Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-08-2024 09:40

General

  • Target

    2024-08-05_c36a6061550baa5cd3e3a45ba0bfa6e3_bkransomware.exe

  • Size

    1.6MB

  • MD5

    c36a6061550baa5cd3e3a45ba0bfa6e3

  • SHA1

    7331f8ebbabd78a9e3d6860e92dc0fcd9bbdf399

  • SHA256

    785cb716fa93ebadf945b62764868eb9aee6081b31e4058e7ca64f538e914e1a

  • SHA512

    5b968969bf4bc9a3c4ff02466e278f12e3681e96b91c094d0f8595232dc3370ff599f522fec0a7183090fde509f89ef45725b86457d2b90ba8f1fb005dd0b316

  • SSDEEP

    12288:i85bM3nKxYfj63hgD1ZiwMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:E3nKi63iOSkQ/7Gb8NLEbeZ

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-05_c36a6061550baa5cd3e3a45ba0bfa6e3_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-05_c36a6061550baa5cd3e3a45ba0bfa6e3_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1360
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4948
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3672
  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1236
  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4032
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:3036
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

    Filesize

    2.1MB

    MD5

    c632f4d6e87f5effcc95878919236c80

    SHA1

    e7087ed9ac1ab9e0d1f95547dcb7792eaeeb293b

    SHA256

    ebac0831a22ba625301c24d9d3d0e32d9f553f3a19148b86f9165d1073db525c

    SHA512

    e26aa2246b505c15e359e9ce76e1420ff40ff085e48cea22242f0acc530272660010351e81a43032b25d634fabd3fa99090d900e35b90435c6e384b0f617da5d

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

    Filesize

    1.4MB

    MD5

    8fb7c58adf5d894486768f03a1b3db52

    SHA1

    63b4c0f7fe560c80a0f73b56b8cec4c6273d14d1

    SHA256

    313fe1940d6f2bb07ed048a483f67726181eb8332451bc4130477d811ce66a9f

    SHA512

    2d0ee312bb68a56846197a0ea9fcff71c83e5c7ab590108d1cc7381d47a1839967f0825affe6db1b03a818d7149cfae7b1979f1dfc30b84d26b6a3cd1c150bb5

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    1.7MB

    MD5

    c4779d7e9270c9d2d99851372d11cfa6

    SHA1

    76183e358c7a32f0432afe0a1faa1b40553f32df

    SHA256

    e659344ee7a66a6ef50083c95c6d97528f945980e20da64ee8ca5279c3271ad7

    SHA512

    e9589d0571bf0e5088c6b3cf43d5dc8ea697bea881964a7ef2d2c18cd3a163a147b560bb2ce1a966d559e3dc06955fbc03b3cf14d77b2a220617f723410e3082

  • C:\Program Files\7-Zip\7zFM.exe

    Filesize

    1.5MB

    MD5

    77cde23fc256f767ee7a12b3d04d3bad

    SHA1

    639000e822fd5e31aaf153ecf76888c4b20796da

    SHA256

    7156c033459f662d754514e4a52dbe7d612007743d5e25094e0e406bfa937401

    SHA512

    9b4758539582491c19c5cb5ce3522608fbc68b30805c6192eefea22d3e55f3bac57cb5aea2aa6c038f8a76577b88a1a3fae86c37c55d31037b5be5500f3b31d4

  • C:\Program Files\7-Zip\7zG.exe

    Filesize

    1.2MB

    MD5

    331aaf8906c897aad0fdbac77d96d5da

    SHA1

    861c7cb8b25ac0a610a4d7669789789cb45d8ef5

    SHA256

    37767d92196dc7cf55f4b2f1bc078ad719fa3d879ac3cefcf5e3ae96fed5ec04

    SHA512

    a1c4e6889fb67024dd229f90a5a0d2de3a62c6db4b11b867ede7ce7f90eeb0dd037ce818cd244d67a16768d9f1a7760d4249dd0e63c9f4d1bc9af029d91a8e73

  • C:\Program Files\7-Zip\Uninstall.exe

    Filesize

    1.2MB

    MD5

    4b8ed358a89966587798c834f6b2c8b6

    SHA1

    f5b3889953fb9937976f2efdc61f71aaf60401fd

    SHA256

    33f9d0b81598a3bebb490616963a1aef8ad4a69818b5a65e0a6cc595fa3c5775

    SHA512

    217650c7154744e2a32513f5a7a433e047fbe419b083d1802ec38bd94b3dfc909b985ca54a6ae3bee2f78353be6a4ef23a46071127bcd1f3ca318ce9154a0060

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

    Filesize

    1.4MB

    MD5

    008e57c0de3d8163add294cad7749b94

    SHA1

    7aeb96e439648f680a845b7be1059b2c3d9cc828

    SHA256

    2fa691be58ab4c16e18e40b6840613f17fba28e430c4482f276ac3ccbcfe57ab

    SHA512

    91e9a4f90deb819d20e56ec5157109bfb422cf5a84e399cbdf358b17bca976063ad3a29333d66e75e33f7cacf67efca738ca9b4cfa56614d82b1b0f68c92beea

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

    Filesize

    4.6MB

    MD5

    50bc4cffdec8973a6f11fb92e47a74f8

    SHA1

    9f614af9edb17ade0c0083348f9dcf97c1d06978

    SHA256

    afe5993d269fdaddc4fa5bef01a7aa1e53ae3a3793bbf8b440555da2e1f1f8a8

    SHA512

    10c2875b3740c30edba19cc29d1313d52768bbb110a5fe62326012356d153f9e4411c370d0b7aa29060a06d47e0148009a8024081bab4bf122a6b6d4d2765a66

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

    Filesize

    1.5MB

    MD5

    48e40dbcd75597a5ccd2d0bd473b7bde

    SHA1

    64e62e98f8e4e25516f5bfab385892c6bf5fd44c

    SHA256

    53c888ad44555009cc9475fe8ccf62a1a1fc712af1ef075673409c4b148ae881

    SHA512

    1b0f1c18e0a1f1979157357e37aa6cfa384042a28712e6fe72b25bb9e30009f1bb94c13adf78470c83e799227f716ab56a6843ab70d014558f23b2693b5b8fe4

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

    Filesize

    24.0MB

    MD5

    967f59eb2211fbe13e7289b5cd27890c

    SHA1

    71ce9d91d74ba0af6c0937087e6351e547073013

    SHA256

    a17b030d1d63852d2bdb0d1132448cece3905d7c8a0b250bfbcaa587007e1cc2

    SHA512

    3ba28fcb198ef36f0090146295449833be0fc1bdc67e6d9e39ef49ada53f257f996b0c806ab53367a5f97731d24fda917f4885e8aab558bf79b52d0514420b04

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

    Filesize

    2.7MB

    MD5

    21364e9dab0e97a0c7cd980cac9859f4

    SHA1

    55048b43bb634d8862ed2da643cf26223a196c90

    SHA256

    9544a2ef3b97825c76ecce8d15faed99b7b718287c1803c524261b68e3c1a542

    SHA512

    404b498abb31d89c7a012b72ac94a301a4d55e31ee0ff5e3da291226cbb5a59d45c8efafe98c7a23684d3e870bb60d90d48bbd2f04b83669bfc0ebe61a70d3cf

  • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

    Filesize

    1.1MB

    MD5

    8413a6cb0ddaf413ba4c23a724450cdc

    SHA1

    e7f2a942c67bd9771200ed0a1a9c236613bff13f

    SHA256

    7aa6e0644418ff4ed3146ee2ee6ecefde17ddf80ec2892ddadffa1b2853d8361

    SHA512

    1eadfb2bbc3ff831d303b8062b9d583f7f58fbc86042bc9e7503d1e6388d130a313b23f101ce11518b72a3e8602b8ca36a3789289be34c93387adcc3073d64d4

  • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

    Filesize

    1.4MB

    MD5

    ccb09210358444293ae223ad2cfae398

    SHA1

    feeb9b9f458aa68f673ba6482a791cbe1588530b

    SHA256

    df2bc1bd6cb7601eb7daad58514b55e43ebf9f84d6ca23f98668a92781f4d9e1

    SHA512

    8d3f73198a0aebbdc33122c24f263491bb26d974b21d40a970bc2e8407cedf0207e3ca0f1a9f5eeb73e91f9081b35567435f2b056e48eed5e851886d6be92709

  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

    Filesize

    1.2MB

    MD5

    670cf495120af80f1da53e46f8bf64a2

    SHA1

    f387973096550ad97ca058b42cab6d3dea671655

    SHA256

    092c062c6defd63d58385d14442707346a3ecc2b6f97dfa8ce4de2dada9e5c0e

    SHA512

    82755ea83277573a40c534146b28438dec42ead48caaf5030a867d211b7ee6748a23e7c9722e571a706ea0d3732120b048844aa16d85ef8f88e952a2019c7d9a

  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

    Filesize

    4.6MB

    MD5

    0254c138e6bda845560efb76a263df5b

    SHA1

    24e0335b5ac37f9ef3779e5b2736709755741fcc

    SHA256

    035231492f276408f5a439ce15f553ee3bb8cff94950bf033dfcd75ca3c14d06

    SHA512

    6d5400e5082abad4680ceb0cc8e08da2a2a3b2c14d33b368953bdb968b14f493475592f2d140b6d408a0742be3f7b988ae011ea9ddc6f159f89ddf920e146041

  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

    Filesize

    4.6MB

    MD5

    04cb57abd07a89ecf4e8610c5e1cf777

    SHA1

    070ced263d917fd6653245daf6f44cbd4076e9e0

    SHA256

    cc377a77116597c4160c649487164277b74e3e8b24dc36e3dc24256ff38a7507

    SHA512

    1622cce4f1a6334e367eec7e8e9d1349856cbe05b9d70644b234fae8ca1910c2c30e850e9d7d18ea8e6a0020b96fc63ddc0b5e09690603475d21034673db051c

  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

    Filesize

    1.9MB

    MD5

    814be3c64c52e2f4153273439def8db3

    SHA1

    247f900b00aad908d5d94b238da3cbcf7d649830

    SHA256

    d03cbe90ccdf9b94c6d4d81a85f9ef9ee7f8d3d255afc837c938d9f0b27e62ce

    SHA512

    d10e973eb16b7b67fd5ccc2f1d84443b554546ac3cb70f52f5e4154eb5911ad51549759247ce2b186c3ec9c025bfb8555ecc25e39dc4c16c25dbf9611980676a

  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

    Filesize

    2.1MB

    MD5

    a386a3b5e9848f4237ace52c40f18e5e

    SHA1

    12029c3c20ff0f96ffcb9eeae53ac5591de103ef

    SHA256

    52c58a18babe03fb7b43bdab51f2a8c43444fd7618902dc18198b492045287a9

    SHA512

    6338ac9b1ad5ae365bf855fb984ffb61dd1152997f77353b2cb23c61196f1c35871d71962353310e06bea39a13684fe5378667f2a4215fcbde8c5e37b4e040cc

  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

    Filesize

    1.8MB

    MD5

    7b01e256c0e13eb5bf874c02b1021dfd

    SHA1

    1d58a690134dd43cd8ffae6df4f257cb018059de

    SHA256

    edd0c46f7d85bb69bdd6524c9c9f1d49382d9eab78d87b7c297676304b6b0c5a

    SHA512

    f821741daf5a0c69dbdd8c9690842d1d8f1acc7854b68453785bd5c270915f3062e52c919d5db160357f16cb557e4a8e708491c6b2a4b2ebd50f285babd8a74f

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

    Filesize

    1.6MB

    MD5

    44b7af269129205bd9e451c043e862c3

    SHA1

    2b067399a0afe81c9da417af8f78f3f75939676d

    SHA256

    977db5ff7cc769dd6d598de6fc8d13e7d6f030c95f5e455cee3384007c74f552

    SHA512

    49a57452bb80fa35c8bfab6e6e3f768de99f7b4f0ed3e792a111af6e2aa4f151a1e0b5fff12bd4654a49ffe95956698f0df4e215317a6e1040f5425421eb19ff

  • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

    Filesize

    1.2MB

    MD5

    5c813570d041cb8ab4703576686427ed

    SHA1

    1a02b602192cb1035c8671798cb97d09e8d618e2

    SHA256

    3aac7b2690df398901b454abad6a2a5f926be0e1a4fd9157b3fbcd47692f7d2b

    SHA512

    db6253aca40de36f562766ba53a7d9471a73c0c3708aa2eca5e7b37cf7a55300174d5fae8c7385b68600be8e1f99442dab8284c3631de40390fa717752dd8631

  • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

    Filesize

    1.2MB

    MD5

    43e09e15dc206fd3a1aa2662f36c9067

    SHA1

    cb77a6df3074110cbec2652316c7611eea25e465

    SHA256

    edda34751306fb85e52eac3e8cf2274236eb023127e9495d7065159c03501538

    SHA512

    ab5626ae2d98e7614f430ab870ea2f4f8ea52599ab9b757a95e57557be12405db85253b83d6d8630c5f18f0f040f571fec00c1f56d7bb1050e57877c98de23c8

  • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

    Filesize

    1.2MB

    MD5

    56d7b408c6ca4a0475d03d57cf7ed656

    SHA1

    5d35b60c91304087e2ce8f2da772dd6390a39bf6

    SHA256

    e0d0f4a3d924f6d093f5644b2e2b55d302207359fa9fb91107f7e7abe3663e87

    SHA512

    5a880ed3322297588c91e7bbe50fe0c6be6d1c4befac7d1414aef90a182f4972b22251e7e2be854ec02cae7ba9f442cbeec31d6e7c82c54f116ae1a250820e46

  • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

    Filesize

    1.2MB

    MD5

    764384c2b224c7c14562132fac1c986f

    SHA1

    5f77030bb2af61150b7b85c925e123b9335ebd24

    SHA256

    912f00f7a5f6dc628e99f4916f41554383c915b44fa455aa1846c3c10f680a96

    SHA512

    502d3f032ad6a1103c5233dc2c0bf4f7a99ba1a281ddb7041b2e20e379f6d68b41ea311e90ce99a945549f186367706b97398123fc779a89306b33316aff5dac

  • C:\Program Files\Java\jdk-1.8\bin\jar.exe

    Filesize

    1.2MB

    MD5

    9909e10c0d7c738b922c28e2c9f6fb50

    SHA1

    3f225df3a4fb6f9e4fac6ca7ad22737e91f0084c

    SHA256

    76b627e06ec4f679dbdd1793a71e09edb1df442a8654e58863e299af9688a453

    SHA512

    a889b62f6d99189cee1fd530b620b86e1e02ca22240caefec56fb4023597f4609b0c196f2c3b8baa38d1a976e66a7e117746ee0be0f84039c1df80f7f3d72271

  • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

    Filesize

    1.2MB

    MD5

    34d97047efce030023b9a5f2ab4c0c77

    SHA1

    40946ac1ed39a5230877d1b3d85cac6595f2678a

    SHA256

    dbb19a1c958e52dfe7bea9e5b1646b9e0ad400ace27ce698e17c1d3659fb5644

    SHA512

    74c06eb2e8eac5ccf25906d35fe32fd60fe2c9071a75a044069d3f573c9702849e0feeac0bf4376f9377b0b51f9330a9ab05365c8f3b94456a3473b66799f1ed

  • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

    Filesize

    1.2MB

    MD5

    bf41dd9fbdc72aaea0002e739b48609d

    SHA1

    77fdf6c4d389c951466159be8d7fb1b5c26a988d

    SHA256

    e79c685212d9ab75ec407489c97e647c36e14750d863e13032f2f9a07e060177

    SHA512

    dfd075fd3c1febbf3c785eb2bfaa0e1ac5db9ba6195cee636dd4fd045d95fe246dd695753f8c478faf61b8b9f53168f6bfffcc33ec969e69809cfcf3694190d3

  • C:\Program Files\Java\jdk-1.8\bin\java.exe

    Filesize

    1.4MB

    MD5

    704b84254740840ad864c5ead5b08116

    SHA1

    c89d8671e5da2b9d9ee851672cc381b9f322fd77

    SHA256

    7d850adb7abbc496232636cc835ff4b2af0425f2b82ab3dd00a3268108538ab2

    SHA512

    8b5e6098ef415e1ee02695bae9543b09f1308d5e18c1ab78c0b11b7d1c31aad1688aa46a70194e992e30b286b84197c6972a6811e1230b3a7d139e8857548274

  • C:\Program Files\Java\jdk-1.8\bin\javac.exe

    Filesize

    1.2MB

    MD5

    620c5279446d6fee4b6243b3adc5548b

    SHA1

    626be846965d9d06527ba8158e09038b53a66fa8

    SHA256

    9773eceed924e3c104d4cfad963f6d53d57f7a78063d0b9e74abc260c0ec6d9e

    SHA512

    cdfc927f87d9a9b03f489dc71eac12eb62782d937be0fb199fd2ded1afa5cc685b986413b68556c907dccf4060032384c7733ff30b2be72f93631dbe36844e51

  • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

    Filesize

    1.2MB

    MD5

    1917fd8621b31ca1ee4087ebff402ef4

    SHA1

    6110a5c48a23f5feb4a62ac260add2d7d3a6aeca

    SHA256

    439df9f1d818d69ba8c8677b3c5f1b9da2efd221f8a917827f0ea72aca5904c9

    SHA512

    1b3f8700312cac8602e6b24a460975473a6105c72bb3b8d1c82d55994e22911e6cc6ba8a86fb47955f1b02325abb7635cdb255881899ba167bf9500daf0d7bfd

  • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

    Filesize

    1.3MB

    MD5

    516e758e6bb30e1d45c482c1220d255e

    SHA1

    52f967b932eeaef1c4a3ed125677516c66b9e44e

    SHA256

    0b13518b7df75f4ff89410c4974f67c68ccf9269f2af3d97c6aa3286b7f3566a

    SHA512

    7b4e95d3c7c76e14687443286b86cdb5cd03f231417d15e80e56ec3c5506b564142525d8ad8f84431f09e2beecacb3d29d8b696ff0aac6a6e79aac945ee16d27

  • C:\Program Files\Java\jdk-1.8\bin\javah.exe

    Filesize

    1.2MB

    MD5

    9b4384a65f5314862aad8c52c47c36ac

    SHA1

    0f0a72c9f72c2c51283c456d97dbd0f0129c55be

    SHA256

    23bbf604ebfde7d773a283fb202df3497896c73589e0c837353359d399ea6d2a

    SHA512

    1b16ea1261cbf41e3636b8c0093d8a3e03836cda592b5a92cd6514179d643dcd299a824e8a7c88efab58bf4fa410a6ffda6cb573c851944428430bdaff1e27c3

  • C:\Program Files\Java\jdk-1.8\bin\javap.exe

    Filesize

    1.2MB

    MD5

    d3a9b0161ac82ab06054fa02c629c28d

    SHA1

    7d8e5427fba496c751fb4c64bbe4a2714452e74f

    SHA256

    889dcae1c19b42b9181a12a2d5115ed8229cb6d097cd41b071e11b0b116ec10d

    SHA512

    c81372d7421af62d651aebb3c9b870bfdcdb37e9e4b757752ec5d94bcb076d2f9afc54687fca0831613a49839bfc3cb3ac653d0b83addb7f82a3cd924cc048b8

  • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

    Filesize

    1.3MB

    MD5

    5d68feebd5aba31f6adc9bb8d48d0db6

    SHA1

    e0f6d2a2f17968596756ecdd74264a50d0f8f5f7

    SHA256

    462f9e7b4b801338b979e9e1068cfad5380efae19c01657cf7331479cb091704

    SHA512

    2450d75b3002c41ac54df88a1d036b1fe2b728675d378e502139a54d3ff470108671b96f5935e9506d7764f7d3ce337ac83d8f087832eed853258ffca5db44a5

  • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

    Filesize

    1.4MB

    MD5

    95fb99c37257f7233840131775e038b4

    SHA1

    4312bea12d461f1bfb5d09d6ada11da696c15a34

    SHA256

    2e54e2850c55c843470f926e655e2a43731f6217e1d9c6ec82394f93157100c9

    SHA512

    385d528d231a544d14cbe5b6fb2bcdfbb32a2535af7afdccc1ba66d80309e88a2af1163ca28c0c183a3b0fcabe1004f2393e6589efa06df7626cdc91a0a77fc1

  • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

    Filesize

    1.6MB

    MD5

    6649ba9face448355ed4d29e3cb47d7c

    SHA1

    288798cce222cc068596bfe6b894b0c20ca67956

    SHA256

    1ab3efa4343fa2106258bf9a35449fd3914815aa4a4b068199300fd1ef0c6e2d

    SHA512

    2c1fcf7f9582518d72c94f5e93048617fa47f0f28653369d3b49d0afcbce72324887d1d4c13201d6ac0cc8083c1a0288d229297a18e9d5b409cce40d83ca26fc

  • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

    Filesize

    1.2MB

    MD5

    9557a08cbc9075596dfc3ca8b9aaf874

    SHA1

    77798f4f2536b466485a854266308f1783f4000d

    SHA256

    e1965a9191c7d6480ccdfd5064e3f600544a95dd013ee85725ac7b7f67b4a485

    SHA512

    b0d31de307a5cd8b3646aab56cbcebdb46f43ace24ec124dae115ad620d49458ba84e5b22c4677e40357a4e84cd4a7819785a898b799d0cfa475ed40f35f2320

  • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

    Filesize

    1.2MB

    MD5

    b780d98350d95533c00135891e74f0c7

    SHA1

    eed2c866bc67c6419b200beb1f17b09887296308

    SHA256

    10d4f84a49782a11543f5400851be59b354e9fc2cfb66954b0cc7fab86ab9a53

    SHA512

    7cd92a465df42c50d29db4871fe180de78c0f0ffaec7378ba0655d484e1b24ac7d24c1922ff24eb5e39380e772a172ce7b5f8e23bc4c5dab5409eed995c8ca51

  • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

    Filesize

    1.2MB

    MD5

    a8b8bdd1888f17f212f7540699aefa82

    SHA1

    6344dac03b1ed94538a8e193fe987036c33adf80

    SHA256

    6dbbfb4bc2f98656360e753ceb0ee3d50f2667e9cba8bfd4efa53ced29ce0c55

    SHA512

    abc841799a8ed7fcb50e55e0d795d0d2eecce2c357043865d8a08367abe18c071c36db2d29dc83376b9736e913b2835beedb505e135d1893a16bedc8bd131d78

  • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

    Filesize

    1.2MB

    MD5

    32d89d6ed5128055f144e4c035371ae2

    SHA1

    e440cc4bdba2156a69f06be11c343a78a96f1e10

    SHA256

    5db0739b15b16eee6446ef48223e9c4316d8a2306c2b5e2ac896a975069ce9c1

    SHA512

    d31becffd5fe83c90d268b56e27ab6e5f6b0a659d45e78761c71d869de404fcc38e44c8ba35c48b43a81c65722020d8797bdb420023a90c5ecd2284aec144e76

  • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

    Filesize

    1.2MB

    MD5

    abcaa8037122ec865522ded42623c3f5

    SHA1

    37ae29331c58e6bb02207738dfe056fddb2a2cfb

    SHA256

    6df64fc26cb090d028c1383479988620de6aa8ca3cc337349e860a294f93c685

    SHA512

    f211185d90e9b100ddb84e22248820f5662da31f74bbf9af5a5f40b603cb213cc28f9a099d391553276137b3277a0f2808f2d7d8eb1c99bc385f400261e6a13f

  • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

    Filesize

    1.2MB

    MD5

    2098e33ba04a536966bcd85439e708a6

    SHA1

    16cf081e271545c7afb9adaed1f5fa675fe232e4

    SHA256

    6f9de1e0e9e0e004aa5f245727058aaa4f0c9c2758ac38939953aef2f9aa0dee

    SHA512

    3e1843ef9908d795e8b2faa1bfd538a9250c7fd6cc6207494b82fd869274743c59c6296b1dcebcc2ab887ff2f9be9172565f118f22597fb9a0f2e4775b7be372

  • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

    Filesize

    1.2MB

    MD5

    6b2372967a582b473308544403180552

    SHA1

    ba571a3a9f2c9737eeda063ac297afea83058579

    SHA256

    6e6a16cdbb029de2801260f7c152da9496f631bdb7f4f23261359486635c84a4

    SHA512

    8642f90f809be8d816cbc162fea6a2abd467e65aca6a50ebf373dd505c6618c00329258f840d39b19c76d98342e4e8227bba17c88a1fbc132ccd91a5542e72a1

  • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

    Filesize

    1.2MB

    MD5

    8236a6647a8c2802de69d23e63cdb00f

    SHA1

    00bec7657ad586a5052fa9494b449f708f59dd47

    SHA256

    9260a6e54ddeb4300273d7a7d2ad8cc7f3d0a34f7e4c164b06b35b0651426764

    SHA512

    4a9ae3119e7063c504e6a6c91910df6dd027f9bd0d666fe14c4df20f3c2177e8340f34b75dce8c1adc6c5acaba1599211057743234357a880bc403b431a3d70a

  • C:\Program Files\Java\jdk-1.8\bin\jps.exe

    Filesize

    1.2MB

    MD5

    45558634572f418cbb8a5b020665bd88

    SHA1

    567b347021f972b9420ae9b86890e57c2a552fbe

    SHA256

    e074fb2bbb1c426996c00fe086f2953a90e2283c8cd23130b83942f9e3ffc592

    SHA512

    1fe5321d96fe0bc43aaea35492af35a6a7b1db7d9e1e99a75bf2f07f0bb4aa055fc708c5a9f72d82d01f3767f9898d256fdb9e17ef0c7c2919c763a7bf48d158

  • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

    Filesize

    1.2MB

    MD5

    5b4fe7ca1448680639661319eba92e90

    SHA1

    ffff127ded07e3c20cd6f79f1502f48054e215c0

    SHA256

    2660c82c8a487948dd615c40f6820d25cc51a9e3fe6d640b33621491b201eeda

    SHA512

    dd981a06b4b320f4ced39ab67874287690592a1028cf95f4da75f9a90a610a7e4c085d403ee9d263adf71cbc705803b3e1a96446c7fa98570c8f0a5951d51d3f

  • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

    Filesize

    1.2MB

    MD5

    64088ee734d9ad549f0533fe6d627854

    SHA1

    1b5db485c82bd9fac35ae6ec705f13cd4c8d6cdc

    SHA256

    4453b1f813ecebdeca2fe430166d9062413cd41b1bea6299b3dd2bd7046b4c91

    SHA512

    5dedca3f9371914bca97baf8e7f118a19b0ddfa9f765acd27cdaa2046c4b203c14d1fa71b7b38aa97913248387e5b7aff55f75cfea89b65e4d6681eacb70e313

  • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

    Filesize

    1.2MB

    MD5

    8266906c89f36e2962b3324624939bbf

    SHA1

    996fbc897aa717c591288480a10d4f148f57f427

    SHA256

    89e9b3b6f2edc1013b9fbaa52eb070ca4401bc04b6be721224fc48e191db63d6

    SHA512

    efcaf522a6a4569f25375c6d68f68be89ed41bb763b0484298bbb2ad42e5c6c16c6d08a812add62054ef9b180adbfacee346998eb0ed2c617b6be80b179ada9f

  • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

    Filesize

    1.2MB

    MD5

    f8043f165bdf2cc18af6e417a9ea1fa5

    SHA1

    8ebc0a8588cd60890b69de52443ca7188bf54e7f

    SHA256

    ce56391181bcbacfeacc4b08cf035a10862d33d0b53fc3fae2d4f8476ebd7d94

    SHA512

    f26cdeffa3046e7ba80479f7dd8a8a32f38de835d78e314067c45c17e460a4e2a2dacc86f13433963ef4b87d1d2b4ef510586f3ac49c884a809cee4ec885bad2

  • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

    Filesize

    1.2MB

    MD5

    713380a83f98c887e5088c41c2defd72

    SHA1

    c4e2f087e47a2fa84507263bc821f03f134f5678

    SHA256

    b8baedf4dca1dc718037c468f25ac46c38aa829e935211f78f705e75538e585a

    SHA512

    324c062c7275024025c02553a534a21ac17d9a78c9bf37bfebf86687362a92ed2382a094ec3182c2ec785b9d1c75c5a8f6614462c901dc9f3bc8478c1af3cbc1

  • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

    Filesize

    1.2MB

    MD5

    37aff837377d6484ff33eb37c3a180d4

    SHA1

    d2d65b1e28e5fef4dae388402da921d33e10ea51

    SHA256

    a7633a99a2e6df5ad9b66fbbc6050986f4286cea49705567b4144bd6978eae27

    SHA512

    501752895acd0f7191ad7c905ac14e621636d76d049bddd86f0cf8a6c0fb38cbb000d5af5df9356fce09a1253465e7e1e3ba8723ac09aa01dc0aecabc0dd0e6d

  • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

    Filesize

    1.2MB

    MD5

    c47820c13ae9dc66335f3d5b91d7f46c

    SHA1

    49c07f3b33bda69d4e9058fc6dcbaca55655c724

    SHA256

    309243d7a8b1e247de7ab80c2e8ee143d870c8c512b9be038c7d75fecf89a363

    SHA512

    4daaac1d43dade165a9df38a36e5401615d1ad6847681d98ac66d904d6bc21ea5a0404e8897f27fb58505e3e1dfbfa9241fd34c315e078d795c88521c7284478

  • C:\Program Files\Java\jdk-1.8\bin\klist.exe

    Filesize

    1.2MB

    MD5

    e51909925a9251dbb5125f9a8787c20e

    SHA1

    8ac2cf0471ec2148923309dfb7aa7f5f819f4e57

    SHA256

    0ce3fc326444f18196e3da7979c113abb86d1b5b694ddacf1d3774a4fd57ea6e

    SHA512

    4bec7b849fd3e35b4e31a5a957f3138753eb35314f866fc32432dcb0a02765e67966348b3a4281fceed310730b1b2f947b9fb84d1d4eca8bdf4d1ff4bdd0b6f8

  • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

    Filesize

    1.2MB

    MD5

    f716791eb2543c71f912af6b007e596f

    SHA1

    5d92e4f48629b937d418132090bbb0ae464deae1

    SHA256

    72d23e0cf7c3048653380a217449e2fb753e4ee61d02a49310de8b36cd34c925

    SHA512

    38edfa8021b876f16ca238fc01b0af35af3040248ece9b5fd5662867684484ff619cdef545093af0ca3aa5da555cbb98598842246eceab9c5eaaa6b8120d59e2

  • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

    Filesize

    1.2MB

    MD5

    9f7168c656860eed17af22fb92b5344e

    SHA1

    925d24eeb5ed236e4556a5385a52be078b48b85a

    SHA256

    4274b3fe4119a0881252f778a78f20023719eb4f79114b614b48d6ed2db22882

    SHA512

    21b2cf8cf606dd64d653582c3589c951c73c3304accc3abd5c5c1b0b2f73c852150e10c2b280b311e3ad0e3c15703fb06262a4c25d81533a36cd40f4bd56a0dc

  • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

    Filesize

    1.2MB

    MD5

    9c5a5c81bb722c5fbdf37fc6a0f705a1

    SHA1

    ac0f13863e3fc5418697bdba03d4dd711d99e91b

    SHA256

    c751cfd206fbc77e4a9e2f5151e6a05e69357bc4d05d0724ff4a61105dade728

    SHA512

    50d6b059b08865703c6d32ed740beb9a5324699a307902f208744992704496f93162dd6294b1b334604b182903d49059e9a11d3762a00e6bb662e13a7c11f0e8

  • C:\Program Files\Java\jdk-1.8\bin\pack200.exe

    Filesize

    1.2MB

    MD5

    7914edc35b4d93bd4b433ef4c29d61d5

    SHA1

    c2f62ee892dfc4597877f50942dcfffed974d822

    SHA256

    63f4e7a55fe8a901ca8c606f51561494becdfc4fa1223b9aa3599015600146ba

    SHA512

    17a06fd499b976d11341dbab66980e10253e01bb67155c380b2e8095ffa6357d00f794266fd6875835c6264a611d9c8a47b817db3ae67334d385da897829c2a2

  • C:\Program Files\Java\jdk-1.8\bin\policytool.exe

    Filesize

    1.2MB

    MD5

    1e73ad951770c6ee70af1827e573bb97

    SHA1

    07712f4250a07e0d70f8335f3a01e72d0d16d9a8

    SHA256

    a82176cb4faf4e4042c066501d49c7c1e7956cf80264c185b76a447c9720ea2b

    SHA512

    d2493bb6a04610f3085d70e30cd18d4a5ed06be208716197882ba6a0fb22f968853aaf0d35e094577762ca42cf30a190871be3ebe657beb9c525e5033f61ae9b

  • C:\Program Files\Java\jdk-1.8\bin\rmic.exe

    Filesize

    1.2MB

    MD5

    243c111fe0ff722ce15c34b2a24524c3

    SHA1

    cbcde80a896ca6978d6b79c4a93fa80031c8141b

    SHA256

    6e6ffe938c607109c69f257aa88ff8aee4c5514841d0cdda856f4d5c33c820a6

    SHA512

    86791e066cb21eb9d2f32ef4e83ae5527d8252f694f6489a1be577377ca1922b6aaff54946d05bb51e401075671af4d6d7b931aae06ad5f3d328f18e29cc4f81

  • C:\Program Files\dotnet\dotnet.exe

    Filesize

    1.3MB

    MD5

    ec29f6d5a2b3cb69d66ba7026d859fd4

    SHA1

    1085ad33a08edd4fb3f828db14ebb46cea594471

    SHA256

    71d85843cc1a48ecc8b225e48db7a857bb572b12d459faf02a16b387d1175280

    SHA512

    6625973e2815b34db1a972bcb71bc13bc62739aabab0d4e1554ed029c2f56e9be5e5a7b75dbb7a3edc3eb11fb6521962a27fce8597aa1396a014c56e4e0dc007

  • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

    Filesize

    1.2MB

    MD5

    7744c4e81c066b06b48df836b2d619aa

    SHA1

    0adc17e4471c45f91457e5e28f2dbb2219667bcd

    SHA256

    3a045c69cb11f898eb9d4e0f678053e1701345264e1a0278226727828cec4bed

    SHA512

    aefabd6f8ce513b17cbd73d9e985a3ba5ee4cb00c69648c1b550b02736b6519dc3fd5f9974fc7c30f5a8c7f89effb359eff2a57016c76cf51b1d8093d1e7b147

  • C:\Windows\System32\alg.exe

    Filesize

    1.2MB

    MD5

    a94209c2aa288120789389205cf26e58

    SHA1

    aecc71cd511c995ab0f2c8ae1b31f5b628aac881

    SHA256

    62b1af2f2636392eaf87bafe620fa90deddeefcc265e05abaf1745b328491c94

    SHA512

    ca7312a783f9cfa4c369e5fc112cc018cb7b64066b86c178d9c8c73250babbe9d66aa715b49e16b49b63cf828016b48d3fe5ce45745172abf76ccbb5aab13fc0

  • C:\Windows\system32\AppVClient.exe

    Filesize

    1.3MB

    MD5

    1875cdff73ad095f63367c1b7b326292

    SHA1

    e205fa4e6ea259ddc3d73ceccb1db34290048fc9

    SHA256

    d02e03cf56fa0a13564be8199199d97af33347ee5ce71b482d0d2323cf9a5c32

    SHA512

    df30ec12cdb9bf106fe8649fc76d6f04da5d2911f0991aabda2b095bb3c08b107db48db7361a7a414a30b15b7a433601a9cc4be584769cb56eec9e9a2209eeab

  • memory/1236-50-0x0000000000510000-0x0000000000570000-memory.dmp

    Filesize

    384KB

  • memory/1236-48-0x0000000140000000-0x0000000140234000-memory.dmp

    Filesize

    2.2MB

  • memory/1236-249-0x0000000140000000-0x0000000140234000-memory.dmp

    Filesize

    2.2MB

  • memory/1236-49-0x0000000000510000-0x0000000000570000-memory.dmp

    Filesize

    384KB

  • memory/1236-42-0x0000000000510000-0x0000000000570000-memory.dmp

    Filesize

    384KB

  • memory/1260-86-0x0000000140000000-0x0000000140166000-memory.dmp

    Filesize

    1.4MB

  • memory/1260-78-0x00000000007F0000-0x0000000000850000-memory.dmp

    Filesize

    384KB

  • memory/1260-251-0x0000000140000000-0x0000000140166000-memory.dmp

    Filesize

    1.4MB

  • memory/1260-84-0x00000000007F0000-0x0000000000850000-memory.dmp

    Filesize

    384KB

  • memory/1360-38-0x0000000000400000-0x000000000059B000-memory.dmp

    Filesize

    1.6MB

  • memory/1360-0-0x0000000000400000-0x000000000059B000-memory.dmp

    Filesize

    1.6MB

  • memory/1360-7-0x0000000000C80000-0x0000000000CE6000-memory.dmp

    Filesize

    408KB

  • memory/1360-1-0x0000000000C80000-0x0000000000CE6000-memory.dmp

    Filesize

    408KB

  • memory/1360-6-0x0000000000C80000-0x0000000000CE6000-memory.dmp

    Filesize

    408KB

  • memory/3036-93-0x0000000140000000-0x0000000140166000-memory.dmp

    Filesize

    1.4MB

  • memory/3036-87-0x0000000000CD0000-0x0000000000D30000-memory.dmp

    Filesize

    384KB

  • memory/3036-66-0x0000000000CD0000-0x0000000000D30000-memory.dmp

    Filesize

    384KB

  • memory/3036-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

    Filesize

    384KB

  • memory/3036-76-0x0000000140000000-0x0000000140166000-memory.dmp

    Filesize

    1.4MB

  • memory/3672-29-0x0000000000580000-0x00000000005E0000-memory.dmp

    Filesize

    384KB

  • memory/3672-37-0x0000000140000000-0x0000000140140000-memory.dmp

    Filesize

    1.2MB

  • memory/3672-39-0x0000000000580000-0x00000000005E0000-memory.dmp

    Filesize

    384KB

  • memory/3672-246-0x0000000140000000-0x0000000140140000-memory.dmp

    Filesize

    1.2MB

  • memory/4032-62-0x0000000140000000-0x000000014022B000-memory.dmp

    Filesize

    2.2MB

  • memory/4032-63-0x00000000001A0000-0x0000000000200000-memory.dmp

    Filesize

    384KB

  • memory/4032-54-0x00000000001A0000-0x0000000000200000-memory.dmp

    Filesize

    384KB

  • memory/4032-250-0x0000000140000000-0x000000014022B000-memory.dmp

    Filesize

    2.2MB

  • memory/4948-20-0x0000000140000000-0x0000000140141000-memory.dmp

    Filesize

    1.3MB

  • memory/4948-21-0x0000000000710000-0x0000000000770000-memory.dmp

    Filesize

    384KB

  • memory/4948-12-0x0000000000710000-0x0000000000770000-memory.dmp

    Filesize

    384KB

  • memory/4948-245-0x0000000140000000-0x0000000140141000-memory.dmp

    Filesize

    1.3MB