesize
18KB

MD5
f7ebe4344f08934d5f258511b4d340b5

SHA1
8adcc680b8828569030959bc7f59d376903f5438

SHA256
01e41ee11a5aeb62cd18c3cc6709e0381dd0e3ed31b564f84e6a73c69c9c4bff

SHA512
38afa2b195d685fb010313c01a57881b269b59e3265a736243d8790630c4be4c4daf6c039c5b7a9ae465ceb412c8f9093583b873bc8f2bcca5840754600c9c37

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe

Filesize
18KB

MD5
f84c7631acde3e29664fc5110920f3d6

SHA1
0b0fcabf4c5b01df0b81d8c5128a864c3b6be3dd

SHA256
50f9360afea0f3960d0274f2120b01622f9b0344e3453a2335d22b5dab93684d

SHA512
bfae4fa04521e2607c60473f3c616ce6ac436c06f0b809af6cfb50dd5465680f5fdcb7d9ca5d7e8a00499dc9bac95efbed1309faf5995e06e776df76cc4a76a3

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe

Filesize
18KB

MD5
46bf22c831a9e42cd8bf49bed4f64a31

SHA1
9f7d68e5eea4cb3a41b8a19e0f0d77241c0f5f82

SHA256
f7f2a34adb626471c1da429f23bcbcb26b04e5d6a3bb9f7dc5b495a22e558508

SHA512
5d68e5852818e6813cebcfc3be6a04ef9aa4b92797ce4cf1f4763cd895f15e05a7a50dc6f095507459cc6cbd9d65fb193713f1992320e66b28e7b80ae6e05ea0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe

Filesize
18KB

MD5
dd8abec36540aa4e29939321ae22061b

SHA1
e7abe54a1327185021c88cf4c830ce19e4def496

SHA256
31067cdb84c2bafcc9db540bbe2699ddfcdcc25b84c998f061dac094577e945f

SHA512
f7e7bec3eeae8e4827e8677418e34249baa8ac67323205a403a3f69e01147b95976ea26879c738c9193e5953f4cb35ecb005b561dc11c8d170e92544ac8b459c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe

Filesize
18KB

MD5
48cb25a99c470e69603dfe2b0fe5c6b6

SHA1
ebf5189eb7c1f25750077e77f9e0addda485e771

SHA256
570b03dbb058a1308a274a573fa601fedb3f8271079bf2dde020810e58e5e197

SHA512
421fb68226793183d4c2e7a8441afec3387cc52d40602428574010cde0635877c4ce691d6c4291328d3d1022b6084fa3d2feab39574675652a0adccf9f4162c8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe

Filesize
17KB

MD5
3caaf1a2cb53f607d856e894c8dcd165

SHA1
f92057b0feb96ea0772bf7d289f67282e110e5c4

SHA256
88d4fdc34882a3e852b29089e75ffcafd727c9c5b115d505b0517bd755315f5b

SHA512
016e4fa5cf5dbe4a1fb6616d1a04d2a3527b718b615980a025e8e09ead8a77bac5bd14a4913989193e9f4515cacfc070cc3af9027fd447a5db55549409abe2e1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe

Filesize
315KB

MD5
e1e0d65902febc611963c187dbab272e

SHA1
4f1401a96d66e2766ec7727a1300175c9cf7a99f

SHA256
9a76f9f9f2a5e4881cd3d0cbdd6ab1f75a96e12ae5fb6f4bc7b2f5508f1fa4b4

SHA512
380ee13c090173903d477477020f41520d74feaa805bc6273bdf326f22a4081eb08f94cb7eb121924657a14b830fbb61ec6ff36d4def20f948734512add27003

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe

Filesize
18KB

MD5
380ef98c8f12802b4b55651378199955

SHA1
fd54e00de36ad9e1bfd83b3ed921141f4b23766f

SHA256
2803be0073b8b53c7c737d1e021dda70006179fe8436de1ad927327ad0e1b77d

SHA512
b3f8d22f695bfad11688fe86373618b03ca6860a05c8409f051c631d95a032ecbb46d56c2d13e7f3f4ca418658921ef765690eea9823ce21f305eef9f9986535

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe

Filesize
18KB

MD5
747ca1eb70d62ad537d6aa02a2482064

SHA1
37fb5c0911476a62d9040faa0cc74f1a3238fc21

SHA256
2f84782a5ad2201a6d70be4fcdce5ac28a451211944dbe00d821ef6e543ea1b5

SHA512
d0f44ac990ef8930301c6690a355f1607316c7b64c8cf7c4c02669f70b4511a915cefe649e7faf538422ead0fbdadb19ae85344f167f67d345c28f0a6409594e

Download Submit
memory/1604-0-0x0000000001000000-0x0000000001031000-memory.dmp

Filesize
196KB

Download
memory/1604-850-0x0000000001000000-0x0000000001031000-memory.dmp

Filesize
196KB

Download
memory/1604-862-0x0000000000170000-0x00000000001A1000-memory.dmp

Filesize
196KB

Download
memory/1604-1101-0x0000000001000000-0x0000000001031000-memory.dmp

Filesize
196KB

Download
memory/2200-31-0x00000000001B0000-0x00000000001E1000-memory.dmp

Filesize
196KB

Download
memory/2200-863-0x0000000001000000-0x0000000001031000-memory.dmp

Filesize
196KB

Download
memory/2200-1090-0x00000000001B0000-0x00000000001E1000-memory.dmp

Filesize
196KB

Download
memory/2200-1102-0x0000000001000000-0x0000000001031000-memory.dmp

Filesize
196KB

Download
memory/2400-32-0x0000000001000000-0x0000000001031000-memory.dmp

Filesize
196KB

Download
memory/2400-1091-0x0000000001000000-0x0000000001031000-memory.dmp

Filesize
196KB

Download