Overview

overview

10

Static

static

3

7b13d92a5b...18.exe

windows7-x64

7

7b13d92a5b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28-10-2024 23:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    7b13d92a5bfc7ee0ee5d9c86eb07ce23

  • SHA1

    c2f5566d2a142388b9b7887c6e86ad9c619f8003

  • SHA256

    0e4e50cd144c54ef6eaae2464d15977f3b60b2001118cfe6392731ccc671137c

  • SHA512

    9e824a2ea95ffae8da28ec88ca6288250681a6064b8ac61210d12382f798121466d688ded6d18add1ddb85463a793d7b92cd97b13369598d832a1f6138600de1

  • SSDEEP

    24576:Rj/ZAILiXtDtrn+LCHVYmpRqQYAe9GIdUfd40Qb4B/cWy52:RT+gibn++HV3pcQY7bdU1Qu/BM2

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 6 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext 18 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe"
          4⤵
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2456
          • C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe"
            5⤵
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2852
            • C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe"
              6⤵
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1688
              • C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118.exe"
                7⤵
                • Drops startup file
                • Loads dropped DLL
                • Drops autorun.inf file
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2652
            • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1752
              • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:864
                • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
                  "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1596
                  • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2892
                    • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
                      "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2828
                      • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:988
                        • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
                          "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
                          12⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2376
                          • C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops autorun.inf file
                            • Drops file in Program Files directory
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:2876
                        • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
                          "C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2748
                      • C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"
                        11⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1480
          • C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2020
            • C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2284
              • C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2256
                • C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
                  "C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3052
                  • C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1440
                    • C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
                      "C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1144
                      • C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1512
                        • C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
                          "C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
                          12⤵
                          • Executes dropped EXE
                          • Drops autorun.inf file
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:2300
                      • C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
                        11⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2480
                    • C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
                      "C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"
                      10⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2804
          • C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jdk1.7.0_80\bin\vjavaws.ico
    Filesize

    4KB

    MD5

    38b41d03e9dfcbbd08210c5f0b50ba71

    SHA1

    2fbfde75ce9fe8423d8e7720bf7408cedcb57a70

    SHA256

    611f2cb2e03bd8dbcb584cd0a1c48accfba072dd3fc4e6d3144e2062553637f5

    SHA512

    ec97556b6ff6023d9e6302ba586ef27b1b54fbf7e8ac04ff318aa4694f13ad343049210ef17b7b603963984c1340589665d67d9c65fec0f91053ff43b1401ba9

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
    Filesize

    1.2MB

    MD5

    7b13d92a5bfc7ee0ee5d9c86eb07ce23

    SHA1

    c2f5566d2a142388b9b7887c6e86ad9c619f8003

    SHA256

    0e4e50cd144c54ef6eaae2464d15977f3b60b2001118cfe6392731ccc671137c

    SHA512

    9e824a2ea95ffae8da28ec88ca6288250681a6064b8ac61210d12382f798121466d688ded6d18add1ddb85463a793d7b92cd97b13369598d832a1f6138600de1

    Download Submit

  • F:\autorun.inf
    Filesize

    102B

    MD5

    5513829683bff23161ca7d8595c25c72

    SHA1

    9961b65bbd3bac109dddd3a161fc30650e8a7096

    SHA256

    94e323bd9071db7369ade16f45454e7a0dbfb6a39efddc1234c4719d1f7ee4c2

    SHA512

    308c84446106cda0a71e37b0de46aaf4b7361f9ddcc3c4c29f8e87da8acb606525dce8a42caf9d74e708c56b31c524f9535a2f5f4757c6c357401da1c495ddb6

    Download Submit

  • \Program Files\7-Zip\v7z.exe
    Filesize

    544KB

    MD5

    9a1dd1d96481d61934dcc2d568971d06

    SHA1

    f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

    SHA256

    8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

    SHA512

    7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

    Download Submit

  • \Program Files\7-Zip\v7zFM.exe
    Filesize

    930KB

    MD5

    30ac0b832d75598fb3ec37b6f2a8c86a

    SHA1

    6f47dbfd6ff36df7ba581a4cef024da527dc3046

    SHA256

    1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

    SHA512

    505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

    Download Submit

  • \Program Files\7-Zip\v7zG.exe
    Filesize

    684KB

    MD5

    50f289df0c19484e970849aac4e6f977

    SHA1

    3dc77c8830836ab844975eb002149b66da2e10be

    SHA256

    b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305

    SHA512

    877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38

    Download Submit

  • \Program Files\7-Zip\vUninstall.exe
    Filesize

    14KB

    MD5

    ad782ffac62e14e2269bf1379bccbaae

    SHA1

    9539773b550e902a35764574a2be2d05bc0d8afc

    SHA256

    1c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8

    SHA512

    a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2

    Download Submit

  • \Program Files\Common Files\Microsoft Shared\OFFICE14\vMSOXMLED.EXE
    Filesize

    118KB

    MD5

    f45a7db6aec433fd579774dfdb3eaa89

    SHA1

    2f8773cc2b720143776a0909d19b98c4954b39cc

    SHA256

    2bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a

    SHA512

    03a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662

    Download Submit

  • \Program Files\Google\Chrome\Application\106.0.5249.119\Installer\vchrmstp.exe
    Filesize

    4.3MB

    MD5

    2161730a7ae00a1fb8c5020a43be949f

    SHA1

    8db6b820472cdfa266c874e0d3a9395412995aa1

    SHA256

    07e7896b2304e3b9966294a02d2ed32f41994ee7bd0a284e4160743edaeb9e15

    SHA512

    aa3659b6184f4273b7fcf1f7d2cd0a5a9129b8856d15e4ca8904b709e85cd432538ce0510ca9777760a1a9d5391671232a79908860e7d665260a54910f6fea5a

    Download Submit

  • \Program Files\Google\Chrome\Application\106.0.5249.119\vchrome_pwa_launcher.exe
    Filesize

    1.6MB

    MD5

    527e039ba9add8a7fac3a6bc30a6d476

    SHA1

    729a329265eda72cada039c1941e7c672addfc19

    SHA256

    4b8a72fc81b733ed2e6e70d4c5401f954002783dbf14927849ad579860780b94

    SHA512

    9e73e14e33a5f07a87e9c1fecfdaee09d1408471052aacfde3d1e877dad4d253b525ebefca6bddabc23cf81d8dcce0785aedcc2f135d171ecbb1feaeb922c449

    Download Submit

  • \Program Files\Google\Chrome\Application\106.0.5249.119\velevation_service.exe
    Filesize

    1.6MB

    MD5

    ec6386b63c3a5ffe0577905e94262c3a

    SHA1

    8f8c428d0e7f32c9d733ca28384ded413a060588

    SHA256

    302c968ab3e1227d54df4e72f39088d7483d25eeb3037f0b16bc39cef2728fa4

    SHA512

    ddbefb759858493de1f9d7addc6ff4488c8be3164374e0a88c3cbe97751510005dfe6d91c5499fcbdc35aa33a8eda2d45591a66e54ab9462277dc833faef77c3

    Download Submit

  • \Program Files\Google\Chrome\Application\106.0.5249.119\vnotification_helper.exe
    Filesize

    1.2MB

    MD5

    81664a918656ecd5e8eca90cedba1150

    SHA1

    580d0eb98bb2c838ff89eb54efd86535ee8882f6

    SHA256

    2f664c756727c321a3a0fb6c6e68842ca1a5f20575a02312ea10675dbd5dc40e

    SHA512

    7a211a01c674aaa5e8052dd339b412892c452309b651e835f0b8e27f15ee3fed42c58f43910a202150ca90704f522499deb7bca055451f1e6c8515b2d491df3d

    Download Submit

  • \Program Files\Google\Chrome\Application\vchrome.exe
    Filesize

    2.8MB

    MD5

    095092f4e746810c5829038d48afd55a

    SHA1

    246eb3d41194dddc826049bbafeb6fc522ec044a

    SHA256

    2f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588

    SHA512

    7f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400

    Download Submit

  • \Program Files\Google\Chrome\Application\vchrome_proxy.exe
    Filesize

    1020KB

    MD5

    b65d7344b0a7faa207d2e1a7adaafb60

    SHA1

    755ad15b1745b0e730d658d4a92e2b754425b7db

    SHA256

    f4b91fbbcba8a46eefe4965e4a24c6ede3decbd1fec96e141a1953173efd1c92

    SHA512

    f17ac73c2df7c73a31b11ce0f533d6db91bdb0cdeea653dcd52ac72c3cf28da0c236b79586ddc7a6c825fdd171290722f888465e776f12ac2cae75be82726b22

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vappletviewer.exe
    Filesize

    15KB

    MD5

    c9aaf1247944e0928d6a7eae35e8cdc4

    SHA1

    af91d57336d495bb220d8f72dcf59f34f5998fd3

    SHA256

    05b153ba07dc1a262fb1013d42bfc24d9000ce607f07d227593c975cdf0bb25b

    SHA512

    bf3bc64135810948626105a8f76dc4439e68ee531f20d901c3082ae2155f2ea35f34d408de44b46ede61ded832fcc61ac1cb9719e432f0f07b49479c95847e51

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vapt.exe
    Filesize

    15KB

    MD5

    407d2d7dab36cdea871d4c6b9c62b258

    SHA1

    86cd158ad810c6772c22a5799c7acf4b9d7c9f57

    SHA256

    3c040679ea4be0cc5ca20c9f24caf6c13d3002560347e7446dc963b611523bd9

    SHA512

    dcdb53a3ca2a3637216a9d8133d1dbda336a6d3a98c6b956af42f94adbc136dc5a0245e87512d0314f23dbf3cab4900bc40ac13c79ee93a677d93a89e0cd9e17

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vextcheck.exe
    Filesize

    15KB

    MD5

    1cb4c95888edfdedb61628680fffd415

    SHA1

    3336670c701c61bb8062d7620c4244dbc01756d1

    SHA256

    182d8ab5ec2ee2ec57d60c2d2d75df6c852810e74c50289aa9c2c99a6b050fc6

    SHA512

    24c8c05baef516fba5aa763c0abc603065a75e5816501c713b24ec8baddad4fc290b3973dad89ac65f09d0277c2fa72d8b00f0eb2871170dbd89a8d9062bacf3

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vidlj.exe
    Filesize

    15KB

    MD5

    26b70aa2ab871a72a3fd30829f2f1f29

    SHA1

    73934bad6bf5ca22484a88e1a4b1263ae278c419

    SHA256

    4e11bf944fb0a34c5cf1871fec3c8f7473e1944642cadf89a86db2eed874d35f

    SHA512

    40cacfff6c7f47aa0703e8cb3186f8bacbff1d56dc0547d67c44e716fc0d28705995a439a88a02ce8a262628b33cf2f6ec6f0586cdc2fc86597e3da4fb6a1d84

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjabswitch.exe
    Filesize

    54KB

    MD5

    502e87232756dfacda7d1686d4bc9ea4

    SHA1

    6e40897d0a957783b8b88f2a6487dba028954b22

    SHA256

    d230ada81f3add58fd8a646d25b8f25fe6271b3eed5edef9fdc8945baabd5631

    SHA512

    96366e76942f6da30c02e9f6cf7cdf0cb7550455c8cbaaae7358d15a2258e1f0b2bfa960d52cb774039f2070dc8c383c3df187805f4910d40601b853e4309d9b

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjar.exe
    Filesize

    15KB

    MD5

    3eeb342d48cfaa4c568a93ffdfc847d0

    SHA1

    ed5fd565c4a1867ca554314f038fc20c7de01b90

    SHA256

    29e65344e34c2354da05e8de64b106aa0ec99d8c5c22b58797d0047e227879ff

    SHA512

    db5b84233d40139c44cb8fd1a43e1c8a41c967358641e1488cc19474a8de381c5aa2c84f61b10d69d019f0d7170177cccea47ce9460d409a480c8537232a2ef0

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjarsigner.exe
    Filesize

    15KB

    MD5

    2f7770a34bb22b99f8f6966851331d82

    SHA1

    2a2860cde1482df656544e1983e957f815be4193

    SHA256

    f873c02b69408f905c2c0b35b188d2c0b0a7cccc98a59d18dd0c297f761d2ef7

    SHA512

    8611f8bace081711d6f5dcd41177f594314970c5b2f328755027383e4ad2a239bbd85e0cedf6d1a76d9d1f54afbd340c9bd4ab119bb87cfd5a11149a0cb71dfc

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjava-rmi.exe
    Filesize

    15KB

    MD5

    a5f4cccc602a42b4ddbd8acbcf34f158

    SHA1

    5f26277884b2f6cdac26267f9b582ac5a5d21b08

    SHA256

    2d9044e9265fc09680d5f0c054c4ccac7d8d14b3a4a42e803a2097108e0f1acc

    SHA512

    3cb0d0028468edb1687c6142ce3ed6b594428bd209bf8b85ab2315e7992af12c4d622f26e652d6be0718d51d0d6a171c0a881b36d2e67a199998442e91621149

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjava.exe
    Filesize

    185KB

    MD5

    641b4ed6ab90a6f52ee512ea88a64cd1

    SHA1

    28d014900accc98e6089d83d0b2a8cb8735ed101

    SHA256

    13590945a04037dfd15d61166e0771682c7809674fca42f53fdb3afdcbe21410

    SHA512

    00a588556196e305dbf1714e573a5c5516c2988356b984a7284ba017a78bacb8d576b590da35be40171d6dca73580c5b9ab06808c7246c2e13c8d9b816f2ca09

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjavac.exe
    Filesize

    15KB

    MD5

    000b77a2ed92887856174641dfb6f485

    SHA1

    7872d9768f3a4b0601b91bd0b55f08c8992819e6

    SHA256

    1100a8d298426491aeb34288f7d6e600622f2d94fc01bfeb093fcea3ac32a8e4

    SHA512

    cec8642269bee8162b8d317ba61777b4005cb2dae8e9837bfd336bc6fd633066cd52b878160f4496113c147a7d0374619367e9bb451e82f7a5a39f0db3fde152

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjavadoc.exe
    Filesize

    15KB

    MD5

    516f6320ae4d755b9ea0c7c8347f5801

    SHA1

    bfce7c2869725ec8f327b083be57d20671fcb2a2

    SHA256

    9e696aa5772e8cba27545b47b00be4a3b8fc888f8c83ca11939b753850feab14

    SHA512

    0e12bc2f01f2897df41e56cee150177a3cc09ca5e889b61fcb9dbe07391a6f2537454401a2ca2ad93c652303a8e5782fd9860ca83734401393e314570175a6f0

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjavafxpackager.exe
    Filesize

    78KB

    MD5

    cace8f27a66ffec4f9823aa258c307a9

    SHA1

    dc515d29aa43d2b6b7e157f05e97e87d5f785884

    SHA256

    3cf626dac6e91a03f688bf5ab674871a3e0411314f261bb2c69346a1c46bc733

    SHA512

    4a5d5b564bd483e1949826d388e41c63a7b056236c5972c76721fd98c9b704a79622ed4c1b045080e4470340a9953595df955148999e15677f0e38e529a6a5f7

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjavah.exe
    Filesize

    15KB

    MD5

    8ffd9b7406e8aecf1d6117606d2bd149

    SHA1

    edf1f0f2f1024cd0fb6b39dadca251c99ccdedcc

    SHA256

    dd6b65e78cb194055494bbb7736ef917d3d6da1863567afe50b8abfc8e51267d

    SHA512

    ee54a1bec20608477053e87c641cc59dfe3c5a77061395c9d41759c3c559d6d5e8761b75327f3a05e62c602031650ec0be375a1b2235a944048ab340efce7397

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjavap.exe
    Filesize

    15KB

    MD5

    95cf3bf094a35c9e7434bc402c09630c

    SHA1

    2b4d21ee55666f0664a644ec443502a942b9e7d4

    SHA256

    4973b97a274648d53977499891b919f98684fdbebce10751d71ce4d2754f6622

    SHA512

    09db399afec354ab699701f4196e93178db613421beda9e695bc36414698f83084d05b70595d2b31fe2a0d757ba98640f7e3953defb8dd71df03e4c01391fe8e

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjavaw.exe
    Filesize

    185KB

    MD5

    0266d98252b6beee2e842d5e876031a8

    SHA1

    8d57c6d94835ac6b1b0f9a657af6baa4be25779d

    SHA256

    c5d59069dcaf86222c9c189c8ba8932ced66ab77b4baad485e1f0ac715e6037c

    SHA512

    7eebbff75a67a0408ff2f507d9f1b387dcfbe6765ccd4247fd78a64c2ea6090e88fd30f561e30f48bc107dd9378364fd18dba4ea22eedee76a1f993fbb1e9f32

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjavaws.exe
    Filesize

    312KB

    MD5

    bf91501c9b39c728ade2cf3788b647c8

    SHA1

    fbcb53c4ca9836f5bbfbb2b63e7a1a00a6bf10c6

    SHA256

    d602330327fd3630d625c9023131fd2318f677c67aa421631b8a4080dba38578

    SHA512

    01a6639a580bd418cc4d1dd2bd8794f356c08b6f7fa801245e9200c883d32c6b103aeac2615195868a8e63e3515911de2a9afcced21f62fc41edefdd0a66001c

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjcmd.exe
    Filesize

    15KB

    MD5

    36e8cb42bbfc16e1395a88d183caed83

    SHA1

    ca1c513aaa7d49adfe0f43ceec81e6d0c0ae67d8

    SHA256

    40ea55ebd7ef975135dafffb396871a8ab728abc24b42eaab76f08859994e996

    SHA512

    f7620b06a5d43d21a0d492b66b0e5bacea6918f1490fb0504e9440524b7ef02ba83d2ae3c2211113b478b8325a3a6b6c8f65939ef5a01b835451cce2e72de00f

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjconsole.exe
    Filesize

    16KB

    MD5

    805f6272e5e3a80aac3540cc5b42b08e

    SHA1

    437bee3476647f7b55a49630cb86ed4befc34293

    SHA256

    910dbe44d17bd60a295a956e98e18347080cc879ed7ef7241cd2d0edfc060551

    SHA512

    319f8f50dfca4adf148edf878fa7c83bc6e4f1053da0c7d412645fcae9c63e67b838c876838805d9a33b28067947d3844479c9ddab11eb9e760b9df285f27041

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjdb.exe
    Filesize

    15KB

    MD5

    0b5681808a793728fc658f1e9b94ec52

    SHA1

    05763b10f153447edcc08afeeeee71fa2f221033

    SHA256

    d18fab0d0e24e8f1d9551e2667f6b2c34fcd75232c39e85ce50660588174079f

    SHA512

    65e64980a30285b29888b9eeb66ec1c27c98a15effd67d761c3c62358e3ec008fbda61feda4fada8f9af8bce740b8f38236495c6f1b274d98c14209cd56b414c

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjhat.exe
    Filesize

    15KB

    MD5

    1dbd51882c2b82a5496106c31db425f1

    SHA1

    f47bee48a7d0da0c4930cccc6fe7a8d8600d4b05

    SHA256

    659fecc81e846405613c2080ac81a567df17c97449a9c2ba179ac216280223db

    SHA512

    81418b0510b58f782b843312069842aeeede8d35feb8f393807169398464896f281dc13bc82d51279a07adfbe97758b82143218cf9a56d653b3a9d11da62f50f

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjinfo.exe
    Filesize

    16KB

    MD5

    f499825b88d200d9348b5f97ff297ec7

    SHA1

    366adce5911c160fa26d6fdb4d65af357cf0e3bc

    SHA256

    8b2d599efa66da695e503b480f355fc5f22347fcf5c294100abaeb3e9a20c1f6

    SHA512

    3017bf630ba53ee0855d1e657df197732e4fe2fa6455fabad2085e5a24918589d487362fc2819fff85b3fcf7e684376d4b7a5bbc6e71ea57cc62ab397a87dba9

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjmap.exe
    Filesize

    16KB

    MD5

    30989429490b9ccbde4fae1fc6df84e4

    SHA1

    64c8cf20ebb4e8dc31521f0084eb046a9e3f0500

    SHA256

    aa98634e3668beae535738d25c2094a7ef0d855ebd9d945b484368f9e543bc0d

    SHA512

    9a78ed9cd8dcf333ea240ff309e24a2e5de39bbeba4e9291b55d51fdbc10ee672c674a9f4393b13819562a0d9bc99667eb03519cefed0218444874f15729eefe

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjmc.exe
    Filesize

    314KB

    MD5

    c8db7998995218d59addc586ce9679d6

    SHA1

    694f18eef5aa6dfe1aa607ad5a08980f9656ed07

    SHA256

    e3712cd917e4d41696165a98233443d63dbfb28560967de92ca4e707c50d7df2

    SHA512

    ba7bdfae350c4b98067a2875295a20fbee1b7e9cb1f1afde1a299ca1b8d6aab3996dec59119cd83214461018e5e4ff91894ad3f0e909359382cf5183811d3d12

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjps.exe
    Filesize

    15KB

    MD5

    4ce9dbe70ae911f1fef704e2c5594214

    SHA1

    3431c1d6fa21e04e79f0b2f48cd30b037ab009cb

    SHA256

    e45733934ff8c01f79a98ea2fd6b2a78fc5f0164e5d4fea7aef5119c7218a5fd

    SHA512

    291420138d84108ebbb8f3dc81bc4595206144b8eac0a459ae63754aa137a3d6789330dc764c6dafb5cecc76908166d93cccaecbcb3987d4cbba662980ee6359

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjrunscript.exe
    Filesize

    15KB

    MD5

    c77fa8599058f2f08f6f028ad1ba3d29

    SHA1

    ea42e7eed011b8b71f32d4d47827a5b56198d134

    SHA256

    db2beff59876773d223f4813c05c65a1e582604c420ae6d7f6f3844a0a060398

    SHA512

    f2834be1925ca448884877e7236d2febb72190ebf43a2dab29a76b71c4976360d56df17879966ec74c60b3d62dadd81d577e3034961ed64418c0300f9710f43f

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjsadebugd.exe
    Filesize

    15KB

    MD5

    da1c77dc8b88afc927144ac6814ffecc

    SHA1

    ff50b5fefd7275f3972f2e3f228384816fe22e63

    SHA256

    78d50c2ca489676456b3a0ccd1696dda0f1e1e144baacd26cdbc472869578b30

    SHA512

    02fbc972c889a71947b2671bcc7e22f9a0edce3e0462f332753d974d73035315aef7b4ae1069e309aa560f98065b792447b2ef8f1e8be1874969de916b2f3e25

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjstack.exe
    Filesize

    16KB

    MD5

    095d24917473c666b8906e45852378f7

    SHA1

    2ca5842715ad03982eb9094786832775926e4b4d

    SHA256

    3289a0fb8c701e7eae9fc792329c0eff6cd2a42ffbf1845f4e630a3e1a019529

    SHA512

    fba9fe4ca6498c9fcf0d251906b537286f2e7bdb2399293c71f9b0bce379c2684da14212231535a81889928fcbe0adf7354bc83e272a3f6d9082f125494cc50c

    Download Submit

  • \Program Files\Java\jdk1.7.0_80\bin\vjstat.exe
    Filesize

    15KB

    MD5

    f9ae41a829d457685c00b08ea9185e1d

    SHA1

    54eeb13931bfdd989decb7e807996b46b75f1cd6

    SHA256

    d122b3df7c2b81c5eee0d3165a6741fffbc2298a8eb41740dbe0092eecf3cd47

    SHA512

    fef83f2670a11536b57dc3a1d86d014b49b83c720976a5592bf6fef2ec45aeb62e269ce0759b150accfc77a94a28423c833b4ad0fbec6a7e0a4132a2b152a538

    Download Submit

  • \Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
    Filesize

    7KB

    MD5

    54b446b04c83570cc974ed428b416a63

    SHA1

    f6e9eb6319a45d381baef998ce45e50f247cbc7d

    SHA256

    ead396edbe63927c734b30f9275e52c4dde8fd3c1e53963cfdafb24f53e9fab4

    SHA512

    0d0129553c623c107d70d756c1d023f8f4463cd6d6517639e5ca2c79944285cfd23dffe98a3ca6c12b9d33501830de05c599d89d12a3ae5514ddd6c18b28e939

    Download Submit

  • \Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
    Filesize

    13KB

    MD5

    cf7e259dd0225ae86a29f5952bcb5b4d

    SHA1

    4c6b2363a754bcaa07edeee5b4837b464cfb5d5c

    SHA256

    bcf654651c834ff5f885a6ab272d000aa48acea1ebe68ce146c68c863c4736a8

    SHA512

    91c469f7b4d3c95177ccb013e3c16fe61fffa1fd631857f44bb335382b6c0c80d8bb178e72140178716312f49efbee45ccbe3467a01099561ab3ddf33b412b3a

    Download Submit

  • memory/2312-0-0x00000000745F1000-0x00000000745F2000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2312-1-0x00000000745F0000-0x0000000074B9B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2312-2-0x00000000745F0000-0x0000000074B9B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2312-3-0x00000000745F0000-0x0000000074B9B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2312-23-0x00000000745F0000-0x0000000074B9B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2456-66-0x0000000000080000-0x000000000019A000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2456-49-0x0000000000080000-0x000000000019A000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2456-51-0x0000000000080000-0x000000000019A000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2456-59-0x0000000000080000-0x000000000019A000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2456-63-0x0000000000080000-0x000000000019A000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2456-53-0x0000000000080000-0x000000000019A000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2456-55-0x0000000000080000-0x000000000019A000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2828-46-0x00000000745F0000-0x0000000074B9B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2828-38-0x0000000000310000-0x0000000000438000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2828-67-0x00000000745F0000-0x0000000074B9B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2828-28-0x0000000000310000-0x0000000000438000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2828-29-0x0000000000310000-0x0000000000438000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2828-47-0x00000000745F0000-0x0000000074B9B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2828-31-0x0000000000310000-0x0000000000438000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2828-25-0x0000000000310000-0x0000000000438000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2828-37-0x0000000000310000-0x0000000000438000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2828-42-0x0000000000310000-0x0000000000438000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2828-45-0x0000000000310000-0x0000000000438000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2852-74-0x0000000000460000-0x0000000000560000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2852-70-0x0000000000460000-0x0000000000560000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2852-72-0x0000000000460000-0x0000000000560000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2852-76-0x0000000000460000-0x0000000000560000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2852-79-0x0000000000460000-0x0000000000560000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2872-12-0x00000000004C0000-0x00000000005F4000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2872-6-0x00000000004C0000-0x00000000005F4000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2872-5-0x00000000004C0000-0x00000000005F4000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2872-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2872-24-0x00000000745F0000-0x0000000074B9B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2872-14-0x00000000004C0000-0x00000000005F4000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2872-18-0x00000000004C0000-0x00000000005F4000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2872-21-0x00000000004C0000-0x00000000005F4000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2872-8-0x00000000004C0000-0x00000000005F4000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2872-4-0x00000000004C0000-0x00000000005F4000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2872-48-0x00000000745F0000-0x0000000074B9B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2872-22-0x00000000745F0000-0x0000000074B9B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2872-36-0x00000000745F0000-0x0000000074B9B000-memory.dmp

    Filesize

    5.7MB

    Download