Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 20:21

General

  • Target

    2024-05-14_f889d162025c3271368457c863f4bb1a_bkransomware_karagany.exe

  • Size

    677KB

  • MD5

    f889d162025c3271368457c863f4bb1a

  • SHA1

    4a30766200a8164388b813bfdc1a277bcd872a44

  • SHA256

    264072b9dc8007ff0834188d4e11e97772c03e6b0a953b5e8293bc2323144873

  • SHA512

    6bc126f4ac8369c8ac56656668cac3f6a17ff25ded1da9a81168b69ba57fd7da59ce89419a54fe6c25b0d2386333f28f4dee431e376de234c8546045fbbeb780

  • SSDEEP

    12288:EvXk1LUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:wk1Latr0zAiX90z/F0jsFB3SQkb

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-14_f889d162025c3271368457c863f4bb1a_bkransomware_karagany.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-14_f889d162025c3271368457c863f4bb1a_bkransomware_karagany.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4816
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2732
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1796
  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4840
  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:3080
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:1396
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

    Filesize

    2.1MB

    MD5

    22b1dda3cc59f97a0d7599f6d5eab8f8

    SHA1

    5bf03c9c0303c0c17a75103c200b290e75de7b2e

    SHA256

    0c5f954bc5081895fe7bf68baa16582f1360c1384e3507845a201ed55192de73

    SHA512

    cd84fb81211f2685603f7e565305f4e3190b7378fd4e573a19c325e43c45bedd0abee9576b3f8dccc0f086277d29d9400dd6d69aa6e35b95d8c32c0fb03f2799

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

    Filesize

    797KB

    MD5

    b28f309f4f8220ce48e84ee2d65c78ef

    SHA1

    faf941e4fd704c09e6d30416b41c5aac19dbe719

    SHA256

    2933d08d99774c6d4846c691d8a50b9c6cb3b79187673c8b8faf4842b8486834

    SHA512

    236e1dee394a0cfb7a4af4437913e6b3cb899a1744a31d9b2cea783e95ce351f0263e2d8513643aeecd0208f52d8d6b4ea78da2a97288473f174182e4840cc53

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    1.1MB

    MD5

    33935804ae4dad0edf9a45926a543591

    SHA1

    a66dc25589be0a1ab632e65563690c46402e4f01

    SHA256

    c0db61c8942189eadd0758e3b14f96d6e300df02cc529a40dcbed12723848cb5

    SHA512

    2f6ada20d8462194020d1b9ab3fb7adf2ac5ef14f1606e25a1125b09fec69687402bfaed6b8ab2e589bc94a865aaa3a42cebd8f6a5c10c0565cfb3f3a016cf20

  • C:\Program Files\7-Zip\7zFM.exe

    Filesize

    1.5MB

    MD5

    f3692e8963bac1ddbb68c54988d98078

    SHA1

    157324f589afea0e5e30c61d0d4fe255b50dde3e

    SHA256

    b53856f183605eb3f9d92d17b54b8f59f13cd4d20b042b4aa1c3fb317ce9acd1

    SHA512

    ee553dd9fdc7610d46d335ac59ef81e1e58c51c8ccdaa7b8c45962024a6159b7f2882b23047bd52bf44389df8a5484f3cad697dc49bd10e7a5d9fee4752b963a

  • C:\Program Files\7-Zip\7zG.exe

    Filesize

    1.2MB

    MD5

    ecd5da103589d1c70e238b2054eba62a

    SHA1

    7eb08a806bc28119302e814e1529c5b5f5c53cdf

    SHA256

    d9e400801ca6406112e69fdfe92bb6b05a5e57ae8e25fa977dec3ef6c3cec78c

    SHA512

    0929fd896da3d94517f7274975cf258ee10ada6c09a810862746e5e1656f7f95e449b65662d336e8750e5833db9d396cedda0551154b23e9c833f6a32b3efd5a

  • C:\Program Files\7-Zip\Uninstall.exe

    Filesize

    582KB

    MD5

    3e7f063d8574ae7b446ffe0ab0a77df9

    SHA1

    59e61cf8aa7da0d169582a707903a6c5040ba44b

    SHA256

    25ff0731f31810898d477c0b01df918bae4d3d2760f389f50b097dce3207ce56

    SHA512

    f3008aac86814affd4bf0aabbdedf8691295309e3c5fbd2a15667ab1bb1cb7f09ef9027e8ad32438fdad1aaf3a0b0c9d085c25b28e96cfd0543b651827db04a7

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

    Filesize

    840KB

    MD5

    dfd9830b982b234240fce484177ffc64

    SHA1

    ceba672415fa80af669922a3a9735a6148df5db3

    SHA256

    7035bbb766be1619a6b4938616ab67f600093af2aa0eb9281b2e0ceaad79b2ec

    SHA512

    61f1f32fc2fba5925fa130261ddd4c3712637e8c68c45651be56472f59f1f2cde4bad59329a51bc513d94158981ebcb4bc202dc6985951d882fa73128006d5cf

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

    Filesize

    4.6MB

    MD5

    1608d31fe96c505a04bd0d5dd2cb3812

    SHA1

    730adb3e5da348ea226203d7e7addf7d19b8648e

    SHA256

    a27e013a732b78312e8a832fb90bb7f4555174bfde6a5144b825f60da45f8f73

    SHA512

    f3bdcee544eebe176be6b7689e9296b7f15b527dd682144f2c85c46037069a88e613b000f2259caf23863eb87885f8aa6e5bc7782e8fa3bbd6b4f0a0fa925cb8

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

    Filesize

    910KB

    MD5

    0db0d14b31fd5afed10f1f52da60a5fd

    SHA1

    a76395afe090afc8180b09867425864e78386c4b

    SHA256

    8224217dc01dcca4c589789870fd9fa6bcdba71842fd005232fb9a7c7a6858ed

    SHA512

    98d8aae85d91ae029d6336b64ebf3e1f96f73b99a2b220bd3f5dcdf883fd1a0142e3d51e334f6e56d452fa35194ff8606346587119aa409d148f2377904c4705

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

    Filesize

    24.0MB

    MD5

    01ad47275f924436ff7da5d8ee8ce1fb

    SHA1

    cf328300f96ce0442984b3972d0ef89e2b746324

    SHA256

    669426651d1a66ac61944045b741ddf7ca93e4cc98896fb3dd6427ccbba49c9b

    SHA512

    82c45742a39a47ba9af9b8ef569df4627b7b5ab5f1bd0c240a35f3a2a1a9d26fc5fbffdac2c366af947f45d244108e1117c7dfec0243fa47a86daf5588bb2a96

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

    Filesize

    2.7MB

    MD5

    7ede3e06a01ed172db46f50eaae55975

    SHA1

    dc86375ecaf07f58877441edc5a4eb086c3d4bc3

    SHA256

    71e3e79e2e8ca3990c89aaaeb54d71e710a3eb58ec111b75453eced6d3f7e3ad

    SHA512

    a9f020cfd7fa19cdb28a967f6fc18aa4633e71d913657c8f750e46af3faaa3805c7312167cce19cd6c73a9d978ec8c8a785b5c86132f164230e641e05489bf7f

  • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

    Filesize

    1.1MB

    MD5

    1cf2bc846bc3601dfcc1a9c50e59f37b

    SHA1

    27dab651c3c34600a9b5f3eaaf23bc0f3d1e8962

    SHA256

    6e75460c855bde927a576a794fbb70e87ca5f3a2e4a3548d0d62efaba642597f

    SHA512

    476d357a3f3f4be876880037fc64e609aad69079818baffdf401fac9e84061cdfb15fc9aa95e737fe974f9f020d9975c8def4f94c3c1072cd71caa871e270574

  • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

    Filesize

    805KB

    MD5

    587b634f2575ca27de2e9efa8a86c3af

    SHA1

    b54d7b04febf31ccbdf9da67a6d99f80d02937c4

    SHA256

    5338f91ddc413b1de6ee3bd1925b477bff25afadb04134c81cf4634039c999c2

    SHA512

    41450e4cd374b82b384152d2c64ecf6bae37a2bd73b878918f18e242ba51fa763c32db09863074747281d359ab7af43eedab5b88ba1b17921f9c6902912a852e

  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

    Filesize

    656KB

    MD5

    85f718f95e711d2ebdf100d3f296de58

    SHA1

    cfab353211624cf6dc89480b914e445802ff5f3b

    SHA256

    68433b193ec29382454d779bd8248fa74d71de6be1c855a7a3ea4e86caa0f7ff

    SHA512

    bad343003fcc4be816187e3d4029a8b53d0c96b522c498fd5e0ef1cbbd9a3aec1f8794136143edc425b5a19ae89ed7a39c26e9e92565f8e14a0d55019118d6d2

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

    Filesize

    5.4MB

    MD5

    fd3b2a6ebe49ea495aef3b63a43e424b

    SHA1

    2c806c3781f8ebbfc62cb60aa49a1199a5f61e39

    SHA256

    9a7a3ae93601c5fa3d24834dc040d5ace0226d1d6f716164b334cb17934444b3

    SHA512

    6143587b9c48f0b92b8968c7e0021ad34e7ac77ac8f2f06e4532757d1a3e8b2200140a1fa7fb394620d754287a8624d96976b7efbc6d430a79931752a327493d

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

    Filesize

    5.4MB

    MD5

    e64699bd5696fb966515f677dc203b4c

    SHA1

    911b63f02ad42a3760cb9989c4de9a870eac5fb7

    SHA256

    86dcd8acdb6b1b7e628a7f6abbfd21e79c2989959dc393b4713a03c83b45ad11

    SHA512

    5f409ca077d0882f0ee42e5c729a523bf68c3db568a7c38e55df79ef9aad35d15b7f55ed6a73510e23f9f2a629c2f732f1d5e7a212f875a1b19d011a84b0dbcd

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

    Filesize

    2.0MB

    MD5

    3a38868f4adec7ca6bf4f85b54a84d52

    SHA1

    00f38d5ef92491dce76dcf7ae5fa8994e04c2aee

    SHA256

    b435cd164132a8b3d56f4dd4b2c843ea5f6cd0424696b2cf251426b7680aef25

    SHA512

    ea13a4cfcdd67d55cfeded94d6b28361ac8cfc8851f338e19a73f7454fe8ed303a1da6811ef6dfa0e9c284240bd2a2c48afb90c2b58bbe339c990a557d064468

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

    Filesize

    2.2MB

    MD5

    8cdf580966e57d40ece0b801d91f7591

    SHA1

    017038dff9f014ddc6ef9bca301c8d01c6a749fb

    SHA256

    b4e2e665a809b40e48d32bb8ee0a847f2c91f85c4b119711fb75277205036daa

    SHA512

    8b60ddab29b282025396ecf4af8b1c5f6279bec2a0b09bfe22afff6fa54889fc80cca0b12f366f233a21896175d15487140ffa2c64b298f43a880b6445278bc5

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

    Filesize

    1.8MB

    MD5

    09fcb5e6c6c8e5ca9b07acb9ecbac997

    SHA1

    7bb2c2ce5978ed99ff5c5ca06362dedfaf6fe4c6

    SHA256

    32e7d96679964f0641348ed7477e0c4700986f54b6b1b4229be500604c1d63cb

    SHA512

    5fa0a4ada089fb1908b465c1ed828dded34a9c6855b8e009949b1c7349be21705dd9eeefcd4c5fdd1a7f56031f8f8eb5f5f0d9522f5dfd92e9eb460abeb0ddbf

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

    Filesize

    1.7MB

    MD5

    5aa658225b73e974fed25854ed409258

    SHA1

    e25fe24b7d523db473faad91e53ecd13f5f49b57

    SHA256

    cab6c26fcadc7b5167a9da101231838a35fcf0dfd259f3150e95ce23580dcdef

    SHA512

    106f3f96ed6af16828fe2d602202b14c1ea5fcc945d565d57d8439188d74e0793dc2bfb07759b13e4d4488f57a27a60122d5c8be1d3ba6efe8d9212011d0de0c

  • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

    Filesize

    581KB

    MD5

    a05a9571fc964bfa3c0c7d5b8b43c4d3

    SHA1

    a77ef8d888600a1ea07e985c4ad577bb96af6220

    SHA256

    332c8763e5e87102641d66f7e717ee3541604c7faba65bd632bd1c7b09412ba3

    SHA512

    85fd3a2bfb66c9a69bb66f075654dabab91e8a21f3c70453f5797c1c9dfe5a5867b443c4d4b7363c5173d0312cf1d25e86500d5a55fcdc6cc6235b2c5debbe3e

  • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

    Filesize

    581KB

    MD5

    a991d46ddf64441067dc1b99a9cf7013

    SHA1

    4f5d1d6c26b85099f88b10ade94a2941b2db619b

    SHA256

    23dcf6e4d463d9d9922d1c147cafd8ebced09feab746797083bbb5077df8e277

    SHA512

    be66a4706cb4f273b1ac7ba7858c4696d94be60b4c78b1f1d4e5fbfdf93a5e10f20fb460bfe6fd469976cd35ce04bdc5dcc8413a66296f326376b959a892879f

  • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

    Filesize

    581KB

    MD5

    d6d876ab9ff2a917fa961751a60a1800

    SHA1

    ed5f3e50305dd63f96d599d449ac9a6ac9ba8ff0

    SHA256

    08ac830a01de7e4d622ae71fc888fd06594415686db39b30b8b68fcec01f6766

    SHA512

    bf540a0da4c9b9706b58e2f7e49ff434550bd5b0932d7a1a45a0b652a609dc27fabb5e13c3309a4e0999e77859b06e6a61aff3c671ad36e1aba71bb5714a753a

  • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

    Filesize

    601KB

    MD5

    a2dbf481d22962a745ada03c04303c66

    SHA1

    6c42e2061a130b04534bb98121b53b23195a9779

    SHA256

    5d2d1a0c7a6218242ea66b221baf46aea7784fa24e0f70ecd293f3d6b94a57ad

    SHA512

    ac8791f51e47ca4eb7665a215f4a19ea4f60865eb6c55e69c48ab2e4ef119455bc5a51c9da049a80ceae381d8eff2d2f0514778448acf2273203adbe9ee12a8f

  • C:\Program Files\Java\jdk-1.8\bin\jar.exe

    Filesize

    581KB

    MD5

    542e76a11dfdf440ff151b0437565993

    SHA1

    7c6cb3a04abc977ce8408958df51c80397914313

    SHA256

    88ed59b34e51a76d6785ef2b1cd266b486305af0f789f35235fca6a7392aedbe

    SHA512

    eeede736be4e772a81046d1fe91030b98451d68205f7a7f10bbd34a6b3e06a9889ef8a0b174e17edc56e4147df958a5873d144c1a65f055dca75fe21d55c88ec

  • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

    Filesize

    581KB

    MD5

    baa14870cfaa86eb2f63951cae246561

    SHA1

    fce6a913088411bc65df7bce4fabde303d657a4b

    SHA256

    92b8241ab91dee7152db5be4da5d82fb89de92854d3ac8cac928d61788d954fe

    SHA512

    e20b7f6eaba9d5935065154b24728a128044ee103b4071bc6a6c24cf2fa2d8753d67ffc573b735dfb73f2e514f07d04bf292acaf6b35644955de1473978d058b

  • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

    Filesize

    581KB

    MD5

    0a787fda1df5543eb55bfb9dc8a02c48

    SHA1

    0dfede20001717728d2ec18a4978b26958abc717

    SHA256

    0900f80f4aa40154ad81b3d9089637e25caec320a7bfe951e969b0abbed36770

    SHA512

    eb6207442e639096f7c20543d65f02a7ce173f2420119d89f60e0ac8e3fbb78acd370d6f00565fddc12fcc5c4aaac083e59b32fbd8578caa1282627d7a5f12d4

  • C:\Program Files\Java\jdk-1.8\bin\java.exe

    Filesize

    841KB

    MD5

    21cc75b90a6011b6ba0866a69b4949ba

    SHA1

    27ded9ba04aa21adc4d29704b78cfaebcb462cd5

    SHA256

    b1b4364d13466416cb3d90ea6320b1797e9efbde5032866d5b4f00f9eb36bff9

    SHA512

    a3ac776d2253d150ae079f663f0fce60c4a0c7aa6ab032cd1766b1b30ea87c4342c013a0edcbfdef4d65660bbed0788ba481d476d763d957415333965b8265ab

  • C:\Program Files\Java\jdk-1.8\bin\javac.exe

    Filesize

    581KB

    MD5

    66b1d270f475cbd5ac9ebe786d76580b

    SHA1

    c2924df4d97c1b45923690338e8bcec0f692b3eb

    SHA256

    5b4aeb6d8520fa1492a4d6d180f92d9d18b341d72a55bf3eed162e9206c62890

    SHA512

    fd3df1219014b876cba582c9c13ead5f6ea74b3cc89da163120526d895491ac80a6f14b9f7113cea0faad552481b6a7249ff5a89f1ca2f28ebab07ddaf45d378

  • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

    Filesize

    581KB

    MD5

    0de9912af53a7ff510252a9ce74f2b71

    SHA1

    03a95ef085f02cb07c7e8c3d1ebaa56230bbcb8f

    SHA256

    be245f30fe384b3b72b7baebb103044b4e8b98d9927ba10483840f58bec68b7a

    SHA512

    a4748e3384c4c22b5425efee0ea76608ebbfdd8a3d077a547683d139844e00eb651945b3559b33098f68fdd5cbf377288091673f820dbc8f71bb34e4354aaf24

  • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

    Filesize

    717KB

    MD5

    f10914a16c310a97995b7687b3ef62fa

    SHA1

    9fba0a3c6fa6aabddfc9737a2c0c743e0c2e1a4c

    SHA256

    c07f779245cfc788a8132c3b3fe71ef2ca7d73928c2f4539503c41064cec3f85

    SHA512

    a03110fa6be36b2b96467561c17a38ecd1d44cf9ea38770f7f3ca8c7748ca1268e4fd9164a3491879a9daee14e85145fe536524310e36eacd66bfa441b247a03

  • C:\Program Files\Java\jdk-1.8\bin\javah.exe

    Filesize

    581KB

    MD5

    7779129a5b570a20a7e30374b7826c8f

    SHA1

    75a8d5191ec2e58c953e6d75eea58a7a46e5ddba

    SHA256

    200bcca194a328a5753700508e84a0555717abf3e5a0add035959a67de53e7ec

    SHA512

    c3d57edffa0160d45336c330dcd7c490da0273c705a555704f890755202d3e01985d2527a69484b3b33733933285ed119c61eda6eecab2a884b9c5e38fc28ba6

  • C:\Program Files\Java\jdk-1.8\bin\javap.exe

    Filesize

    581KB

    MD5

    4c48a33df3ca6541c98dcbce2e0ecf90

    SHA1

    2ffbaa165e148edbc3c259d1e7a62a62f3351584

    SHA256

    93515070f906ab9ea747019eb7fc4fa5523c32fd3b04da226de5b8a0d6d2478b

    SHA512

    efc3fe1a576572d9770637d2b1b78af263596c562911ff5ccecf6b1f64606051270118e43902e32c5bfed23788331bd2e50cfba49621ce8307faed7934b0c349

  • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

    Filesize

    717KB

    MD5

    8f737eeced274d85f5850c73c3771ecf

    SHA1

    35f2e06ec056500cdbaef8370962ff2029c4a749

    SHA256

    2c10a8c3869189c647e1f6ca99cb1099ee16b9ab9681e39e6b67019b33ed360c

    SHA512

    fcc4e6c4b56498b706b90cedb4828cf3dd4fcf8ef2b96a5c286890af67b3d6371e24699b6f23a9e7dc9615579d2bd456e39b85665f533af6f28f3b16f4b4bd78

  • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

    Filesize

    841KB

    MD5

    7f2c82d2be0f0d27964ebfec68f54121

    SHA1

    c9af2b9f4117ec948af74a81ad96f62e0daa76fa

    SHA256

    272751c54adb36c098708a1f086a42fc515e1a886c10f31db81639dafc4730a1

    SHA512

    97d7fc7d2e9c79d534479a75fbabc668b0f7be9e309a753dfe2a6c17f418ecb8f582cadc51424a9ddb1d43894f26b36125dace2f1d40fdc394ffd6f1854e680f

  • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

    Filesize

    1020KB

    MD5

    baa01ac5942bdf51a0602995331dd84a

    SHA1

    41cd7aa834a46561ce83a5a88b480217a928b32c

    SHA256

    b26a790a6de36687669e92bcaab218c536bc378a3633389e871565d615adafbe

    SHA512

    9c8f877ed263fd43719de3fd696b1b9852a5ba8c2a48688b267a86755b1c18037aecb29427becbf816aa33da16aba5e4e2eba3b39975126c12249612e0491819

  • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

    Filesize

    581KB

    MD5

    a62fa8998cd98a8a5e0c0f62dc5ce74c

    SHA1

    1bb92e45fcd60a0bad5fc8de8842002684fb7cff

    SHA256

    2034ea3fc6e876f7595a57521a79bbce9d5bd08742d68e16bc457875688c4603

    SHA512

    ca08804fa3e95ae2314387b72403a8423b91d6734a96fd21e5d6032a5ba1dca9239855d0e55e66330051c032374d1c0e060c145e6194366a542b695b74b02694

  • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

    Filesize

    581KB

    MD5

    94065284001bd9f15453ebfd77ba0bfd

    SHA1

    33c1090c31cb9c2d337963e8de83baa90547c4fa

    SHA256

    1e524ceac228ede3b48f20149c69b19b7ffb1acdfd8a8869eea16733fcc76c93

    SHA512

    e3fa8fabc220e45fa6925245a9ebff08d7bdc958418f4ba6e243260924b70ccba792ffc472c091ee7f45b47a6252280e8034007338ba9b693ce36a090c0267f9

  • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

    Filesize

    581KB

    MD5

    e7bd9f41f42f1f01c3bc1b66c5499c02

    SHA1

    5700d0002a3616f8e75f077d3358086c53c5402b

    SHA256

    6e98bfb41686517510b8eb723249817b0ca0e50cb05e27b6f417db99c89642ae

    SHA512

    f1f82b554f71635d4bce001d7c175d7f6e683958ff0ddbdfeac0ccd32573826c4fc3edcb772869829ef5e2e447a8da67a71829083a7107cfe72fea56b9c74b21

  • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

    Filesize

    581KB

    MD5

    009003f6bf147e326119fbc80c9bb14e

    SHA1

    8ed88138d651c245468731059d269b8e91c35668

    SHA256

    c0b861e7398223ba229469f5bb73768dd0de52303a1c5da45952d4a86306667c

    SHA512

    63051fb1c074cfc84421bdf2f490d9bb2656b839e693993a897de53b1c3ef283391adb841afc4916335d8b8a0fb88873107ef925436ff3c6f23bf396885a297e

  • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

    Filesize

    581KB

    MD5

    ddff38657ad5d496f441f02a3293ae8b

    SHA1

    18c8dde6de907206928e3b0f0263f219bcbe41e2

    SHA256

    43fbff0a9584e8d0797faab3caeb889d4d9b2eb4d19ad676d9583120e9ec8013

    SHA512

    9ff3b80608b0b18067ab48ccb56e8fd229a6629a55487b5c1b4ba6f598651a53f9cd5b28202cf9ae697bb4ce7f8e4fba72ea66e2d29fb7724206d59961b19203

  • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

    Filesize

    581KB

    MD5

    ee3fb2bec9085a98e852073a40b01317

    SHA1

    fca6367624fb3fd9367831447165636aef910359

    SHA256

    684ace808e42b1bba4a407ff823ce260cf3065607b08872e269baf25588a9e4d

    SHA512

    36a2401eb2273ad3419d902bd917246df1b912dbdd63406053e280c6e070cbc2debb36815a4c383982f131bd35896e6a3f9f5fe8ca65ea4f7bcf42c4de6e3019

  • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

    Filesize

    581KB

    MD5

    300f58463af28dc4208a72efa6751bad

    SHA1

    11ef4921cc628ef3cfc23c832cae423842526550

    SHA256

    5adbb671f2b1a917421c18efb1a3486d2a6a5ce38e56b3f88b4e7c2c17ddd2f8

    SHA512

    f61077ddc724067e2ac5b9d0ff87acb39dfd5dea9efa84815a48965d07c7edc6758df3462946fb345721c8d7216a7010cd7dde2d258faf396693614ef3d8ff3b

  • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

    Filesize

    581KB

    MD5

    642a6061cd0fcd301a3a55ebf1d2ab6b

    SHA1

    4ab4d1f547c3981244353a3cd1e591fe0b87e53d

    SHA256

    ab658a5e9768b4e27e1e06af8e85abc2d14069fe828a3f4007a82d08ac9b4fdf

    SHA512

    f52374b510375f8786d3aecd89797ccb6250a1888f5ed65666a8d5ab7920ec09a2192b42f17d2e334cffc8de789ffc31ad1a7b5f55ed4f51a972704dbbc12b67

  • C:\Program Files\Java\jdk-1.8\bin\jps.exe

    Filesize

    581KB

    MD5

    87c757d8b8df054fbc13653165f9ce76

    SHA1

    4232c7e05e712ff4a223f491e86ccf5575be2676

    SHA256

    6b50c5165564704d4e5d2a2805da62f8f0b06cc388d4072ad4a411a079c8f89e

    SHA512

    89050af5c746b199b0ecb41ab9ec587c76905ed586afbab0642b4863b61ecd2743adc68a3b9856265d8e755532e28a786d5d3632048eb9a6b6f4d941cf791ddd

  • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

    Filesize

    581KB

    MD5

    d48fd21a781decd883b491cc63690322

    SHA1

    9c89a3152e36bba7478b566cdc88bd52803b9bed

    SHA256

    a1c187e08fe264a4346cd8b7a328c0c7a459b8a24eeba3ec6ea0b21c06357581

    SHA512

    a2f7b96183171d406cf1c36c1e863d711b8b773ab5297b852d5fc0fbfb78f1b308a187858762e1e41ef62b7b1696f1539e6d91e63461cbb52e6982345a6ae701

  • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

    Filesize

    581KB

    MD5

    1f49310d01501a1b4a55f20eda56c905

    SHA1

    809683e3750025050d0350a7fe531ce611ca8d87

    SHA256

    a73db8a0dccd43f874557e94ca98ca2feee95177ed2a9760fad432d61eaa41a3

    SHA512

    90ee99e17a4deef87ab00b721f4a2fc79adbdf173fe8b7e6e677c9e892aa20c2a5d1f48feaa3383c2e6db3395668fa6529b82e3209e6c29c9cbe3908ca1920d0

  • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

    Filesize

    581KB

    MD5

    2e263e9abd4406fb90cccdf3e5808f75

    SHA1

    75e9903b9cdd8519c92f5e7e3508f51ec4ed885f

    SHA256

    da042ad2c8bddbe42d04d8659bb8cf841d4754803d2951b2546386eec52f0656

    SHA512

    cb59171a84d1c9e9d5e2c32161a9e651a05c7d45f46c0815223714e25192a8765545c45508f17ae26dafed0be137f27208aade18cc3610e18c2581c04eb5be01

  • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

    Filesize

    581KB

    MD5

    5d7f4d23a10771623b3513fc63d0a8a7

    SHA1

    50feacf1851883eb56d43d019bfc9df3a25d50d7

    SHA256

    23fb530ac31083e29e58f1300a8d7fb41026c3f01daeadfa236ef4a1b21a494d

    SHA512

    b331b0d8f27abd3252c38468eb28053d9b60e39f8cc7fb5f7988e677a2048052a8178c8344ac10800ef018641c140a610f43ebcbaa1de2ef02025cf14d82dffc

  • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

    Filesize

    581KB

    MD5

    413adf412d998b4178d74679e582ad02

    SHA1

    8e8b4d1daf908761a43f86c2e564bbea3dd38d97

    SHA256

    32da248de6ad3b25f026c52a2d9c95f0f5c24da2158d3bc3a8b4cb55676f6263

    SHA512

    acd9b20dd25f8f7e947df39253086bcb67c4ff25071efc985cbf1982958629ce41fdbd1b2e1b4680d5d2f880f920ddd6cde465eba3576d08a4c5ba2048715985

  • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

    Filesize

    581KB

    MD5

    6cd5d82432ea668cb66bb2160ecdda99

    SHA1

    7a3004c3f06474f53d79a019b511ae671615c7fd

    SHA256

    411dc61b2020efba95b20b2bd62020d61f8f689510711e26aa377f89f3566cd7

    SHA512

    f155f30f688de55977b0e9d3081086d3d2830d33290b205c140a2564b5fc5cb49eb44b740a9196caa58626436dcbeaab0fe7679d999e8384a2b500eed7abea15

  • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

    Filesize

    581KB

    MD5

    9d3f57c861028c6c5e3c8e0ae69c0e70

    SHA1

    b902eb036f680ce0f73fd4134a037a974381dcd2

    SHA256

    2f6040b9e4c90898ca6db6e389e52f812af4e2893c8ffd03045c9797f0a5cf89

    SHA512

    f5b007f53b2cc06d0cf4cd643ac9658dcc64bf941f8cc2409eb0ff715253929ea74d28860735e4d17a3e8fdd64023ac3c4a7ee292509de0c37d39a6ba1f7ff19

  • C:\Program Files\Java\jdk-1.8\bin\klist.exe

    Filesize

    581KB

    MD5

    e8d4e532bd6c63633e3fdb9ddf6140ad

    SHA1

    1273ce370a2f6dc3de4581d46be72117adc44a31

    SHA256

    7ddb5f1728dc2c8db6a34172f03bcffce5f7f492299d26a526bc47c4b273df1e

    SHA512

    15e7546af91b9153e4a21c19be1101a5db34171d9dc2a81af2a4331365768093d116b63d14d1fe25876839ddac1ce35809f5c3c73cac07d9d544ee2f062ea5c2

  • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

    Filesize

    581KB

    MD5

    52b77b7a2caf814c2fda269c7630b49c

    SHA1

    26b2234ce89ec563cd8cf3b4ddeb615018b6be91

    SHA256

    3ace9d6e50580a15e8365b8608e85f59149e4dc9c33f7f5446ee2c144ab5faaa

    SHA512

    5f875911472ef4275c3188f67207eedfce533220567eff70bfd151da2447d243b1a7948d373e6d6de16fb117679c86e3142bd8e5a78c5d371dd6d9726a309c69

  • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

    Filesize

    581KB

    MD5

    bf976408952f5a680a3087571cf5faa8

    SHA1

    007c5db971a7b2dded8514fb767d722791c5ec57

    SHA256

    a06989b063ce58eea6f31dbefd49b6e6eeb3a67c2b5bfd39b50622f1f9bd56bf

    SHA512

    6cf0446d0e798bf8ed54cdb9f08a8ffd37c188c70f104d9f8714271744125eebd7ae4e2a6db07adaa95ebe08b542b07a6166a14bbb38521b536ed4857c7fc5a8

  • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

    Filesize

    581KB

    MD5

    31dea3c52adc76fe3f6ac494e3de4d68

    SHA1

    8069a138a9fa719428e77e36344c8bf648a78395

    SHA256

    c8db1693b54bddfd2a52b892b23bc45ff8a0d91fa163c190cd6b378800b78538

    SHA512

    33b5590871b31bf96b494c2f9aa7afab18a26159a862ae105365b12d50cf8f9de9cf6d4d0c394406d66f871974c8386f724cbfbcd31cee13c6e87abb02039ab2

  • C:\Program Files\Java\jdk-1.8\bin\pack200.exe

    Filesize

    581KB

    MD5

    160cb9f64ff67c1f704b3e4286b95d11

    SHA1

    928146f8017e445db83df491da34ddaf46a05cbb

    SHA256

    2d26fde8f4658cfdf45897c3f368fa60747ad4c206cceae008e7277ee39eb01d

    SHA512

    a59b24ba723f1690fad9b47b890e76a3f2e5032525750c2e43d4b588c9004e8eca1e42b7b21a556393f0086f5882d4d82830fe1b847fb1b685b78cc97c883809

  • C:\Program Files\Java\jdk-1.8\bin\policytool.exe

    Filesize

    581KB

    MD5

    de2000af1f9db2b03344ecd6e411e677

    SHA1

    ad38db8d65b43285bff648757f23af13bbd36989

    SHA256

    9caec83b09e3218c7acda41c60598161620cb481415fa4757c79a793abfcb512

    SHA512

    73b2952d5bb670243747c46d18a1cc5f33f9ef3b9093648bdf0ecc621121fc26ac90152f2fc0d642eeaa3c01ae5cc98ef8fbaa2366f85f326bc79c2fb8175971

  • C:\Program Files\Java\jdk-1.8\bin\rmic.exe

    Filesize

    581KB

    MD5

    752070b1db3ae0101c96752992672ea2

    SHA1

    9dbb110c218a94180db463411e5b5cc935b3dafb

    SHA256

    32d5fa56f2ff72df71f1ddef562ad26e63d80f53347d75a1f4861794de7470cb

    SHA512

    995bcf0bcc0243057a57f35492528010a29d1a965142df137e73e932acec608ab957a1ccbf502a5b6ca3b452073fd214f465da44ab0f108747691da030c9e5e3

  • C:\Program Files\dotnet\dotnet.exe

    Filesize

    701KB

    MD5

    3dec2588505da38aeaa39928ba34823b

    SHA1

    ca4f10dd09784a5009457f0d2f4d4d3f32350e2d

    SHA256

    e4a165d3350ea79ef6ae68cc55c0276ecc99253278e15f4f57f42b00d2832fa3

    SHA512

    3d28e3d2c15fe0fce5fe8f18e6ac573c9f36f9b5948d880b06167f13f63f4d33b1ea969978ecbb260aa8f0463a646300b3840b5569329f4500c5433f287b417a

  • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

    Filesize

    659KB

    MD5

    1a35bdf70d50c45186556f28e8de4496

    SHA1

    78efc56169828bb5e564337596d8a2de8c6d3d4b

    SHA256

    f76130b993e619f40ea024d37f67e2c439eb052dbac1072f3738aec9bd57181b

    SHA512

    ca267531e2421ef99b0ca62f0d44fd92c18c96d1a5650abb02732e312a3a4eaa1bfa675b0ab081003353d15fa90ea15364d23e649ce0aa010768a3dbf93ddf39

  • C:\Windows\System32\alg.exe

    Filesize

    661KB

    MD5

    270217d9db8c8d5d64f0a391bc704a34

    SHA1

    df77b1ce42fdb288b6e391416124b7fb9b3b6930

    SHA256

    c83b0ffcc77cda1a9903804bdd29ce38cbe43de3e3fcf4ff87673d6ff06ba332

    SHA512

    36804fc6289d24a2584558c863105b9565d17e3a1917c6901db4df472612ccfdd0090e817eb96f1ef46f5f29e80f3957a3a6246c7de152f2796c36ab90754a16

  • C:\Windows\system32\AppVClient.exe

    Filesize

    1.3MB

    MD5

    c39d6f38dabcfd8a96b8f8b9084ee60d

    SHA1

    2bbdfedb0ef451baba2f32e109b2df58c034566a

    SHA256

    6038ae208d99ab784f43bff7c7cffad2846bcebd8c6f809812ae3b09ebf584ee

    SHA512

    d7d138c6d60f3f97643eeb2e82d45caac6e60dfd9fe5d96005fde185847cb86673d5e63d216ddf96d542055a8fa1a66c1ff4d763798d5f4e795a4f562244238e

  • memory/1344-83-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/1344-75-0x0000000000510000-0x0000000000570000-memory.dmp

    Filesize

    384KB

  • memory/1344-81-0x0000000000510000-0x0000000000570000-memory.dmp

    Filesize

    384KB

  • memory/1344-251-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/1396-70-0x0000000000CD0000-0x0000000000D30000-memory.dmp

    Filesize

    384KB

  • memory/1396-92-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/1396-64-0x0000000000CD0000-0x0000000000D30000-memory.dmp

    Filesize

    384KB

  • memory/1396-84-0x0000000000CD0000-0x0000000000D30000-memory.dmp

    Filesize

    384KB

  • memory/1396-63-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/1796-246-0x0000000140000000-0x00000001400A9000-memory.dmp

    Filesize

    676KB

  • memory/1796-25-0x0000000140000000-0x00000001400A9000-memory.dmp

    Filesize

    676KB

  • memory/1796-26-0x0000000000540000-0x00000000005A0000-memory.dmp

    Filesize

    384KB

  • memory/1796-32-0x0000000000540000-0x00000000005A0000-memory.dmp

    Filesize

    384KB

  • memory/2732-245-0x0000000140000000-0x00000001400AA000-memory.dmp

    Filesize

    680KB

  • memory/2732-11-0x0000000000560000-0x00000000005C0000-memory.dmp

    Filesize

    384KB

  • memory/2732-19-0x0000000140000000-0x00000001400AA000-memory.dmp

    Filesize

    680KB

  • memory/2732-20-0x0000000000560000-0x00000000005C0000-memory.dmp

    Filesize

    384KB

  • memory/3080-59-0x00000000001A0000-0x0000000000200000-memory.dmp

    Filesize

    384KB

  • memory/3080-55-0x0000000140000000-0x000000014022B000-memory.dmp

    Filesize

    2.2MB

  • memory/3080-52-0x00000000001A0000-0x0000000000200000-memory.dmp

    Filesize

    384KB

  • memory/3080-250-0x0000000140000000-0x000000014022B000-memory.dmp

    Filesize

    2.2MB

  • memory/4816-0-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4816-37-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4816-6-0x0000000000640000-0x00000000006A7000-memory.dmp

    Filesize

    412KB

  • memory/4816-2-0x0000000000640000-0x00000000006A7000-memory.dmp

    Filesize

    412KB

  • memory/4840-49-0x0000000000C70000-0x0000000000CD0000-memory.dmp

    Filesize

    384KB

  • memory/4840-48-0x0000000140000000-0x000000014024B000-memory.dmp

    Filesize

    2.3MB

  • memory/4840-40-0x0000000000C70000-0x0000000000CD0000-memory.dmp

    Filesize

    384KB

  • memory/4840-247-0x0000000140000000-0x000000014024B000-memory.dmp

    Filesize

    2.3MB