Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 12:33

General

  • Target

    2024-05-15_6ff736806bc90bddc06fc39ed93eb58f_bkransomware_karagany.exe

  • Size

    677KB

  • MD5

    6ff736806bc90bddc06fc39ed93eb58f

  • SHA1

    5054e90f640e44f0bbc0f1e0a5642081aed1f4a3

  • SHA256

    6ece8aadf10c720f979ba25db9f7f9f103b0ed9b9f8e7e45cce066e63817ee22

  • SHA512

    6ca756b7e3a79dd10b58b868cfcadb029f3739f42b2e8de6405dcb3c5c3de28c8120ddbb7972b5988ff27c8bc9f5ef0095108ac87164272e52d88391770fec4d

  • SSDEEP

    12288:nvXk10mqmFrfBCgiw4bivhqGoj85sVPL5qw+D2:fk1vqMrfUgYbkhqfj8uqw

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-15_6ff736806bc90bddc06fc39ed93eb58f_bkransomware_karagany.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-15_6ff736806bc90bddc06fc39ed93eb58f_bkransomware_karagany.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1852
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:32
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5024
  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:440
  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:5056
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:4092
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:4260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

    Filesize

    2.1MB

    MD5

    7e78e4aec08f66e4d3ca0613c19aad08

    SHA1

    aeb325230b91639b5f6abf50b0eb5b500309f22b

    SHA256

    44b76b9e4a720ef7e5b0fa3e05f67da778d699d683d27950714acba525c1cbc9

    SHA512

    dfa3167d37f44370e052ad4b7fc97156d9fa26fe1e7f62a6066f18d36539ace95944d9f4757dd7b791f40eace3fe9a5a707daa2a047c72f47799b07cf644b615

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

    Filesize

    797KB

    MD5

    01ed01ececcfb647125bf877cb0bc535

    SHA1

    24fcd2495492e6b341e829eb719e1e1610736667

    SHA256

    faad9606b54b9c3f9fd0930fa8852ed55ccddaaa9d3f0f017940ef97795d7dcd

    SHA512

    8c25f5114b692777b4852468fbcf9ef1ffbeecc1194156c9cd4c2b84c74e5278c1fde9a26173640f601100657e7395b2bc8772f0cde4fcd8fe8393ebeef89b1d

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    1.1MB

    MD5

    d5639ffb5b9725fd0e369cae22c0af66

    SHA1

    94220682a9ee5de5a35a31f0b689b943ff18845e

    SHA256

    1c310b9ef0b994d1beee195173458caed8eaae547e0b49ccd0525f4c7de31169

    SHA512

    024f07e3378b158ba0314b4441f008395c239ede6f53ebe57a22fb7fb8327c1a0bbe12d15206250cc0e5cdf7c9e96d0711f88728c1ddc78ec03b3618cded6e6d

  • C:\Program Files\7-Zip\7zFM.exe

    Filesize

    1.5MB

    MD5

    7d2275039cde65ca5d26d5cabd0a1216

    SHA1

    4582a1e4d35baa00dd770425de85696f1aba3d04

    SHA256

    8a9139642599ccef4f07e39a724190e0efa73b3fd9763dd031a4b0da2dacedd1

    SHA512

    e397d3346fab7af1aef791849672923ab74d270d36f18a1546e32d6503de341f88ad0149046d5fb04bd47989e6363be644363e0616ac6e38acc941a454636c2c

  • C:\Program Files\7-Zip\7zG.exe

    Filesize

    1.2MB

    MD5

    1848d65daf78da755a1728bcbc230fcc

    SHA1

    89a4beb4863c391dddcd14f06072b4ff814ecaa2

    SHA256

    f2e936d58147e89b0875ee80c749d69f079e93336e78a7eaa063be6bc1fb04d4

    SHA512

    a19c7437f127fd980690f989b43ddc07e51651cdebb9af2ae4df7e962f8ac07426d842bac3a447754072370fd0f66c24596f5882e526936367f741078960d53a

  • C:\Program Files\7-Zip\Uninstall.exe

    Filesize

    582KB

    MD5

    7f6e759f6a7a920cb0e5cf83a2af2270

    SHA1

    b627df5aa2511e5a91d73c4e7bc08e0bf74ebd35

    SHA256

    d4f0515e680a3a9f4afe73cb6399e8bf3f5114f08dc0011c8a1c2f3c2198f5c8

    SHA512

    79e55013256896d5f6be6cb29880e09ac493cc54e0de293ff7dbfbaee36da8672fd74eb82ed7f6f4b53beb1192856b52a219b706630128d6692ba10b04c264ae

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

    Filesize

    840KB

    MD5

    19dd761b9350cf5acfc2623ce511d4f7

    SHA1

    f1200f8b962fe64fb42343285fbb47307acab603

    SHA256

    b0af6797fd8116cf6cf01482efab6ca203e162cad29aa9055a8a4ab7eb85f550

    SHA512

    9bfaeccebcd2112caae7ed6b3f08f30bae4baf3ac9854194369a2f431254290a04d7d2c1ae16440ecab7121102577598ef1a7747a0b135a8e06ecb7559b70273

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

    Filesize

    4.6MB

    MD5

    b5f2949daa48d86c010876fa9876599d

    SHA1

    e7fe5ff188da8cbdbcda88e48703c85c0dca17ba

    SHA256

    71fc302d240f943a059ea2511b4d1a9b8dd155d2c3debd705a81120c32a9d115

    SHA512

    76149902a9f277aa9a17365fd8b1f28f57639327a26e07c5a46d6a8a7298b735825ee302618b9f14315cdb0a03127cc2cfec268221fc6f84bf1401a422dfe190

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

    Filesize

    910KB

    MD5

    640d30136ab19ba506f8a3f63f8075b2

    SHA1

    72af89b8967204b4a347aaf11bcacee2f2c645c1

    SHA256

    83391dec3a49da000b39f0350ca4319852fdda53eeede938ced11673719c6b45

    SHA512

    839c7bc7706fafc46deb63035e0a2e6b2e2c69789f1d3b041931b18fbda66f13b8c34a2ff5f538911e817c91e5ccd58291933f45eeb509b645da1471e8e2c3c3

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

    Filesize

    24.0MB

    MD5

    fc02a1ccd5ae54a6f899ad822b24f3f4

    SHA1

    5f5bb7a705992841dee9b7f98f5ae35c43af8eeb

    SHA256

    a7f70bd3a98c7d36b89312e111c965ac2642d6abbae937b4a1e8136b37a8b3e1

    SHA512

    333c03216a19fe9bed810e15eac95b6d0647ac919399828369589a50baae3293fe4e21236565a505a1da533dfb6ec0e6415528cb09e356aeef637df493e0e260

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

    Filesize

    2.7MB

    MD5

    3aaa0cde48a0b7e6f955bbd1403e1066

    SHA1

    7502f88034ec120ed15a62407ae452400f4ac6da

    SHA256

    bb99f14705b3e822ac68f31fa91574b00fca486e1e06ff810b31baddadf099ec

    SHA512

    1c722d44b345f28fc0749fd68e728cb346d729e5a147041bd07b362bfd1fbbfca6ee0c4251a2640c5cbbd7e8ecaa24c6e37b075441906014619de87525a0829e

  • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

    Filesize

    1.1MB

    MD5

    4df090b4499b87bfdc48a707a4ea7993

    SHA1

    8632ef4dedbc90b6592031056a62b81f40dd2659

    SHA256

    68f1749534a95b34be71c9ddecc5825231fb2ffa6727b0fe0d090ecb0806cdc2

    SHA512

    680d5946d19ef788d97354ac6fab3996dd9b6163d8c0780e6a183cf8f7b0d0702310c52f027e3281a299e734cac253eb448615d02148b56c12b1855a26bea39a

  • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

    Filesize

    805KB

    MD5

    b5477f581da6cc904f634edbdd64e8ee

    SHA1

    f917b4a897d00b36f4ff5373438d51daaa37e853

    SHA256

    94873c65370a598f6c15e2d5db713c6222b1eed5457e231163da17410bc6a23b

    SHA512

    854936541f0e0c5943c177909e1a91405c3ae348b83bd72f22fe5d733c5fc6f1553d70c20f71824c78bc5d0bb348f8b2254f71c3948f30d925257c69f6818b4b

  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

    Filesize

    656KB

    MD5

    13453823f59903a9fe9d4a6060468aca

    SHA1

    f39dc5a56c5bb5f8ca90002db48005bda8adb012

    SHA256

    8d6dcd7af4109eebc2ee8684ebe9c11ebfe1b79872b88a429cd15fa62fcaa8d6

    SHA512

    f72a66e48188b5f96e0c9952766f3998ece22d695d08b79dc8fafaf3ee7fe2f919e0e40fc631b8465cbc13a34b943676fddd2312e2f087783af8554d80882392

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

    Filesize

    5.4MB

    MD5

    537a19b1674e34f5fc5648e31ea58e13

    SHA1

    e585a6389e79ffa68a5d65d85f64841dc6a6365e

    SHA256

    76fbdea4c7906b3abcb6e9b5ce7ecaedb477147dbd98d2e7b09230ea0b38be12

    SHA512

    f49b6fedfd312426bc70d1176d16900daeb553b53619a8620e0bac65aad5d06e331f66bb409eb46f3caddb48f85a70c4f1e3b07a15964a57cc5080404fdbf38b

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

    Filesize

    5.4MB

    MD5

    134702881a1d04b26ccdde9b0f0a5ad5

    SHA1

    bf81f2997339009dee8ead84d610a0fec4a0591e

    SHA256

    303266fd7efe567d02cd224c0d3559947dd5ceed228213faa7b929d5fac07da3

    SHA512

    81dea7231d79ca3dc78ef44f046328a6dc49ccc17808e027430c1ebf8cc391f29e5ec80fdd2883938affeac713aa62cbea50eacc31046f3cbfa1e8192508c1dc

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

    Filesize

    2.0MB

    MD5

    efa0d522cbccfa356c1cb96a62b2a7e5

    SHA1

    f8ee667f7a08caa10d3fa0266b2920cfc1a66362

    SHA256

    4e60795d416da0cb45081cf24c0caf440f811bb9d10bb8ff6740d4d0050c6899

    SHA512

    b955253794cf78f6832cec210f13f436ff6198b84706fed81e6b0aa864dde9f76fc8284fae31816b01dca8e9013490c6b37977ec46735c2774bfa6e1abc42e8d

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

    Filesize

    2.2MB

    MD5

    54af515eb2c16f36d1b37deffe38b83c

    SHA1

    ff5510444d8be0fb085f8a43f0b7578bdc8f583b

    SHA256

    8eece4bc12d8a6333f8f350ce46c4853bbac570e36e8eb7f46d3fb5c6d421bd3

    SHA512

    0de2f32f1acf08f3083723af637de1dcbd97ad6385aaddeddcd42bf103d58bd43dc357393e8fd070cdb34abd2fa49687b0fcce0074219db2dbd09b84555881ee

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

    Filesize

    1.8MB

    MD5

    7f5a317fe48ab3515cb45a70871d5039

    SHA1

    b1a3aa8acf6f195887f4bdeedfad927bade01ab4

    SHA256

    c7f9a287fecd8885a89b4ca2209bed3756f21d2a0602030df477f00c87eafacd

    SHA512

    c73a869efc402f37a578715f934c6b4effefcd04608fb3c6a8b0382745e6354c6346dba386d589770ec3e38aa0e17ab5b36d013a1aa99d0fd0256df15f5dd1aa

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

    Filesize

    1.7MB

    MD5

    fa09cdb9916402f5d1cc5ad34527f247

    SHA1

    f8532d43e5e2df632676e9f48c9b52c5e603611a

    SHA256

    51bb0a6c1316b4c20f0ecbf6ed59e67c03ff65b605e9b6525e2902db9eba4686

    SHA512

    86554cb5894ba6938edfb9175cec2d65d7e965b024d109c7838eb61a85a9bae024fc173792cecdeb8fc3b19ac4f3ad68fd699bc927adceea789ae38862c7e3f5

  • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

    Filesize

    581KB

    MD5

    de6d8602d882998b6cebfc63bc2cbba1

    SHA1

    c70d150bfbea9bc17eea08dddfd4046d12382760

    SHA256

    c3b8fe00500e5b8f7dea63bfa5077bf917c38f365d8f06ab222409970479887b

    SHA512

    f1dfd3ad79cfb53432576c342c4198d6d9e0dc72e81ea2aca6260a3bbf38a9fe157452550b4018f58ab6e9ed1ca3937245fae279a70bd3d57ce8a770d80a0aa8

  • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

    Filesize

    581KB

    MD5

    3e777b0e58b21eb330fc1af344464bc5

    SHA1

    fcd136df2fe8333cc98b7e6952b1d124de5c73fd

    SHA256

    c64af1db17ace9a74c86f4ec776c55b8acc4375c8913542757d4017653cb0d9c

    SHA512

    e996fc2fb905ccc2048c5c72fee3dd428c5cbd7d8b7e9aaad1981f7be25fa24c2877f5c8e6ed9c40bd85355b1ae4f00fc89104088a7a91aef7b7bb49712c42f0

  • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

    Filesize

    581KB

    MD5

    729ecfd7c672c35a0ed4354bdad39e21

    SHA1

    28689d697427153c758e944ce5419e1e7e19809f

    SHA256

    38d89539b3b2430dd6fbf25fe390a7d8256b4597af58e2333f32de3256f4e7e8

    SHA512

    d2bfbe232cd47e65b51f0e67213ce52597373d643c2afd3a3daf48ce07088a33ada5ac95362e2495999f68a7536c9d8017318c15cca9505954f33e38a65e6f14

  • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

    Filesize

    601KB

    MD5

    ffcfa866b87c7b690f13300f961ae6a8

    SHA1

    5649b64444e3261565a076f4f152c48af16d9053

    SHA256

    aafe8b3f4d5212d7cba7d14b07e9779b096000b92f8bb483361d0c1342bdc83d

    SHA512

    2a3a75653d3407574674e1fc0166ca97f183eee77d84973c12fe00c5eff1fc8e2154a24edb8a994f6056d9d0de44356337062351fdc2fd23963fc6258167d4e3

  • C:\Program Files\Java\jdk-1.8\bin\jar.exe

    Filesize

    581KB

    MD5

    e68d6abcc0a116102df432b4acea77f8

    SHA1

    b195e0f4209c422aeb14c35b31c571edb10bd97b

    SHA256

    516ca9bd119b2f1b1e91aec03570b21ec770519bb76abb393474bf66af0fcafe

    SHA512

    dc5c0b2be39f226260dad2d4753ab7eb68ae8649d56842ac342c5a678ae335b32c917da2d2be18a89809ae88f57293c769cf83aae0982b421e86355b06a494b4

  • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

    Filesize

    581KB

    MD5

    4ed85b0f18cfdd4773abf11ba9f5ac53

    SHA1

    c542fe8f6116e13b6a9858db1309c870f4ff39ec

    SHA256

    9a13fd595f1946041f6302fceed6dbe8a0617691fa841ea202bcceabdea6a98d

    SHA512

    392fb5c4b1c77f4feeb50e86f12036461d14fa5e49f43beeda4e4eee350ed15ca763f42ff064f6bf1c53b8ba3f97e807299fe65012748a55c2018f964a07c3ec

  • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

    Filesize

    581KB

    MD5

    4f94953cb03fa0b44add271df2a5c7dd

    SHA1

    c8da3bf7bdb8d1cb104627555d0931ebb7cb0d2f

    SHA256

    d467fcabb79ac2fabf0fe4b6ecb47488bc389b16df61a7ec97e20788977d37f1

    SHA512

    bba742034a69a7d5392e98f28d4edff87fb056e30703dc10bdd6b622840ed80b0138ffe1a2f1ac5e223fb101d0652c04256d14de1ee36127fcccc6f644a272c6

  • C:\Program Files\Java\jdk-1.8\bin\java.exe

    Filesize

    841KB

    MD5

    00230d7e5d1647cfd3caaaa7fff51e59

    SHA1

    d5bca51f4abfa7f7fb6dc974201d97ae1d1461ec

    SHA256

    fdd30bc1e4de12dbbe77d9b88c19388c5e01177ec2f7bc2ea8616531ee5676e9

    SHA512

    0e0e3296d0ed8036ef4fa1ae4b2e87e44a2cd664f49b17f03b09b15c197b9a12be24e3a419ab3360fb6ca5ab81041c5e674991fbeededec5f05a675b64b9be9f

  • C:\Program Files\Java\jdk-1.8\bin\javac.exe

    Filesize

    581KB

    MD5

    9654c292f188924db6c2202b41a91323

    SHA1

    f0298d8e0f76b3393e3bd95b6c30cf44bd46438d

    SHA256

    80059fccd4c11476706a59f54621c9f968697905bb30cbc8ef31043a725ea674

    SHA512

    3e3bbc9619fb4015f99678eaf7aee9661141185eb3c38210395028cd71d328588f0a26f9f22e02745661a0656fde12c189f6176576547bce4e59c8c48d879f18

  • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

    Filesize

    581KB

    MD5

    2c06d19a33ea8768c8f72c76d6ab9369

    SHA1

    75655cfae8edf809ab4398665df480612d4b95cf

    SHA256

    ae3e41188f4cc1fac0e4779f6ff5f4045979bb61038232445147978c3ead7043

    SHA512

    d73f29de8d60c579b3b4eb8bac162a3db94c3dc538765cf7a2b89e15ba71d950269e4d995298670450814351ecdf8bcb053ed70b20cc4124e2ed171bd89be151

  • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

    Filesize

    717KB

    MD5

    45400411a1cd7c7341277c082a985ff1

    SHA1

    7f602db5c9ae87c11d80a3c4fe783a95a1703b58

    SHA256

    828e344d34e809be2d76cc64e493c6ab2b5ee5068077ca6702315f0535f03d7b

    SHA512

    aaefd1a35d7210cf120b93dedda0c9e0fb52fa358b6406bce4d94fbdc139fdd911dec6393d42cc04ac1ac7cdc119463e907c349ae11f40f9df134af8fd0b5afb

  • C:\Program Files\Java\jdk-1.8\bin\javah.exe

    Filesize

    581KB

    MD5

    a6406afa4226d6e8a40afd7f09eb0c0f

    SHA1

    6c259b0ed8d66cd3680bc82458ac7578410aaa27

    SHA256

    2381f95a69c9bac3ae5c722679ceeb9dd891302e4ac38d3f0e0ca6c4aad59358

    SHA512

    b7931479600ddb0e3786ddff2db6fb9e31f69e87cfa456130efe4ef3503a83633be3110c81fe5ea8d65e7526727991cd736790506dbbaf4ca7557cac47c12c33

  • C:\Program Files\Java\jdk-1.8\bin\javap.exe

    Filesize

    581KB

    MD5

    5b2e586febb6bbee10938d419fb6ee5a

    SHA1

    95788f9aaeae6284e79ef50f47df6a20ee6a29a0

    SHA256

    942fd374099db03fe2aa174e6e1522f4f43155b3675b81d8c393210baece6d20

    SHA512

    5361334244c1c236412c07d0ff86a08617879e529c5f4571ec40a6ab57d59af0e97fcba927f87ff9251d91dd7a280d576883903308123794af0742b10526fb43

  • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

    Filesize

    717KB

    MD5

    035f4a4cf0e254ab30ae23ddd29ad902

    SHA1

    fce4f1685f8fb34b42c1ae3ba06521a88649f95d

    SHA256

    5ae688966831cd656e610dd4e3b89d0f38729b6ca50feab8e3605134be73a437

    SHA512

    7c636093dd0a715407e7044d6189c4c5ecdf0dbd429a93633029d59d0a15c6655b13615d545cd74311f6ad76ac83636a88456641a7353790aeac2bd84b104efc

  • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

    Filesize

    841KB

    MD5

    8b8de6765b7dadf9113a5e6e836053a4

    SHA1

    68363a6496399bea521966c119807ae728a63763

    SHA256

    75fc193328a4d91fc811d64c896063a2e5745288a7c2d3e69f68aeb91a5729b0

    SHA512

    2fb7b521dadf6ff978845d92c70448f999a6bea0d75da4a171e0c94a104dc13a5912ba6b532bcb0ffe7a36e9aca38b40a6106e9a64ebb1019e34caec41b55415

  • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

    Filesize

    1020KB

    MD5

    43c073fdf8ca557468b90a3626b3746e

    SHA1

    6b6cfe06ddc5947067d130c679c79d19595feb69

    SHA256

    2653c228e549f5be460279fbc4f2cd55d6719e8c1ac4d975ac1ffa945d0ef382

    SHA512

    303d770fe71cc50c7d26b38615fcfd8a25e7063027bec192045956ec6a0926e73312a90c834a4f982cfc6360a01991a7479e5920b2ab395277c69052a83e8f15

  • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

    Filesize

    581KB

    MD5

    5619be92bd7d7799b717a3d71eea1e21

    SHA1

    159de245018aa7005c1ce3e346ddb1283d147ec5

    SHA256

    2483b683985b8bb8161e08aa12ebb47e8d2dfe0c5a3a29d164e04005e1df58b5

    SHA512

    e4a93b54920e6dcb1cc8b84df9a8bcce75c2cb76477fe0e6224f183f184b53793f5bb55c3ae117119bf9fcfb3ab6811f2a850eb0cb25c835814796da42647175

  • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

    Filesize

    581KB

    MD5

    391a74f763e72615ec6e9bdb94029aee

    SHA1

    f14874c3a91842cf022efe48a16bfb567af0d472

    SHA256

    4296057e6fe479d978542988e097b2970354c8bb9e7d3930cf9a7629604263cd

    SHA512

    0d79868ed3b12e1d227c0468a9a486152322a66b4e71e8b971e1b9017d50a5b1830e44d4ad8a7653c31a06fe5eea076443fe344df18208c34d295faab2cf4b96

  • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

    Filesize

    581KB

    MD5

    6810287f05bb67b6b2707b38219fc451

    SHA1

    0c4d28f1a0470172b71dd6a1db0fd2e246a859af

    SHA256

    83bdc5068cddb1a42eb4441c748264fde1effb8afeddbc4e0fe8c420e169e07d

    SHA512

    3b90cab2ad380b44d3f2b4b07f6d4ab246cea1db7555c1650c70977587ec4247d43ae12c46d3119d2dc33ad75016997a5053f98d9d3392d30b627fa1d28fcc0d

  • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

    Filesize

    581KB

    MD5

    23ce766ba5431c0a86d5124203caf524

    SHA1

    2a5a1acbd7dda0537ddcbc61ba7cf40bc239c3ee

    SHA256

    83520979b4c6820a905ba422fb997758e771f6c9c5fb23436e98e46e76e073a9

    SHA512

    4a6f90c7fe252108d648429578c99aa61286449d3641ec6cbba1e4a0b7ce13ed12f3920c45f825f11cd98c0c0c89a0ddad1f09bed7d357ea1267d1baab37bc78

  • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

    Filesize

    581KB

    MD5

    02a900083acd5834505e9226d91d764c

    SHA1

    b1001339690bf46c5960f33a7958b260be186987

    SHA256

    0adf339cae8258d9e337ed7187f40fe9c4f0a187e19c3479b2b3e4922a0c9fc4

    SHA512

    68056e9063c810824ee7dc5e8dba5494cce93fae4001f64654205e0b2ad8e0193196b69a0ac9f6b840da4c386f53030a378fa0e2e735a719337a879cf405c483

  • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

    Filesize

    581KB

    MD5

    b00af712dae445b6d6f68a093b9620ee

    SHA1

    93ebdfbef6ef1566c3fc2dc74fdcd4217cab79b0

    SHA256

    51a06e8a3631ef3ef4b56cdd14963f0049c1a499360834f32f83a311f7cb9ad2

    SHA512

    364c8201d6ece4c08b8b0f1866abd3aeab0a569adbe4ee28b97da3ec3ce805f03a92ece8a64d5bec1358f2215413aebb2b2688c978a8b55f7089f54c1822d4a8

  • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

    Filesize

    581KB

    MD5

    752fb8a14b220ec932a55c78e2d1c3a1

    SHA1

    1f834f6bb4b801f917707ac3a78318ba58715b61

    SHA256

    48941bc73b4faa18b7cb4591bf733dbf056a43e6fc2c78f87e8809d7a40006a5

    SHA512

    63d5823d20f3e16fd17c01b45c797a3d75de67a75971508f12dc9c4d61fef469bc0607ebb996145a87df0acca8e348818b4eb9ce93da4ac32e5bc17a826147d4

  • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

    Filesize

    581KB

    MD5

    fd1ec00ccce14ded8856d4497b03c3f6

    SHA1

    6ead8ce4e95fe63a24503d6156e3d3f21341273d

    SHA256

    51577b88c849533e5dbbe5c25aac09351b902909f4ecda424634473bd2dabbc2

    SHA512

    2a061e63f923f5446570961428ea6e871f7d4e3d335f532cc16de15baf401d56c4a3a68bbc02b42e8672284d08e1e3d6f91a77660abcb6cc7e126c1560195b65

  • C:\Program Files\Java\jdk-1.8\bin\jps.exe

    Filesize

    581KB

    MD5

    7386ec35ce28ad6b39aac6511a52b3b2

    SHA1

    c8403a8d92156909060656e5bfdbf25ef24c66d6

    SHA256

    8bf744c74b4957bd444223b10d8a8f5816ade9dadf31629450b3783afffdc39c

    SHA512

    a008e20824a9455c7a353ecd26a1ab97c8ab624cd915f657446f38598d7d3eabd17d6c142310389398e4c86ae39e04f9bbdf1c8f7ea65b5ab14c526752d59bec

  • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

    Filesize

    581KB

    MD5

    1420e8d72958c70de929902195dde4df

    SHA1

    4e1dd333096c647bad20ec23c81e6e7ef640c2f1

    SHA256

    bbebb56d51f157a953b41f3fbbc05cb65270dcf6a2c355a037e5f5ae0ab01f5f

    SHA512

    9ac43a51186bdf6f15fd86b4c02f9fd43e9d5ae7c79239ff940fb3fb90482807cf9d16de85e05a33f691e3fe97c06f21d6c89b037086ab0ddbc772165235a511

  • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

    Filesize

    581KB

    MD5

    8b316546c8e9461ad0bdcb9e47cb8556

    SHA1

    890175181010f077985806def6800e0fb3f4cd87

    SHA256

    f9e0d30391a1520bff4c413f98c883fc33342f2823bfb56336d1e7c54f84eb57

    SHA512

    1dd66d0c58d6dc9adfa7967575d1a0fb186e8b81d74b3fbbd9810e2cd2d994833d6a69edac16ecccb48b7d76614c1a09586d297063999a0ffe14446ec589ab12

  • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

    Filesize

    581KB

    MD5

    f661f39e169dff512aa8ad6ad41fa9ff

    SHA1

    387e7a24d2f30265f70473691da9965e8bbce622

    SHA256

    eb0a8222fabbd5841d69eca53fa5c275a8b4b6740d724d2c7a4a9dfbe43d9a78

    SHA512

    4451254dc22d50435a5f649cd4278e1b73e6fecf43c6355fb4e05b373ca73d4c9516009821e2ff8a32bc480e620bd13e9215e2d10807543c761866d13c008b5b

  • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

    Filesize

    581KB

    MD5

    41ebb95ccdd44222e19accc9d2a86c07

    SHA1

    19919c88899640fd54879a89b13015bfe54ba98e

    SHA256

    2dc8315204c8976dcad960ead219f1e792bc4c1bba219852ace1038c216b21dd

    SHA512

    c9255862a0b8dfba7b825176c0d42e3f72d8052f93854510f2b2671333d3b26c7ed461673b0854cbb135e9ebf6ea31ec2e414b219ee6972ab80421ee9ab0fba5

  • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

    Filesize

    581KB

    MD5

    e413333b3841b3575ed79a40a5369cce

    SHA1

    fafd978ba469dbf8e8c70043ea2a1a92715a62b1

    SHA256

    40c7680bc083bc2bdb404e048723cb840dd6628e3c7ec5866de64e28e4162ef1

    SHA512

    21774b5ef6bfa8c667d4e673bd19b77f37388f98e6da2fc737cdedb729e46f544f2b332fcae5247b4af88421b390c97c6109e7b4e97a1bdff1a2a436c5f74beb

  • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

    Filesize

    581KB

    MD5

    d2d97f5d331ab3aa1d3dd7a26d4e4d61

    SHA1

    767e995f6a1d14baefb5d314637ef30f0c8f89ef

    SHA256

    51c2f6230bba6cbdf0c9b9ce22bce547581e151ce135f174e0157210e6cb22b4

    SHA512

    b68e6cadb3cde6b8dcf249984d4bf94934143d47f0c012af22b3b4681e4f3572944daf813984b1727120f9751b8d1c69dd97bb5752b7e82ca0dd01cdec92b7fe

  • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

    Filesize

    581KB

    MD5

    cd6e10f366018d59911172a12b8da8ef

    SHA1

    460a03f788d4f17d972903d864bb1fc7ba45842b

    SHA256

    87a89cfa85fbc9075c8e4e214b517cad1f8ea43038299ae219a8f488aff4aeac

    SHA512

    71bc2fe0be70f9bb041d075db728535146f9f86be01bf4ddaea94862469c008c0029d59fb6fabd37b426bc2cb3a983f2c97e753656cf3e2f06b12eb0f6770f3f

  • C:\Program Files\Java\jdk-1.8\bin\klist.exe

    Filesize

    581KB

    MD5

    c37badc759630439980533d69250ae4a

    SHA1

    101210ec12d57ce0ea9883162dc2e67b7be909c0

    SHA256

    395968da38a46a5ae88dbcbbd65cbc4ac8a3de338bb0228a5b0871158fa3393c

    SHA512

    160e7bd21b2820b8e4fcbdbd626b354f1cb722607c503efc0e1de30d0fd890b524256515c5102912d31792d7b54688354e065b5bf4a19309c44cb1ac64391e8f

  • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

    Filesize

    581KB

    MD5

    967e304aa7385ec48568551437cba465

    SHA1

    b782869d11151e7b1f2b5e3deb5565e158166d80

    SHA256

    39f5734538bf1a9f68aa7b0df702f4640f2d5d081a3a89fe43c2e76f56a607c1

    SHA512

    67ef3cdeb16d6de31c9dd159df4a5498387f4af350c47c1a65c4dedb137a39a86c33486235947e04daa1d3205bd6496feb2096224d66810f95b47b81bdd4ae06

  • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

    Filesize

    581KB

    MD5

    51073883790e1deb3e97f7d93cb5aab5

    SHA1

    d85ef57585619f1a4e6cd05cdb902486904041d4

    SHA256

    37ce858f8dc3c455aa8bf8256c34aa64b5cd7854c3bae9c877521c4ff218369d

    SHA512

    f8e2e2c0f4ae7e7a54a46ddd32337044c8fc44f92f097865aef15bd42c3ed56a9bccdaa987788ed11b4918f8e343f0f2697a140a0674a75e27d01167e7a84330

  • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

    Filesize

    581KB

    MD5

    69d7d7dab05e681a3380d183158ac462

    SHA1

    d849b8b187a6443a7d02f059ee4a1035a76969f0

    SHA256

    7b61b699b410295be3cd04749e96f1cafdc6eaa7d438991d8e189caa6fd30066

    SHA512

    14117a66f0eaa40e3fd8a7853db001551c095cd24df891a9c603e64b22a3bb3ed16b413add523662ea66245f7e881d2c75cfb06b1d510a211cad96311c0d4782

  • C:\Program Files\Java\jdk-1.8\bin\pack200.exe

    Filesize

    581KB

    MD5

    6a7c5ac0f5756ecb9132ea4328bc0dbc

    SHA1

    8f8be8c1d6ed209eddd368a12715e43b86c0bdc6

    SHA256

    97c59c69c0ac79705a7c4c2f569e79b2fd879fcd92faf596e459de6a4910b689

    SHA512

    edc50ebed679b60a66b062cbe0a40137a3f7934dca3de2f1e3d74b1ab82d675c598f09a1d31fb10ce9cd2131913823ea8040e392cbeb694fb07c299333895173

  • C:\Program Files\Java\jdk-1.8\bin\policytool.exe

    Filesize

    581KB

    MD5

    a09a0a788287579143dc393ec758f11e

    SHA1

    9b7022a7a82d3847a7d15f6053392b5eabeb1f46

    SHA256

    dfcd0f18da8d87adbb9469d7de3063943f4c80888caa422ec1065dd87f1347c0

    SHA512

    7f4b21f27165cd4224fc355101075a968efa384862132042f043c5f634ee15a7cf20e13e4d0c75083a15e3edf2b8270464e5c3e5f2649b8946389a142da7aa1c

  • C:\Program Files\dotnet\dotnet.exe

    Filesize

    701KB

    MD5

    2bcce79bf4f734301412cccd6f02dfb6

    SHA1

    af04fcbf2e11bc8e51274ac9ebc09862117460f8

    SHA256

    80e1ccb3555e336aadbd16b4eea91752c029660f2367df1a6624019df4ff4187

    SHA512

    4d5dbd974c7975553907b8d55d05ff64f7e7ed800bffa3bd3c6288bbbf8c84f97f10905850e5549c936683623542865528567549dc44419abd834fa3e42c590a

  • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

    Filesize

    659KB

    MD5

    7bd1ce18061e63b7a5a020745eda2f70

    SHA1

    0f3fd5d393dec55dcbef748a7ea82bba1a820f3d

    SHA256

    c07fc96315d3ee2aef362eb3bd677a9abd834fcc987593c2b55e5ce9ee6900f1

    SHA512

    2ea48e357be688a9ea3108ea585e5bd5332061ae480980eeb913ddd1433768a054aa1d2a68fcd7ddb2b8b8521d6dcd3c2577af904067343bb52e3f1c9dc1b069

  • C:\Windows\System32\alg.exe

    Filesize

    661KB

    MD5

    c362ce5d88e8504977b0c4488c55c152

    SHA1

    babd10e59cac9ba3dcf6b48c040e3fda921cf460

    SHA256

    0f371b114ee5da9b09a10475f865e631b1e3469b19a28405a44d5cc5a6d1e799

    SHA512

    fca8b652533acccb33d9766f5d89184e2f1bc0734575aff4337db030199d39b9c40b2abf8ab384bd8a4161172d70db123e0c43f595f4940f3acf14bfaba590e1

  • C:\Windows\system32\AppVClient.exe

    Filesize

    1.3MB

    MD5

    87119dcaec86d3237b04e2c31693f451

    SHA1

    64df0c0e01e5a80605951f71e5ef805a116a68d5

    SHA256

    1b3e6f344b059c3854dc16549654dc3c3b014f73fa4d1360afac4e1bf9f4a434

    SHA512

    97657cc8f883169a32dd20603829c25ea06151cddb70468d3af4d6c3dcbeaa8963ba9e60ebb7544a1b5c6cad812a42fe367c585f3cd0c05c1a6bfb0aa1b7667f

  • C:\Windows\system32\fxssvc.exe

    Filesize

    1.2MB

    MD5

    b913007472c0e2c6da7ce84648b0dc28

    SHA1

    1a6a806f3d468028ae627df6d2cd27bd5218b668

    SHA256

    5bbd577f9b5d4c76edc362bcadd9382235654b026a996e909a78e26831ff7f87

    SHA512

    33dd7c62e5fd562a09f2514026c3b05d6a714053a2dec7bf7f612ac89897b769a6be1ae28930c9cf956e0e0d7c013b6c62d9746a84c46085fc870bb0ac9d7707

  • memory/32-248-0x0000000140000000-0x00000001400AA000-memory.dmp

    Filesize

    680KB

  • memory/32-12-0x00000000006F0000-0x0000000000750000-memory.dmp

    Filesize

    384KB

  • memory/32-18-0x00000000006F0000-0x0000000000750000-memory.dmp

    Filesize

    384KB

  • memory/32-21-0x0000000140000000-0x00000001400AA000-memory.dmp

    Filesize

    680KB

  • memory/440-42-0x0000000000C80000-0x0000000000CE0000-memory.dmp

    Filesize

    384KB

  • memory/440-51-0x0000000000C80000-0x0000000000CE0000-memory.dmp

    Filesize

    384KB

  • memory/440-50-0x0000000140000000-0x000000014024B000-memory.dmp

    Filesize

    2.3MB

  • memory/440-249-0x0000000140000000-0x000000014024B000-memory.dmp

    Filesize

    2.3MB

  • memory/1852-6-0x0000000000720000-0x0000000000787000-memory.dmp

    Filesize

    412KB

  • memory/1852-39-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/1852-2-0x0000000000720000-0x0000000000787000-memory.dmp

    Filesize

    412KB

  • memory/1852-8-0x0000000000720000-0x0000000000787000-memory.dmp

    Filesize

    412KB

  • memory/1852-0-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/4092-66-0x0000000002250000-0x00000000022B0000-memory.dmp

    Filesize

    384KB

  • memory/4092-77-0x0000000002250000-0x00000000022B0000-memory.dmp

    Filesize

    384KB

  • memory/4092-74-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/4092-79-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/4092-72-0x0000000002250000-0x00000000022B0000-memory.dmp

    Filesize

    384KB

  • memory/4260-81-0x0000000000510000-0x0000000000570000-memory.dmp

    Filesize

    384KB

  • memory/4260-89-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/4260-87-0x0000000000510000-0x0000000000570000-memory.dmp

    Filesize

    384KB

  • memory/4260-253-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/5024-25-0x00000000006A0000-0x0000000000700000-memory.dmp

    Filesize

    384KB

  • memory/5024-33-0x0000000140000000-0x00000001400A9000-memory.dmp

    Filesize

    676KB

  • memory/5024-34-0x00000000006A0000-0x0000000000700000-memory.dmp

    Filesize

    384KB

  • memory/5056-54-0x00000000001A0000-0x0000000000200000-memory.dmp

    Filesize

    384KB

  • memory/5056-63-0x00000000001A0000-0x0000000000200000-memory.dmp

    Filesize

    384KB

  • memory/5056-62-0x0000000140000000-0x000000014022B000-memory.dmp

    Filesize

    2.2MB

  • memory/5056-252-0x0000000140000000-0x000000014022B000-memory.dmp

    Filesize

    2.2MB