Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 12:45

General

  • Target

    2024-04-28_aff4a76fc3fdad06f1e674c8a0bf5ec7_bkransomware_karagany.exe

  • Size

    677KB

  • MD5

    aff4a76fc3fdad06f1e674c8a0bf5ec7

  • SHA1

    cad65e7f7f1a4c995e9920ea44530ad5dc94006d

  • SHA256

    4f8717d6659f923d707378eb4784d1c407f7fe95db30495d308118e1c80ba175

  • SHA512

    203aaeec46b6087dba336b748fbe5319d19448d20d1865c2b8d302457441640cf89211f238861360f1b4c524a87f4e6f90ac915a0c54c93d3ad53f85aa8b9995

  • SSDEEP

    12288:OvXk1egeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:yk1e7ozX0j52pMkuLoiSJVlIL29mhNq6

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-28_aff4a76fc3fdad06f1e674c8a0bf5ec7_bkransomware_karagany.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-28_aff4a76fc3fdad06f1e674c8a0bf5ec7_bkransomware_karagany.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2468
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3080
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2800
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:748
    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3700
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1128
    • C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4084
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:412
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4492
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:912

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Credential Access

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Collection

      Data from Local System

      1
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
        Filesize

        2.2MB

        MD5

        3bcee291014fe5859b982eeafa86ed73

        SHA1

        0fafee2b940ebe97f64d8928be4df23f1cb85100

        SHA256

        8e6468ff90acdda76391d059403e70387c242b7207eaa8e4f96103e163500876

        SHA512

        107e71f476797fce10131a7d04e470e3a2d268021bfdaa1b64c9e920a8a1aa0036b504af3b8a1f835c1f9a912740feb4f3181d8a04f073a458e63c7131f95e39

      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        Filesize

        781KB

        MD5

        67b2dd3b72ebd2e9ddf32647603cbf15

        SHA1

        20b4d4d43e75e56aa014be85be44f7d33f8ca73a

        SHA256

        6620547736a8cad98a31c8c6d271e8645004a2e61c0889b18b860adf3884ba66

        SHA512

        93bc880030d04cb55e92f987ba8b22f4c527cca9c2bb552c93f6bf5df9ac171ee825313bf126b279245a1eb3563f8e857f1d149a517349156b84634eac03639d

      • C:\Program Files\7-Zip\7z.exe
        Filesize

        1.1MB

        MD5

        baee8f181cf8d67b3957c2cf7b15704a

        SHA1

        ce5a06ce86822d90ac550f57f69206205d4cc806

        SHA256

        f33d64635f7a7df2f7fde4ce5a0a854c7596f5c5662ad1fca183454be8e78095

        SHA512

        fb8f71c13d2c67d08ffd31a887e2eda5b1532ab4a5cb3384eddae769a33740ec271572b4b8c8eed6c94da0b40d272153a5a04e3121387cb5980f4ae05a3cd6fd

      • C:\Program Files\7-Zip\7zFM.exe
        Filesize

        1.5MB

        MD5

        26fa44044820e4be269b013509c17208

        SHA1

        0eeda6b9e6ce89c714f95e99552be56923161f5f

        SHA256

        30e2e72fd67dd27324de2b9a2cc397a99516df1522e8da1fc3fb3c8c2a7ae146

        SHA512

        2b74ff2b998226d997f8c384c644e6121c798f878a063bc842509cdcb80cc7acaf42f04725bb92291c5de159689ce9e77617bb8a49a4ef791d84150cab8e084d

      • C:\Program Files\7-Zip\7zG.exe
        Filesize

        1.2MB

        MD5

        db58813819f249e009c51d3860dbadbd

        SHA1

        de1c10c08146c205a306879568989fae42f2c2b1

        SHA256

        d93dfe3b23a0ea74beb0df97e1b54372ee228209d853eb2f68ed3c7ca8ed178d

        SHA512

        225d9cced1b792b0a60c0dd068ca16a809d96ab2412c7a8c2359d27436d01b175e3f139b6ba8cf6f3afaa2c2eedc1aea7122072c44317004993812d645b67f04

      • C:\Program Files\7-Zip\Uninstall.exe
        Filesize

        582KB

        MD5

        7b04170047618059d583e649d6685906

        SHA1

        97f490c848cb311347f64009190f5571678f234c

        SHA256

        276d643e2098fbba52492f3678032bc71b183029a6f1db2a4b43f7c6086ca0d6

        SHA512

        859aa06227e7d5b9699edaea5e8b70d1b04bd3b0e4f5acfcfac79d4a6da04dd51955ddb4edbd4a6caf897fe42ee9f7c45383192003543d43d1566fe47c336b06

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        Filesize

        840KB

        MD5

        650f145f2b87284b2c5ddb93419db2bc

        SHA1

        a49787a6b09148a9adcdd8370c20ce380d0c7916

        SHA256

        f56a4f85d77850e3813dddc277556db37d8af68bfb22bb6862209af3dd6598f1

        SHA512

        55b732bbabb2b14c6ea200a6206ed3e561fea2366fb314d8d0e6f89ece57acf3ebff69d23095cc753a46d039f567a054f5cfe042aa158850cf14ad057100268b

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        Filesize

        4.6MB

        MD5

        4638cd9771ce5e0412239d43f11326cd

        SHA1

        d5d5f049fef6bac06f970abe13b7a4042801daa0

        SHA256

        a61ab71270fd4c23b34bf8394f8570ecbf56498ca744a0c7e4c9f7ce12f25668

        SHA512

        7d410117161f2224bf47f48944a3b10c2b4a59f4f2dc29a8cd42c0e9e58982431873f8ac29b22a2757236057b28bf4f9676f3507c19754e8aab3097a2853203b

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        Filesize

        910KB

        MD5

        be29c6bc083e269630f491564ab05e9a

        SHA1

        2430a09c319c6f9e59aa50122c8dd73ec6208bfe

        SHA256

        4ada968366f7b68284ac0af3062967a7ebe3dac2c88f50fd0d6194caa2634cf9

        SHA512

        ee2116a933e4f8ba950f024dc19ccff5679eac9d72e8a1efe8774e412873dd9c8e89fba1bdf552de06e0930d450bbcdee92d9f0f12e0d3d32b01c0902aa3d631

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        Filesize

        24.0MB

        MD5

        fc59ad03c52b80c04db9a6a8d3a610d6

        SHA1

        ae7ab27fe536865ea146fed864cb92b7e4189ca9

        SHA256

        b8916dd964c7a4b0b288aa1aa05822cb249e2afb36265da08cd3dcf61b881495

        SHA512

        8337e246dea4b9cedd9175cd176d35cb81cc041be2c85a83ebcc987f8c504ce13d7ce953aabb1c21d01649598ca43173e289cc7e8f12a4d77085c6d092df4954

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        Filesize

        2.7MB

        MD5

        1c01ae27f6b5c23c4e35488ae6695fdb

        SHA1

        855642790c4dd73f27c6fe32be53411d53ad8bd7

        SHA256

        ff3d9d6ed2bad72a0c7044e8dfe6703ee84bcb3f193c9844ad580c4ad5460c35

        SHA512

        cc0b3a9fb81e4bd35e3609bf1e2a94a523ee393f2c2cbf4f4606dd936650fbc205b98f151a113aaee74f9f9dcdc2391b52e92940fd529cd70029e09c89004ec6

      • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
        Filesize

        1.1MB

        MD5

        29509cc4eb955dc1f6d4a1ba88724565

        SHA1

        3a6d9169be98d360886ac4057557069901e54abe

        SHA256

        ccc16df4d83384b9f8d9f3abe8c596d97a503b252b99d57397c33876c0efbb0a

        SHA512

        45682943961669bbb8c372d8a670864004a8f7b4784b3cdb82f996e3a31b044f32558c650a3472a67c4d7c465c7b5ae9b21f3e0be6257e250525b0a9823de424

      • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        Filesize

        805KB

        MD5

        b879cf855de38901da932d3fc9509fa5

        SHA1

        c8f703cefe1811ecc9c3cfd368cbc2990a651961

        SHA256

        7fbd2f33057e3774d8fa910b2e7477125fdff593651b3a035dd175b7090484e1

        SHA512

        5932bfcb5d8cb8209f38383a25d94465b7c8967f1dc7742fbf5961e6dddf28e52cf27d417b5c8dc4819fb067fa3bf06333059d7885db8fea18cfe4fa858d6ed0

      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        Filesize

        656KB

        MD5

        4d6b3d76a53bef305c2687268f561973

        SHA1

        5277f85bbf41940343cd881d06db3270c45bbe97

        SHA256

        4d2f04b2c8f065478e01ea1ade25033b8929333352745143de129740ad26bec0

        SHA512

        d39a7af24e43e5f0a08afb567c716dd21bcb546b21d0e05bd43eb198388ee61570543a0c708dd9eb93e8a399d34d59fbfbec06e3c1b9262b7708358b7fd2f858

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        Filesize

        4.8MB

        MD5

        3eeb3132a9e0674bb178afc98347a36e

        SHA1

        2363187cfe7e95c529e7288c4beb86b9f55cb53d

        SHA256

        8052f8000ce3f0c67f612e5b5b0b72debb4fdabf8fc2d40b18d42c218faa2d1f

        SHA512

        fee413750a5b3ef45a43c77526ed76fd6a16da58c7947a8df3e48d1ede7a5b7f977ee049ad762e21175df4dcfb88d9d2f9cefd0bfd7c2505a15942a8fd286330

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
        Filesize

        4.8MB

        MD5

        1c8360b584a89fb749600e4a6137fb0e

        SHA1

        cd34320085510a7702d83f764af47bb3fef3ffea

        SHA256

        4207e620a8867bdf49906e5ee7a37bd3945aa22864d28c523e78e7f916096b2e

        SHA512

        d485019a0a99226f72aca36ad68a1ce05cdf872d26e4702fa58378ffdebb5025eb09312b10cbe9a0a167238b1f48dd524cfd2efb5d8df9706b318f1ad0afd06a

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
        Filesize

        2.2MB

        MD5

        1732bedb2c4b2ee2add72c3f0962c921

        SHA1

        c5f388c09304b3aea24d5d9e1d358649132dc23e

        SHA256

        a8134628d5ac688fce48ddf9f36b28d8709fc1ca75c2e691445a7ec4b1cef4b0

        SHA512

        0ab21d02ab8cb2a1c51ee8d065a118c1a95243dbadb6f40f1ecf1fcada2f76242b53954043bb4d3cff514a747a2d56ff16b071eb19bf2edf6739c6252ebb686b

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
        Filesize

        2.1MB

        MD5

        158911799ec885b2226cbc168af435c5

        SHA1

        e932221a5acbfff0d2f61291b7aab7ff7ef6e87e

        SHA256

        95438ecc1d04f02424cdea044bafc8aa60db771907d1b086d8612b5a0c471601

        SHA512

        bdc26465d49bf2330e14feb7f39734d295a3d89f54ed40b9e3843a3104ff17b0403638922760f8f4ba7ef1227e600884d899a54c7faf3ddacc76532dac61449a

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
        Filesize

        1.8MB

        MD5

        275f8a807a993593e993dfb9850ff809

        SHA1

        0a70ed100b706a7d23642b175ef8ab5f314bb8db

        SHA256

        41ab2e2455539f5cd6aac1335fc2ead0beecfb77c0b14bcdb93c33425478ad9e

        SHA512

        738da52b35533028c40ccc4cb9337496e8faa3b1ae08c608f1478a5a42f8cd71ec6f45b912c49546838fa75a5cfd60808c087de763848932c043ccfef9a0f50d

      • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        Filesize

        1.5MB

        MD5

        97e3fd4fb5f62b9426637f2f24092937

        SHA1

        f9eaff862d90e7c94b068c084776dd56c6d92820

        SHA256

        b46c653699c97d4759962acb787c0af696834d926f668dd3405d71941d1bf6d9

        SHA512

        5afbfc5d3ff0fabb627ca6465761e351d499da3c086554b824e68b67b076bb01a71c04c73a43e608c109a2cf4a55db750af241b51c59a5fd166254c861fc4ddd

      • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        Filesize

        581KB

        MD5

        b3971a7a4bb2280e747d791b7ddeb8a8

        SHA1

        15b26d05cc433b4b84e85d9ea3ade7dad0097691

        SHA256

        a405deec7da0876bb32c18aa50344189743746448025ed8615de556ba69737d4

        SHA512

        598ee00129cd3be320a7a6f7b772fe6116a03eaabf0ee6401be5d15e6f9800cc620ef37417394356989aeef8e5e8c7b2c168de24e6de5e75ad62b9d7eaa94ddf

      • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        Filesize

        581KB

        MD5

        535d4e2920804a2faa746d92da6442ee

        SHA1

        337c61ba9dd5ff717da564315c6e2a47ed51c2ac

        SHA256

        5d2957e6fce4fed64a77a4f93eceee150af81cd9776c48daf0130ae2d2b2c652

        SHA512

        3303f55618880cc04c670a75c5c56ea130cd66fec1c405622d63fed8e027f496930c48ce41f9da920c01e2d975e0a74185170de996a18eb0d41bc3d5af8febaf

      • C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        Filesize

        581KB

        MD5

        c5467ea0f28dfd1705ecc20fda4b5abe

        SHA1

        8daafb4c4f85e0ac34542694563df42f6ed5c1e0

        SHA256

        e76fb0021cb7cbc837f1350c220d2b1bbdfb19a4d58af7ed2284fb03090ea728

        SHA512

        95659dc37306d8723b37c44c63b48c0ac37bbe47002c73cbbe4df556b074fbcee6b31447378bc981a997a6be42b654fa07aa461da42b967d6150148ae7c6ca11

      • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        Filesize

        601KB

        MD5

        ef9158e3b8911e11fce5e7e8ca8868a7

        SHA1

        48bb72ef4d33460d5a53ccf6106655415302da9e

        SHA256

        9675ed17bd0bf8faf980b1dc61e9d72c3fc7b3a070b111d32bb172b7a022f66d

        SHA512

        10a4514a23cb7356ea7e832b8d537dc260211930934d912ce5a4bd68aed4c884be0ae7e3f768a76e2c71c15f0c85bee87232933613a1e27053ab3eb57864b26d

      • C:\Program Files\Java\jdk-1.8\bin\jar.exe
        Filesize

        581KB

        MD5

        ddafbb86b108fb22f909dbd6b8135c35

        SHA1

        1198da7999cabe20bdc988fa1ec2819ee7e75fb3

        SHA256

        1bbf2cbe306b750da502b58c183fbea68d7b2b0bd15505242b2357beaa2dfe7d

        SHA512

        b6455a161c5db3a64d90b4e3d9d33b6ff1a712027d6343642059e60118243af745e73550781c385463f3fd7aa40f75debe98044bbc5cb47ca4c6e86fab8475ed

      • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        Filesize

        581KB

        MD5

        d131e09dda21f56a23bbc3c72054a2b3

        SHA1

        a6b18464745b8313c9f7e291025af2756e3354ad

        SHA256

        3548689a06fd2c2c47b82e43b57b2593087354959374bef1427bde66fc8bfaa7

        SHA512

        e7fe5c73cbb9fe8319b3e90264fea34c69576b9fb150a32336753bcf1ade372200b6aa5de4623e970d35ea5bb30c8fec6d6b2dbb4114fe3bb8ea3019e595098d

      • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        Filesize

        581KB

        MD5

        5228d3fc31f86ad5b9748db9ae188ba1

        SHA1

        71726aa8694887da3e2e52470bc2d108c2ceeaeb

        SHA256

        60e6c7f8e11baeffef6c5ec436e0ebcba1cc4aca394b551a7a9ca8d12d78cf0f

        SHA512

        14e8e51883ea9534fe8dbce4500bb3568b062b06d1f494c1f0cfcd6e74c56ab2a3b610e5e051226f9afd07aa419a281d84330fd54b575874a1cd93f46923a357

      • C:\Program Files\Java\jdk-1.8\bin\java.exe
        Filesize

        841KB

        MD5

        c98c29082d33992ca522a245441b4e7a

        SHA1

        3ffdf25e6ac175e0fde0653362d3420334b2642a

        SHA256

        3f5bf7be64020acacb41627b9613d76a8da8bfe01d4e88e8b14a21cbdd5f0aea

        SHA512

        f8ccab6861755d3e7331c408a54a339038c42aa5338fcd4346bbd663470e13018aa7976b8ff2f8e577c7f076db9cb1f18c7a6920562d2ebc84d6e3c02c877669

      • C:\Program Files\Java\jdk-1.8\bin\javac.exe
        Filesize

        581KB

        MD5

        2435c841d0f256428d51f361f80b4f27

        SHA1

        2efbc4dffa66c7e8c6c6612d4ee83550938b641b

        SHA256

        d10135e0c1a87ea727d43c74b6fb52d5903428390750f8b2ab0d464f43b26015

        SHA512

        64606b152f4542e4f63f60a7ecedd860286ec973e94c7bee3443cec2116bf6ba5e6bcff859e93fd8eedafb6dbab2cd53779a31303ec62d370566431db8ef4111

      • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        Filesize

        581KB

        MD5

        91ca4b06d861c3e4c3d823c0da96f6b6

        SHA1

        dbeb7b5c3b60aa68e036b209679a5766a065b1ef

        SHA256

        f98457148d1cf0fd78e3c77d6d5ca3134dc50f3b1b0a9e51f6c75c5dfb1fef8f

        SHA512

        f561921938df7994118bde84df83f455890690be034045ea1c5bfdba0fa48d1e94f95e549d7d6845739f14ec05c7ed2f67816f3cf9766ffb7a31d64f4511147e

      • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        Filesize

        717KB

        MD5

        8919f85519c21b36bdd96c3d58688792

        SHA1

        65b6b0326c3d4eb541694ddfcdab1a601d669e67

        SHA256

        241786ec54d429d640ab4bcd827357bfaa7594e0f8410cdf124376568d6a0d1b

        SHA512

        2714203ce426aedb1c5829647ac52278718b20a459ef176aa843a03e478ad9324d3cf4404670a4cf8b24d967946689df6d0cac7d4e6ce388e5eb378cab90a50a

      • C:\Program Files\Java\jdk-1.8\bin\javah.exe
        Filesize

        581KB

        MD5

        38634438a365089f019e63e8e22d802a

        SHA1

        dffd13e2cb39bf90d31a155c5a822aa84c4cdc3f

        SHA256

        b52a47d659eab5e42a3021c0ba731edeea28bea2c7e3f7c5a5774bc359915d12

        SHA512

        a4097f519da55fa5ba28e5c4127e7bcebd7874b95a397f2121332f829637aa82a6de852a096b3d3241fc78449887676709f2a3ccbe97fba02df64b2817c9d09b

      • C:\Program Files\Java\jdk-1.8\bin\javap.exe
        Filesize

        581KB

        MD5

        7430740c5c8bcc41a3040974dc668733

        SHA1

        f2c1a7c88e61693b92220158252584080f01302b

        SHA256

        c3a7d5ee3f3613da4074507d8902c4f309ac359a35e9855ea7182d5e38e4ae9b

        SHA512

        43323de477762f54e6edd93b549a26a34baf3851c57a1612ae6969fe7ea6edf3c552fb29449dac1ac07c6235cf190a16b11d45c7b69c28d453e9dd421e9b285f

      • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        Filesize

        717KB

        MD5

        2397136bfecf0f39132b9099ed45383b

        SHA1

        1462ce20869bf3bca0651037f6ce41d8211edf8e

        SHA256

        40e800076feae83cb7410fff8b7382dae8bd6bd6217d41454aecb5cccf6a4261

        SHA512

        797c54be4dad26dcfb3341b0defc8f405eb4a1370304581ed609c7d37c87af8c6c8d92b64b0a252c1012fde42f74f77fc1ccd7e82413e23788e3ecf59e412851

      • C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        Filesize

        841KB

        MD5

        bd77f4a10c41d37ce198f25e42412355

        SHA1

        133b6660952b0e38e63bf48498e52da35a2c7037

        SHA256

        cbc8d525e4df12a9e96ba38cee59f9fa9897f1f72d34c6015d582bde87ce7b15

        SHA512

        8ed79b4a90751fb793f555282a9fbc1c12c6ae568fb1b5d9b6985982c89956ab72b9d6afe5820439091de2d36abfe150ee4d905bc5cfae89ee97543660d6fadf

      • C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        Filesize

        1020KB

        MD5

        30372e96eeed42cabc8d77f0b5a7d8cc

        SHA1

        7ebe9e8d75ce934911ec5f40477325f9763931c6

        SHA256

        cd53a34789086d8a1d48194627a9b347dab6c740613a999f06474859b1379bbc

        SHA512

        677dbeedd17d447c8b6a80c13e481fdd6c65fda287e70a0dc02f5ad0fc0f6a872e3252b99baa133d566981c2596b734968bdadab882db58301b010c7eb731431

      • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        Filesize

        581KB

        MD5

        083842e0c625250ba9ca8ea775ccd68b

        SHA1

        5e4f3af75c97f127c6f7f09eac2f572b5c34e811

        SHA256

        0dc76658f410c9ac4391993f4e5ed1ef7b474428f4138f7892239c55f1fb7ed9

        SHA512

        0a621f992153c3d5f9b82d12a797c50c71702f3bffbc553a7dbb600dfcb90382c33561e72d4752daa26d4b5aee53547202dc4af90c4e1dcd128089f56c9d8fbd

      • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        Filesize

        581KB

        MD5

        85337d60520c670392456f27d0f4e6c6

        SHA1

        d0a368e5412023f816060feaa0e50d7ef5d4b5fe

        SHA256

        fa2de8c4233717d2689f545e3e3c63195a6a2b6c4fa99b80ca047febeb1db8a5

        SHA512

        c2b8e9c10c51ceaa3574a4a4ed15552711faef2aeacfb523383c624a3c7a33a5d1d11dd3e9953f6a1605daf5edac5e73915fedc17c77ebecd9a87d038fc7891f

      • C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        Filesize

        581KB

        MD5

        ba46d6c02a9e0e18088032b3fa1163ce

        SHA1

        06395a742389d63a99779255f3bdc380bb823ed3

        SHA256

        0d937efd992d9884333af710e6aa42edfc2e415580a520586464a4b881aac366

        SHA512

        d145fb02ad944ad2b66baf343d69705a6c9f3189fb29a15e047a80c05424930b2ff5cebd1d7182240662e5fd4111002ce17d6f05e5b3eeaf06e90e4ff7c2088a

      • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        Filesize

        581KB

        MD5

        4f2571b25d726afe491b68e5ba77444a

        SHA1

        55f527982cf505f52a62de75357317241ff8f1fd

        SHA256

        140052546de1ccd2a39a1c0a5370ba9f03a5e1c12d860790452e3ae94c1aa229

        SHA512

        9be0df1a242cbf454e23f38b5983b53fe00ec7cb9312f80f399bd1ed0c069cd163e51cc050e01fc962c0acfc76ecac20c291fc0d9d9272dccd3edbeac74ebd87

      • C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        Filesize

        581KB

        MD5

        18003572423a5ed960b74e6ecbb95324

        SHA1

        6a3655caa1b2107e33d6d9c6227f2db198697774

        SHA256

        90e738a550dac6e3477838060b5369a979f87f7a4035081d9ca61ea3cf5bcf27

        SHA512

        4e4183e3fdd78f46c463f4cd80bd8ca367e284e92be7b1a75215d6bc29c0c14a331a4a6a9376b0d135644754138caf97edab6c7270ed55498283d891097c8761

      • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        Filesize

        581KB

        MD5

        34f68209acfa5744b7c48800bc897f71

        SHA1

        fcf86d870a5d5f48f23a08b8dcbe28cfb7276a8b

        SHA256

        8468853f5c025d4518f441d22bf679c0e046b15b155de17b8902d9fe18fbdf29

        SHA512

        f1ce592ef61da04f87c66842300423434fb5622370b0a1c8269ea475a961790fd6faf92140a6b1ed6a6234a7b50e8d1a66eb2cd3cea575216ef864cc932779db

      • C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        Filesize

        581KB

        MD5

        e0d0ef217107ecd74b8ac99f31540236

        SHA1

        98a2c3f36f8862ea85777cd3d56100dcaecdc363

        SHA256

        023c78dc5067e71e6799295c20759d215a85b903718f1dc3fc925d2cd0de2a4c

        SHA512

        77c9632d26eea4199514f95dc0ac57bad5e56fde3c0d1427433614bf198a6fc6ab6f5f13ab144ba6ab0b62c5715292fb5fa61576d10dacf19288693b5e492112

      • C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        Filesize

        581KB

        MD5

        6e90ff43decb947e8426d98555019b98

        SHA1

        e668e1e27f31b892601af2faf22264c11f4cc2d3

        SHA256

        fc9f1a7bf9a37ebaf59010591f9e2948012a564f76ddf97b52a691aa8941f574

        SHA512

        edc4d4895365e59af815d7faa6b64978909408e65e4ab1289992ad94155b57a919f60468140cb2123731d19888512855929cd3e1335dfa8d1187a27c905c88ef

      • C:\Program Files\Java\jdk-1.8\bin\jps.exe
        Filesize

        581KB

        MD5

        9c7fb0f2e290ad3820b5c4db9b1eaf1d

        SHA1

        051ba636c23f6c6975e7860faf140e2e10f5f493

        SHA256

        1a95ed1ae2869a3c092680fa17c5afe7f3c3d60bbe4516a32e3e4b709e3cbb17

        SHA512

        f338016a1e8d3158257a8ec1d3b117805f76a127778c7b0e82e2e5a71717c08b25b96d42f67e09372d00d7ddbf7674ffcf27bce1dcc4d8e69c7bb2920129a5a9

      • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        Filesize

        581KB

        MD5

        886401012fa946d76d4d84dc254c7926

        SHA1

        81c2d506f840b086ee3923c41e088877618ead92

        SHA256

        ab53a6a4d2354a33a1ec0967af05e0619e7080c8565bcc311e99f3f1c2c20caa

        SHA512

        ab8296f358ae9ab5fbbfb396c4f46ad1bc85f194b19efd668d91124a7ec8b6b573d17f28f759ce572bbb20296690ed400107169a8b8177f64000d79fd329d86e

      • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        Filesize

        581KB

        MD5

        73f1b475f9cdf7d4c9ceb474a2304ac3

        SHA1

        c0c9e99c1c63da47eece1c16d0be90fab7f618fe

        SHA256

        ed5ae21c05903327604eac848da0e2d8a43722d68d7a4c53c5cc8b1c5d341de3

        SHA512

        72b008b949a7dc4200d9e254aaea1efcc7b60b2051c99f52a0e6f68460d52ee02aedea0cbab949a4d82c5ef0323e4f9b23127828d8d280b00ec0e9e009b33dfb

      • C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        Filesize

        581KB

        MD5

        6a18d30018a3687c1b38a3521d4254ae

        SHA1

        de1b895f83395833ecdb798ce21b094b28a54398

        SHA256

        0e7e346bb1294590d60ec88248b40553bcab8ed9e77831555e1d1738263eeced

        SHA512

        62a1512fc0974ef8b4ba54218ed03be30295f1a17eb13617d0165ba352bd66b01daeb7e3f11ac52ae4a08f4c24d7cbcfe1ea1dde81a69682ecdb83012ac82916

      • C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        Filesize

        581KB

        MD5

        c4aa6eb04e066d1b327d8744d2276906

        SHA1

        841e0072a2a83e4ca8b172e59857de7a9a03c3a3

        SHA256

        4b5401513fdf34f87da073614c4597379119c2d6d491d4a0633b16241e4c63af

        SHA512

        4e7dd943f88bfa5cd2478bc92388a7a32574f053ae8abece1f19a0b46de29a57a351e36b74956d5af9f78510eaa793a36ffca5acf5d3218da3ff096f26d72045

      • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        Filesize

        581KB

        MD5

        312f551caa11133f44373f0b3f25a21a

        SHA1

        12bdbcdbf9dcc94764e700d38fb687a58e8d1276

        SHA256

        dc889a08b85dea3509531345fececd7303ee964dfc4a1205f37d6941c331c6b0

        SHA512

        6db4485897faacd17437d86f30bfa8a7dee143d833410c4fd15e507752e2bb1dbb9f173ac11c42da22bcb271f4bb94460f71f5db59ac3604d8be29bec597dceb

      • C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        Filesize

        581KB

        MD5

        58d6438ad57125a1b4a9885c86de8ce7

        SHA1

        ad963797089e6b4a6caa2b5efc9bfbbd0b75b6fc

        SHA256

        31397d42f91e55bc7796a595549a0265e18ed9a4e4eea163014c7db3f4082813

        SHA512

        4c27c55b8616c85ce35f0c86023dff9880eba253153c9e3aa94d4218ac9c1311ceb28a05cb699053bcc8a988a11177e790e7fcc5f8277dcba68fd9b8c3fff0a1

      • C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        Filesize

        581KB

        MD5

        fb408ca2b614d6ad4ada0459c041fcba

        SHA1

        f90f6350f68d2f7f8b9ae8f6acfb04703af10d35

        SHA256

        a0641ff983f43fa91ea9d2c4b4f9972bc74b73ce30c3ab14a37226f8d52abef6

        SHA512

        60081441e8a14b91c47bd7e0aa94bf405be0abf9084e9b80097cef06c2d754f2f3f4431b3d46083a570a791ed3e4447952055407d8b497a013b2d2b1fc2c42d5

      • C:\Program Files\Java\jdk-1.8\bin\klist.exe
        Filesize

        581KB

        MD5

        d18af34f158457c5a84bfe43b73f36f6

        SHA1

        dc0d32568a38b5c85b453d6f4dfc8ffe052f11bb

        SHA256

        4d56055576e604de1721021b069c8a3839f9e81693284bf53f3676789fcbf44f

        SHA512

        7bc192b5f88b01eca6d5e7c0092a0febacc0576e1a7fd062ffb4b8557c51df32987172f769ae0515d675c737e38f61329964479e08c671b986ef49d8fa6ddcc9

      • C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        Filesize

        581KB

        MD5

        a763eb7faa6949abfded7c57c962274d

        SHA1

        c2c89d9a023f62c4cc45edbed9318f3de47d0848

        SHA256

        59354283ab99c2da1923f321ac1209c6ef32432e7661a1bae1ef5165d2305e2d

        SHA512

        09a851d06fc9f94b43b1177cee956d2b2aed4dbdec029a6f44da1e192aa53ed68caba2228a7f5fc0a4501bd0f2d53fb0b3fb61645ba2ba3e2aebc454c0760044

      • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        Filesize

        581KB

        MD5

        64a278e08c4f65b43885e8d328ab131d

        SHA1

        c0be56a7efe076410008890185a365ec0d00706b

        SHA256

        b2a43ace115233030fc09a182e8efcd415fbd70380ddd081b3bda14a25711859

        SHA512

        6cd5d0337575cd5dfaa20dbae12b9e36ad3e8746c5cac80b2e334c37881fe5b055759e1a468c8cf5d74615b784d00c25600dac22f739b350fbc2ad1652b3d801

      • C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        Filesize

        581KB

        MD5

        3347b9961c719f49da694a68ec70efff

        SHA1

        c7468d3fc0ff0f32300bb79fae18d51e485fde8a

        SHA256

        03fa4b3aebd267929f5c0a6b5fdb771a76a549a7b9de881f4316e2253188d6da

        SHA512

        5d3d1c4ac102610f0dbadb55f0c4b4c68616501c64183a218f17fc66687ef781330ffe97ea76dc120f034ed623104c01a539dd0986e3a76b85fcf5a6c5cbf201

      • C:\Program Files\dotnet\dotnet.exe
        Filesize

        696KB

        MD5

        5c058c0c00701522a858a551165c9821

        SHA1

        ae0aec34db9e2b4776d2176ba539d24aa8d41665

        SHA256

        a86742f0f4ea18c7d2b7d8a873cafd024c09cfae945140bf87a1c05c3682d1c9

        SHA512

        f5f4a28c0e2ab5d6c33695b5a7250ee563f5768bee71a69fcaccf48fed07fb2b0a82c9346be4e23416f4dc01beb641102afcd46983a8892a5ee4c6a06112f1ee

      • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        Filesize

        659KB

        MD5

        8296868581c29b08f5eaf67c5e705c07

        SHA1

        2b6bd4a3bea45108ef6972a0905b82a9632a168f

        SHA256

        b0d68cbf2fae8fb5f4102b16b73bf31c2956205cf5570b58b8a58f9ad55bb0c6

        SHA512

        80647faea0a0bc5a85cfc236a710094ef3f0a1573930b4bf6308ff660eacc46a497625172a475eca89e73a257db0a01bb64950befe0c8f5e02b2de72e56bbfdf

      • C:\Windows\System32\alg.exe
        Filesize

        661KB

        MD5

        09ec8dce8a103c5343ca13763dc206b2

        SHA1

        0b532f026ab0862ed14871839c7a76e4f88ce8f9

        SHA256

        b1beb6d9a254256fb400d9c47e49eb03eff9155580f62b308f6a2191b157d660

        SHA512

        b283fdcb2091936240bddd437dc5c8cbd4778221834c2b98aa7d99300abf259ffb42eef4143adb8fd35cec0e4c84b9b5ea87288f99f43b37397536456b7174df

      • C:\Windows\system32\AppVClient.exe
        Filesize

        1.3MB

        MD5

        abc18baacd41b8a5a71a953a5398d4c9

        SHA1

        f05d2269b3793cbfc3885f9557c88e70cf0f20fa

        SHA256

        81d9bc79eadeb80c17d4f2cee9ba2fe790c91ef40883df5b738db19916d1d27b

        SHA512

        03f4171c8185f3a3a95efadb190d9944957d1f1632dacfdad87712c1e58c8b84fad7dd199292a57bc2a0553262c5eb00a1bded66ceebe2219e5ffb72def3265b

      • C:\Windows\system32\fxssvc.exe
        Filesize

        1.2MB

        MD5

        36c203e541dda568a884e89ae55d9c6e

        SHA1

        7f29095aaff6b24128d0af6dd5d163e4fc1c9a66

        SHA256

        79653684199d87ce36da57264c3699ee5b9d40daef37dcac66976e4124e03ac8

        SHA512

        ccbd88427a8047a7ca50422ad58e5e62e7364ade495fb14a917c80ee41626b0553bafd73df45bbc37ad53f8ea93bb1b7e3a96682d1a40aa25b789f13ee1512a9

      • C:\odt\office2016setup.exe
        Filesize

        5.6MB

        MD5

        5122025f985eb4f1e184e1ff20fbb3b6

        SHA1

        0657456e7f412fe52662bfb398f8907ad2ec2ce9

        SHA256

        a68c4e2908fcd51bb4b89ea6201a4516b5963fa1cbfaf6aea1ffb3441e79f821

        SHA512

        32f30d647f3658a9a5bf5c64aefea692bee8eeb9e3b9f82afb2c282345e7e06550304e4569fceb1a459784ea28a62ca4eb43214bdc4636433d2c57adbf36caca

      • memory/412-85-0x0000000140000000-0x00000001400CA000-memory.dmp
        Filesize

        808KB

      • memory/412-88-0x0000000140000000-0x00000001400CA000-memory.dmp
        Filesize

        808KB

      • memory/412-66-0x0000000000C00000-0x0000000000C60000-memory.dmp
        Filesize

        384KB

      • memory/412-86-0x0000000000C00000-0x0000000000C60000-memory.dmp
        Filesize

        384KB

      • memory/412-72-0x0000000000C00000-0x0000000000C60000-memory.dmp
        Filesize

        384KB

      • memory/1128-76-0x0000000000DA0000-0x0000000000E00000-memory.dmp
        Filesize

        384KB

      • memory/1128-82-0x0000000000DA0000-0x0000000000E00000-memory.dmp
        Filesize

        384KB

      • memory/1128-101-0x0000000140000000-0x0000000140135000-memory.dmp
        Filesize

        1.2MB

      • memory/1128-53-0x0000000140000000-0x0000000140135000-memory.dmp
        Filesize

        1.2MB

      • memory/2468-7-0x0000000002300000-0x0000000002367000-memory.dmp
        Filesize

        412KB

      • memory/2468-0-0x0000000000400000-0x00000000004B0000-memory.dmp
        Filesize

        704KB

      • memory/2468-42-0x0000000000400000-0x00000000004B0000-memory.dmp
        Filesize

        704KB

      • memory/2468-6-0x0000000002300000-0x0000000002367000-memory.dmp
        Filesize

        412KB

      • memory/2468-1-0x0000000002300000-0x0000000002367000-memory.dmp
        Filesize

        412KB

      • memory/2800-33-0x00000000006B0000-0x0000000000710000-memory.dmp
        Filesize

        384KB

      • memory/2800-242-0x0000000140000000-0x00000001400A9000-memory.dmp
        Filesize

        676KB

      • memory/2800-27-0x00000000006B0000-0x0000000000710000-memory.dmp
        Filesize

        384KB

      • memory/2800-26-0x0000000140000000-0x00000001400A9000-memory.dmp
        Filesize

        676KB

      • memory/3080-12-0x0000000140000000-0x00000001400AA000-memory.dmp
        Filesize

        680KB

      • memory/3080-222-0x0000000140000000-0x00000001400AA000-memory.dmp
        Filesize

        680KB

      • memory/3080-13-0x00000000005F0000-0x0000000000650000-memory.dmp
        Filesize

        384KB

      • memory/3080-21-0x00000000005F0000-0x0000000000650000-memory.dmp
        Filesize

        384KB

      • memory/3700-50-0x0000000000CB0000-0x0000000000D10000-memory.dmp
        Filesize

        384KB

      • memory/3700-52-0x0000000140000000-0x0000000140237000-memory.dmp
        Filesize

        2.2MB

      • memory/3700-257-0x0000000140000000-0x0000000140237000-memory.dmp
        Filesize

        2.2MB

      • memory/3700-44-0x0000000000CB0000-0x0000000000D10000-memory.dmp
        Filesize

        384KB

      • memory/4084-75-0x0000000140000000-0x0000000140245000-memory.dmp
        Filesize

        2.3MB

      • memory/4084-261-0x0000000140000000-0x0000000140245000-memory.dmp
        Filesize

        2.3MB

      • memory/4084-56-0x0000000000890000-0x00000000008F0000-memory.dmp
        Filesize

        384KB

      • memory/4084-62-0x0000000000890000-0x00000000008F0000-memory.dmp
        Filesize

        384KB

      • memory/4492-98-0x0000000140000000-0x00000001400CF000-memory.dmp
        Filesize

        828KB

      • memory/4492-90-0x00000000004F0000-0x0000000000550000-memory.dmp
        Filesize

        384KB