Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 21:10

General

  • Target

    2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe

  • Size

    1.6MB

  • MD5

    5e59ac541dec051f71e6c7d6144a6c75

  • SHA1

    53d06fdda957a23b640b7d572d6b14e38f2a3fd5

  • SHA256

    ca4ff92023f433abe5f7e0bd90074da653e88e7ed84755a2db75946960db202d

  • SHA512

    212050e904d38f58b994f4b88a805720276bb20b513718dfd66301fb8d4cb9dbfc1d05d89f3d97b78f4699aab4104822e3f048820cc29f08f6458ec46eae4044

  • SSDEEP

    12288:Y2lWRPkhA9PRWg94MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:Y2lmk4RVSkQ/7Gb8NLEbeZ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-15_5e59ac541dec051f71e6c7d6144a6c75_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4892
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:232
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4144
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4008
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4184
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2520
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2252
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:4912
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2400

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

      Filesize

      2.1MB

      MD5

      68570dc779954e72459d74b92ab9d546

      SHA1

      572e908338c25d2c0966b2baf7f1a9bbf5d8ac03

      SHA256

      da523843be5d6fa19dac4aed16cd5b7693bec160f647549aa5b8246921f1ded7

      SHA512

      9ae466c6efef64ec4dbe3ccea477f620ef1e0fbced6ee73891312869c41a62093d143a81297d8d90b169ffcc5e2ca54631b8e93084b48086ddde17e84ab03766

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      1.4MB

      MD5

      9c7104526eb537327f2566cfcf814508

      SHA1

      c4404163cfa6c2c5dc42fbd4a0ee6323e5e59e0d

      SHA256

      ebe428c526b0b0289014f148fd170e6757ea1b2635ff5f4f2f58bbc103721362

      SHA512

      1fb0a3018d54128a09d4b7188aab1790a7c1cc379fddb962b01f0666a84f1e53fc66a3cf7c2981e697786ef872f96069be06a202cb5b830d1ff2bbcbd8b88bc0

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      1.7MB

      MD5

      3e05c36ca17c79b4fb7c9e0c18997f8b

      SHA1

      b1c160bfb947200ac9615b188d052e350dc16aef

      SHA256

      11471fea6a553339699692d1d5365c6d94cfc167f3a7d8534cfedc20fe4399fc

      SHA512

      a54eedc05f832e4536f6be03c9170d125150987d0cd83ff573e162a9bf4693fd93186379313a9bbce5c2f97a6fa5528cee90cfb5602c6bada81da335c189819a

    • C:\Program Files\7-Zip\7zFM.exe

      Filesize

      1.5MB

      MD5

      292576cb9bb2fb584f26eca3037561bf

      SHA1

      c4a67022ec276225efd791644f9104b37a728c52

      SHA256

      1bc997c27346e4ee64757e97d89b2e30a5cce2c9174bf0bb47e4c7b23e99a633

      SHA512

      7692581184bc0de99f2b67898c7e6d85e532dedb1e957dab60515f24f597851b1e5e54b8ce61dcfdf4d4a3ebc3bf627a7ff08e8bd32aae090d1a4fa628aab842

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      1.2MB

      MD5

      4d2a57d29060de4f19718ce91c121c0e

      SHA1

      1ce3097c53e2223d6670e6fd997b11d659558796

      SHA256

      fa4d09d8e7518a18780e875e8ae93a8926c858d02016d5e51219cdbf6627760f

      SHA512

      ce9b38fda2512099ef5aca9fc41d19d7b8cc76e7eec99f1acd9e448afc8c6e5ac5de6292eda14d0defaeb12e5c319a8f9671124c7c4182307f3d07230832a5ba

    • C:\Program Files\7-Zip\Uninstall.exe

      Filesize

      1.2MB

      MD5

      1c6574937902ae014e055e6c004f740e

      SHA1

      5faec084cfc30db36df0c8f27f278b3099d83ecb

      SHA256

      423b4432979d8cf8e8862b264a9b6a64d5a1b928ed6d59523fa5921e3b174248

      SHA512

      2c72a8e3170053454e7354bf302a201b313924c8b8494390e0cd785a190f325233d9df92780fb47ed746a95c3c928ea29335dc838a4d19f2c41f5065cba45f87

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

      Filesize

      1.4MB

      MD5

      51e82353891aa9d802dadd0e73ed625f

      SHA1

      83f993d21091b78198228eaa46a16b80819f592c

      SHA256

      fc9d80527bb66c25dc88adacec75b7c7b00158eed3a5edce46fc658a11b72255

      SHA512

      53f2a9e162837172f042622869682c57c809f0a9e53e0c162166d53e23dee0497871f3284ef7a06575cef90966ca15f2404fe51a5ac6f4be8ebacbca2c3012a7

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

      Filesize

      4.6MB

      MD5

      487788b183b06d94dd880ce9b7b853c6

      SHA1

      6a9fde84751e7df79c6e189d645e247367e1de9e

      SHA256

      a7aaed1333e795466e6108025f3181bbbcae1d7d7b4f359e5ac2078fd28badd1

      SHA512

      60d215097793f56b7495ec6b341270644dbbd9e3bd068401545964e176576e652b064058493fce98caf4ec5bc91cbf669f445596643424c6866b5f0215bc0c14

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

      Filesize

      1.5MB

      MD5

      00fef85abcbd25663af9b52cd12f3c71

      SHA1

      7467813c5c9e1ebbbef7475aa772f94b51ad4573

      SHA256

      ee1f2dcbd2046b685453c34a18f466ece207c1c79b7c5e897124b393545dd70a

      SHA512

      9c9b94520fd4ec1bed155155814a69d4744ec77e6475eb1c32e3f94fb22bf307d730bdefd2e39b64e08daa2d261c9f7ee49bbe9f6461fd0a1b6a6b73a6e16c36

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

      Filesize

      24.0MB

      MD5

      6f5a941b61890529741b8533f14e6d36

      SHA1

      24846d9eb2de1cd04192e2d2d2024efffd317062

      SHA256

      b8649f34186fc06543a18e4ed7006c9ab2a5c5580e19b7eb693af6d38e0d0ce7

      SHA512

      e4f9a1c53201a6ce61db1fe34a9da446d6743c2c93da026f2ebf0648f2da791524d8f54e37e4a9ceaf3bd335029a20a88d23e1b0f587af46b48257486898e39d

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

      Filesize

      2.7MB

      MD5

      9f89376002c8f46fbfb8b3f7928db3be

      SHA1

      8dcfc6539191512b0984b34ba16ee551993c5df6

      SHA256

      baffe50d851936a3e792a35e04f423e266c29546f2a8c7bf7ec230847c7d29b8

      SHA512

      b2e1f4783c8158a1c60b93020abca5aeea222d6ffb84571c2e055887b489b340f83339d16eb1e77651eca7fd9e1410bf92a7d82e74f97aa9664b0cdb679592e6

    • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

      Filesize

      1.1MB

      MD5

      ed4a4dd0857f2799406feaa7a00ba46b

      SHA1

      35d48622532908836ef5f202a0235a94297141de

      SHA256

      31a4ab4fbe9b762407bdb824bd997f1b88b050f5e5a4a067d3ecf352e20dfd81

      SHA512

      d25fd280ceab2a9382a293639a7f8a2b0aa0246202cc0c53769258fd1126cb2fd528732d7d100d27aecda47e6676d5bed421b9d8e3445200ae33344e88a77069

    • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      1.4MB

      MD5

      9d813422b938f29585a418edd732d874

      SHA1

      893dc984828b205c6a072fd43f452595a3f732e5

      SHA256

      2b45d6866c499df106a9b5c6769e2d905078c992f061843525ac60acf8ea59ff

      SHA512

      17101963ffabc9074da717acbf0c4d0d0adef3227d1bd396ee09852dc1c733d0bb0da61c7a0995e3931056655e46b9f52d0c68501c530295e489e82f69a03b07

    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

      Filesize

      1.2MB

      MD5

      a3bdd8d7b0b2eb34eeb52ccaa3cdc1c7

      SHA1

      a20d97bd2c27184deed040cadda8d7d79d7f947c

      SHA256

      61ade1638c76fd96f6d1cc5422996f7aa759939ffa816f09c1c896a7a16ad347

      SHA512

      60b49dbb0a03675e4f62608ade2707ec7bb7d9118bbb7a5ee298ea5a8b0085af7871dba6688add7656ca1436b4ed92cc26fe791180d6ae91ecfeadf6a64fa2b7

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

      Filesize

      5.4MB

      MD5

      f54ee2c8113199ed8cf07d0d5a88c3ff

      SHA1

      66980d5be56cb0b3abc334304ff454ae75c16e86

      SHA256

      86c8341a78c7b894dcdc27b8ccceb4676182eb119b2104da6cb00fe2f8f56b98

      SHA512

      6f859d7ceb7f78a77bc97f5a36680a3dbd98b8eb29878a74d331abb406cafbbbae166ccf8b2982ceae5223fb9fd0822a32b103e71ef267dc13652a51aeac8931

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

      Filesize

      5.4MB

      MD5

      b513be324a04bc1bd1bda3e468bea6fe

      SHA1

      d5a41f8a16a51a49fe6cc40875b34125f892cedf

      SHA256

      64600960b81dbc2340b3568ff2ee0fbf42886bd1ce336ed84a66773ccb7fc47f

      SHA512

      8da3a29b35802c4283a9251a4c237e820668e997d9068a76acb41dd58d9da375908661134c289d0cd6ab9233dfe0c14752c7eef5e756bbe34462e9f1ba023359

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

      Filesize

      2.0MB

      MD5

      80a1d72b12348a5d521f0ffff5d91a0e

      SHA1

      9b287be05bb1b0b0e2a81c6ca6ac1fa587ce0c58

      SHA256

      df132297dd48d660eb13b972b82ad4a0efade2472cb33883754e9429e572c49c

      SHA512

      c71a344773ec015a9f8ddbecba900e82736de1064cc9ea7634f436ca49aa0166fa926fff435eaafbc7a3f00a715b40b1b50d04b642e545e81c7685a26c7712c9

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

      Filesize

      2.2MB

      MD5

      8c4bca781505593d782cf41a0cae5a31

      SHA1

      5b4d9c9afe136cba72d755fb2d110178c685fe9a

      SHA256

      fe26201119a8b453465684c1e967dc6fe7f91fe6acef18fa06edc8ae16567534

      SHA512

      00ff97fd58d27add4be84805a7b46b0173374950223f5552fa39c4760dadc206fcb2a6cfc316b11df167073a61d4c4523f050ed2349a6a611288d7a1947a42b5

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

      Filesize

      1.8MB

      MD5

      3e1ca5475d22fac3da987fb0a83293e9

      SHA1

      c67ff8307723fe337eab7ef17b98b9762a96e9f1

      SHA256

      63bf90bfc34ce41d9eec96a4256353c87f49611af66942b45333b36763fbeaa3

      SHA512

      289ef41703915fec32e715b501545499977eb3c086ccbcaa5c249c6d30c35f503b42740a47244c6256fa663ea1409fe0d92e3401fb14e073b7366576f78c2e63

    • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

      Filesize

      1.7MB

      MD5

      95d30dc9f238a2547f034b2be4b57344

      SHA1

      adb6e55862eb7af8bb9d08fb19ece993ed0b1ce0

      SHA256

      fe027a97895cea75d4521ae18976cd1a33a175c0b8cf8bc4bc992a5b2b86f8c5

      SHA512

      238c8a7f5164c2bdc42c98e27493354be30ce44adcb1d33ef9ccce01e915a3a89bcaf716a945ef4f0c3e013cb1c9b909efc6487759e3d1fd8788c2d798fe68c9

    • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

      Filesize

      1.2MB

      MD5

      6c49b60227311acd372babcc4b0396be

      SHA1

      87e512d0bd9388fe391304305ee708a317a68ec7

      SHA256

      50fe72a03fb0368f8dc2e4282dcbb7669cfc7ac957bcf1d9baf75b965920b1ef

      SHA512

      7612036f498ba60f1f4b67536161622521d8bcce871338b1a09ac35117f999abbe5958b10c512b48845d17136f66a34745276558b79ba6adc814232df133a525

    • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

      Filesize

      1.2MB

      MD5

      8b7187d51139817fb5e6cd6b45f47e75

      SHA1

      10de2aa59110b2d46b965aab3c5121e04d88de13

      SHA256

      30f0276c3f5c7ab6dab8b382d746ad05974d8d4d1d58d5c6a524ad189958071e

      SHA512

      627259421f668006f5093ccc9d61fadeb5a7cdb764e0174e93e5156d56b8729408c21340666c241632f55c147de31963ea8b8577143ca8ce7dd623c2f9bac601

    • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

      Filesize

      1.2MB

      MD5

      81252cb0e0737162f122d79255088e82

      SHA1

      6541326ba8cca3623d1ca748b84c87895f2c6622

      SHA256

      94e6f2c3160e69df990d39ffcba80b6d2f79b55f163218c05b5a4b72bbf2bd6a

      SHA512

      f439e20e2f473e8fcb86915ebb61e6546e64c98b533a018225fc4232a65df4bc607a2d86efd42fbe78e9fe88a6e6445b5ddbe382ee052da504cec465283100e3

    • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

      Filesize

      1.2MB

      MD5

      33f79c15977013c770f5279e588406ba

      SHA1

      c04ed66d0d68867966112d56862251f2d7d876a1

      SHA256

      51e931489d27679f8957e00dfe2de486c7b5dd7f6cac435031c3ebb06935e6e8

      SHA512

      b9b42e2c8d66140efc10d14f1ca07bbc1d961c0c45e22be7cf6ae7ca6172f1c817360140bf42f6dfa4a388b12c105fc0af3f8cbc1006eac977fd873ea9e6841b

    • C:\Program Files\Java\jdk-1.8\bin\jar.exe

      Filesize

      1.2MB

      MD5

      f43d6a3274b7c6edbbc17bf3a126d8d6

      SHA1

      275c39d7ff1dbd6a49909515003592a75417acd7

      SHA256

      6019fc9b3f538e7812ff6e113c966e3381c511f79cf1f6f46c2b6c85194c9136

      SHA512

      ff95f5011e552ec869440ec2930dd79d979f49397e50c07fb69426f6197661f3468ff6f5b4305502dae13a3f742430b0ed77f0381ba74cb9915abe48021cc382

    • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

      Filesize

      1.2MB

      MD5

      e26f7f0dd62121a1041afdcb4b8fbcbd

      SHA1

      0dbab9e2f18d6e4d1fd3af1f7452618241612628

      SHA256

      5414d9bfa4081ec5d32b209f2baeeff8f1b096a57280af93ddf3d4e838305f93

      SHA512

      a9b09d021bcef3dd472298744c29414a22479179c0c683d9d1b36dd4d407a765da967ce6df04258b6d8c5b2ef37d5c990dadb89566e3f576754187a45af11638

    • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

      Filesize

      1.2MB

      MD5

      49571e0235cb97f7d91f92d7555c1e15

      SHA1

      bfa72390426e5612b0c8ecb1fbd5d2bb09a29495

      SHA256

      23f905f505334e8d4cb5a3a891d563b7b27c13cdeee0d9e441badfe4253c83fe

      SHA512

      7e22e42eaf1f3cb45ef85340d707fc36577ea16d907034f8af0d5f723f091e48b66e52c155c7e126b0799f85521c4226214b1827a0ceebf583c1346b0347cecb

    • C:\Program Files\Java\jdk-1.8\bin\java.exe

      Filesize

      1.4MB

      MD5

      ecdfb82a91002a444e673c1dec99340c

      SHA1

      dea7534e08863ced193f067a62768f38bd9e2a23

      SHA256

      fe8caf61e0415c5bbfc1c05944b15889f62a9ab2aa78e092e24eb0949d702742

      SHA512

      22ea5fc105addd80267c4ded9525dd4880c76043c299eca5e669b1de9cf8adb938e8a5b7c22e0f8253b62a9afcd9b567e7147b3d073a6a3c136886b31ee8d9d4

    • C:\Program Files\Java\jdk-1.8\bin\javac.exe

      Filesize

      1.2MB

      MD5

      dc11e527ad2cf58254224a8f3e1f6986

      SHA1

      bd46a09cf8d6d51eb1b333173be9263d6b4f3644

      SHA256

      6b3aabbaf79ec580f53c33354744858313ad42cf85a254624329a609b4d677f6

      SHA512

      cea1221a85977e81df6c9f59e238caa5bd7069060b7898778ac623002c7b50d544a3c46aa84a2384aa6e63aaddf6b9a19ec359dc160f9938eb18ae7391c70c87

    • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

      Filesize

      1.2MB

      MD5

      e3fcca64f19204e39c292bc4ce44bee4

      SHA1

      b0d130866bbf6ac8d20238a9bc67469608ca91db

      SHA256

      1ea3429750116bf137dffd3eca1711ab2273bd87e69e33bfdc1214f5bbd0ca22

      SHA512

      34d0a1984eb02ac099c86813884296a7d4aafba218d940e6890a7b98c794cc196409691134695157aece8d4ecf46e1d8dbb937b5bd57870d30ec4a4398ae3043

    • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

      Filesize

      1.3MB

      MD5

      5bcf7ce47a3945d7b67890ff460374f5

      SHA1

      9417a54fa08d35c38323801852ccfe3cddcafa4e

      SHA256

      e33c028813ebd22f34260c06b3bc5da22976cab543f8396c7ef612a12abf5a1e

      SHA512

      0ce12c1a6119c60d46b7215e62d62a3a3bd6047ef7f842542cf21c675f29fb5ac09cc520c8a72107adc7601c69cb6282e1909854a8614b544b5ec3e29dbdcf20

    • C:\Program Files\Java\jdk-1.8\bin\javah.exe

      Filesize

      1.2MB

      MD5

      0c060e9328673f4bc56b0ca7966016a4

      SHA1

      65d4d939dd7ffbc37a0f3bbba57936972dc5bd29

      SHA256

      7018456a38dc9d0dc61a42d2c90b07ddbc4f7ab7378eed712baaee753d3e7005

      SHA512

      1e83d4e092d2a267c525445237bdcab10c1a3970b233b3ce5850580624783d23ad38ea8c24695a45b4e4efac9940bdc691ce480d68c98f9ea608997012327a17

    • C:\Program Files\Java\jdk-1.8\bin\javap.exe

      Filesize

      1.2MB

      MD5

      9f0a075d55ee2a9f5267ca79b0d46b5b

      SHA1

      4790898c61242042b061fc110b1c0e26e29e8ad0

      SHA256

      a73e367f273d6d5261ad92a7700d5383eaaa803fadc9a8d2a5470cc794a36f7f

      SHA512

      f0acf6dc4aaee18895b770a01b92b82ef42b385f37789d77f26878293e1b088e546e87b37f21bb8e293e8be38b7453747272cbf140bf3b970ded59c44c856f4a

    • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

      Filesize

      1.3MB

      MD5

      3c0705e5c34b580bf5c93accb46add12

      SHA1

      0881259d1370dec9da279af2e92ccc82f025fbbf

      SHA256

      e9a12e560b2faf7d81a17dc97b4ee11bab8b610458ea935b2613af78f95d35ed

      SHA512

      82bffbd710f41d476312b5a6e61f3aa3ffb14cc526da744d186e4fed857732ae5b6d99e667c273a99aeb8bb0cc356c5f1b72cfb448ca375e6fb760064992ec83

    • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

      Filesize

      1.4MB

      MD5

      ba86bb9449cc2a7386f28e142cb86f7c

      SHA1

      7c90e219783d6fb2e641f8758761a6a7801467e3

      SHA256

      694ef16da9068b3ef486fd871482d435eab5aea3c02439c91467dbb57276b246

      SHA512

      359516d0c305eac307370d2468c3e69537b9011df6579083359102e4dd6627de7f8fd06c9588ed66be8b8cde9b2f5e78e2b0b6ff748f0dbd8f167636f6df3a3b

    • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

      Filesize

      1.6MB

      MD5

      df880dd0f951c22da472f41959f0e388

      SHA1

      ffecbe41305906b695610bf4b09ceb3f963208e7

      SHA256

      d7a36667b2111170db954ce87b274ab0b2a893e24e30fbcda2143e3e03567d08

      SHA512

      7ecfd1dd5d9edf775af63d79469f5009cf94ea998fa007a0d9293477b05f117ae0e4a2595129f32a330eae89121e7b55346dafae87e02719fde23f6f01af695d

    • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

      Filesize

      1.2MB

      MD5

      ac83b7c1726eb410027dca6766ec869c

      SHA1

      09a17ddc464ddfc18b13ff09e28e6052acb4f87f

      SHA256

      e078a68ca5daaa31f8177cff1539fd7504f76fd1795f79950724af13b9ea68c6

      SHA512

      2943d13e12d2f7e87aa6800d3a6ab53f6e83d876c75efd90bf21cc26eb789ba9043b4b9a4094b0c9b67c46de449999a49c12be0680da22d9c09e2b46a80d5194

    • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

      Filesize

      1.2MB

      MD5

      d42ee9b1386c863dec1ab4cff3ef3c9e

      SHA1

      927cef6120951c9549cf3a6a01dab9071802c3a0

      SHA256

      6c7b836444fbe3197c6e791561eabc889f5ce6ee4dbbc60ec32018822e7657c2

      SHA512

      470349f9b079bdab932583684a98dcea743c8c9a4aec0d56335b4a17b3e0222378bd411817130981b73230a1eec629bee80220da6e56bee0150208070ac278d9

    • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

      Filesize

      1.2MB

      MD5

      d18dc2a7df7bea7d3ca1f8a737536c65

      SHA1

      cf78530b811d2d3597740078e7509c2ccd6f4663

      SHA256

      09a8ee2feea3448dc7635c77a746f8ed8ba4a988b53174c365a865c28461b808

      SHA512

      eef43c5372f9369d4579762dc47a141f9992be2d4eb712b0d584f59e4b98c57347cc590f0becc8587a4fe4e0cffa41d06671c179eb015a2c42c0348c3ffbd39a

    • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

      Filesize

      1.2MB

      MD5

      323d5793ad212058bc3029011258fe24

      SHA1

      8972bf698621b30999a782d5b8abacd99d59ab71

      SHA256

      a124a5bb8561af620c7fc421ed33888467623f164c581dce0414aec59050ff79

      SHA512

      ce93b1c6854d3e56b760d65503f1d7bc602f3cb501b1c28129bac18209e35500d0bdfa4b63d4c12a2e4a1d9c1f1a4a31fc4c64c4a19677953137fe150fc06d51

    • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

      Filesize

      1.2MB

      MD5

      f6deafdc75c8ff2548dce483192e897c

      SHA1

      135a1f969c454b5d732b0bb2869907bc611dec30

      SHA256

      b415fc49ce87f492617d985c15fcdac3d383f2faeac66d87660ed07af25a9354

      SHA512

      69898959014d0bb764f75be8890d33db6c52cb7f9c904c6e549188b0f3af1228158e88bb8f6de9de11f13331b6ff257beb3fceb0266431cb33d62b78c1ef7c4f

    • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

      Filesize

      1.2MB

      MD5

      38b011d937a10aa558fad0efe064d9bc

      SHA1

      58a216e04b71edd1602f811aee50529c99541d0a

      SHA256

      65825902f4a39af7155258cb05377f6d674e34f605e331a3fe68a3b2ef7d9f46

      SHA512

      14e7a9e9f6706a4fab4ebe60c72ebdc4ebca6c18db4ac3f9e276a79dc00ddea0c0b0513c0288c4b5857f3f3583c9e844e140e1b5c7fd94821b24d40ce84628bc

    • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

      Filesize

      1.2MB

      MD5

      2c5a2cec1f6680b599d834ffdf4f2694

      SHA1

      41ec6f742c4c96f46742e48b92d73d22fcfa7abd

      SHA256

      a3f73b968ab84848a2a74693ef2e61ad6b3bb6c4f8301f9f61b2381cb015a9b3

      SHA512

      d9a323884537c26463ec396f10c7bbbf51f29a90d45466c61d9e3001d69f18c2ddbc496d72069cd821e814d3b40da4269bb62c08f2cde3921cfe02ee6edd4196

    • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

      Filesize

      1.2MB

      MD5

      daf7c657d02534156d0b30c4d4b60f66

      SHA1

      ae6e0bd139d1ddb356a5aa395230a410d3fe99fe

      SHA256

      d5572ea9e57d5398aeebcb1eff58dbb7c3fa5b42c08ea18e405f59a1021823e1

      SHA512

      2eacf75422e5613b0637e91bce113931468f5805a04f5752cd85eb1da7140388f6caf81f7b78417a16f924e1a4f853dea27c0e7955e7b88f36a0f92624128df2

    • C:\Program Files\Java\jdk-1.8\bin\jps.exe

      Filesize

      1.2MB

      MD5

      e9d820924364f4fd8b5f39ee311423c1

      SHA1

      03d7d6b5de8755625d5578374c4f54886a65065a

      SHA256

      773e28a1866b5d117bc4f8fd29dedca08a9b0ab10e0f334ee4852150597db0ab

      SHA512

      52e3574a52a480eaa22847e519c251903407ad416f539ea4b0f609a06a63dc2233ecb8aa8fd9c92d2aa31a8703a44212439dba0ff9680a98c21a83a8bd0825c1

    • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

      Filesize

      1.2MB

      MD5

      838711a7cfeecc70c6ee86c2659fa953

      SHA1

      db4864dce9407f0ce2f5a66f518f69bb9aca1946

      SHA256

      91fa8b411b235f5cb5b1cd90b0c5fcc47fbff8d4a3003fafac1e96726fbb5834

      SHA512

      c49b08eadfb8a4ae41946695de5c0bf8db2025b847cad5c3759eabfb901638935c1a62c4281330010c03bc2962cd5c559318553d4f8098b579db5627664cd31c

    • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

      Filesize

      1.2MB

      MD5

      6dc79bb66b7839552f5afc9e8e6380a4

      SHA1

      5ee56374373c10aa7fc7f461da9e8300d76973ba

      SHA256

      6f7f3519fc3dc5cb9c908c85b91db00cc5e01f950b59c1b7b8393dfb7131c51e

      SHA512

      771230c1529145b3034daa06c6dab7dc2ffa9032d31becbac633a0deb2e5c71b74502cb03483d9f8ed5ae0e756ccce0a092bee45b2e62b733b822c48808c00a1

    • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

      Filesize

      1.2MB

      MD5

      39adad66081586b7667c2df113f2377d

      SHA1

      2a4acc529807043cf09dae581b01a62ca6d2f37e

      SHA256

      5af3ee9fdd38d4d0ce0e54517266f9725f63084da3537f28ca99c1f4d2eae9ef

      SHA512

      9758c69d62a7865dc78defe217006d07a5eb1a9189ebe396cdc9ee0c605359c3e9440ec18565fd0b9dfd87dfa92e1da7c8b318a67e7106556e0e0797c2afd781

    • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

      Filesize

      1.2MB

      MD5

      dd4f5ffa00c6315862a195312e0ef865

      SHA1

      c2e07d63adad7c87b616d7b37b4a96599893c510

      SHA256

      4d2ebc15636c42f477933258d80224b2f0f526046c77e42cc92de9cfc11fc983

      SHA512

      debeef00ffe4ecb755c7b2898db9e3bd1ca3f22fe0f9270c915360469762e925eb938606743ff7e8620fdc3ee6d4d73ac9697c2bb5eb8e911d8e96913db65e5b

    • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

      Filesize

      1.2MB

      MD5

      d5dcd1f07970521b2ad66e140eca1f4c

      SHA1

      806f3aa3c65fadfad0f4a926d1538b9053d987aa

      SHA256

      d32e857d16b29eaa4e3bd1069ee68b5400a88339cba39ad3b55483d7af1dc3af

      SHA512

      8796c281b3a8f4a311e6e5e1ae133229346fcb1dcec571e09161ece8170ac9eb8ce1f84a75cf39970788325ed6fcb6499f1191bf97332bd117ea1ff2055b1f79

    • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

      Filesize

      1.2MB

      MD5

      d984b6a266c3b534a2cd0e6c62a557fe

      SHA1

      80483401839293a35d0428639c42154bef513c0e

      SHA256

      8ee26398074b1282b84ceedcbf58f1ab5a7f9794f446fbd5b030aeaad7f628e7

      SHA512

      ef9c83d53e4280307eae83aa23893b91188b619edc1a948f048ff232b77f66d396027e3886cd2de8ea8c2c4c81154694f87619c1c53e841b5f8d6d34b2bf344b

    • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

      Filesize

      1.2MB

      MD5

      e595e0d18870f690b128d62ab3c14177

      SHA1

      c56f06c02f224c7ec9c415f1f54f3b660d7fe710

      SHA256

      00a2ecb279529947a7a2f0e11a55ac57cd935045bb442981d8582c2ca19bfe9b

      SHA512

      8610d789ee8d1b7f3307043de08811b3a87e69d5c4239659f16796ccd1aede6e67ce75a2a36681252248c9e23122c977ec0c0133d8ae0e090dbc3b5defc3cd38

    • C:\Program Files\Java\jdk-1.8\bin\klist.exe

      Filesize

      1.2MB

      MD5

      565248874083b83b9d33419b11e512b2

      SHA1

      e34721e29f0800c1f6d9f57fa9b334b2a5bede55

      SHA256

      17df8c7a824987ff802463db211ce3eae4d42946809b1d964fc4a378b1ccb68f

      SHA512

      228e423f12fbfa984b83a43036e1cbcde6900f6b3bcb36e1592384caf717a85c46bf65df45ceece045e8bec1a0416dfe89b577f56921c6e620f8293506ed9778

    • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

      Filesize

      1.2MB

      MD5

      f2c8da66bd30c007d5274818242e41a2

      SHA1

      65b26158befb84e3465586c1e59ecdd55a745d0b

      SHA256

      1428aaa92c87c7ff3dbde293c5109b89f6b674b0ab17a973b961253c8f7eaa08

      SHA512

      bfab7a520b27ce6c2d1b4e9d35fcd3a072583ec4826a80d192e9086f1855376061a2ad7187ff7e4f8afec26daa13aed49c9e47780252471f2737cc13b7bfe1b0

    • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

      Filesize

      1.2MB

      MD5

      78b24779af60196f70dcbe3477b0f567

      SHA1

      a400d86e660a96d7c8dbdad6894efef27414efb6

      SHA256

      2c85b3b3df8bcd090b6062a0debcb6a556964435f84efaf0c1c9ee00c0a81b18

      SHA512

      ddbfc74db3f639a0603a3d9a2f01a58acc6686e95886bc36bfc42b7f56e3142b3477703800d3df0c24df2a8a1083f69bca7c2567867b52724d3e894b359d3d8a

    • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

      Filesize

      1.2MB

      MD5

      a819dd98d89b42b4db25e2de8ec6ad96

      SHA1

      8589d148580c71db1dd03535fd2122f8526dd423

      SHA256

      e36468be4665c37a4f6083012d2d5bf08237bfe72a7c922bb7f8e1ec6ea8401f

      SHA512

      d1197a60a30677c44b9c590beab2fb0a3d6d7386f8df4c149a24b7ebe33bcc553f789590c6abec9d0ce8c39ff15d53b7efb475d60f58fb98f8f080b3bb5ac375

    • C:\Program Files\Java\jdk-1.8\bin\pack200.exe

      Filesize

      1.2MB

      MD5

      9147cec263636765efa02ea31e97d7c6

      SHA1

      fcf6cafbd3244608184edc6f97c6d9926d3dc221

      SHA256

      84b2a692f73b897a866abdf5e2baefa024201d201b3ff4f8ea29cab19d4fd939

      SHA512

      b2c6392d660108a72d6150a01c840baffb31ed1e9191d15e8f861320d85a3d41bc037b7d12c6e2901cfee22fa9b1c234c60431dcf969cc06c5fc299d0ecea061

    • C:\Program Files\dotnet\dotnet.exe

      Filesize

      1.3MB

      MD5

      759eaf5e0766997df86232885b9c94b3

      SHA1

      daecb66b0da9eed2c66b4919d2a8879b2962dd4a

      SHA256

      0612fe41f46a211b184813df071d78a9987fafdfbe920368ecc3572c2719a685

      SHA512

      c84894611e594ffbfe5cb228d94efdc3c04d7a38f63c68da2d59a780878c43f5a5d03b12d7545a15b0b51fcd45cd9f64ae056aebb77ede3f61b527c71a4d420f

    • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

      Filesize

      1.2MB

      MD5

      04afb820303ba5b3c8bc5de6a643a421

      SHA1

      45844749cd069b00fda9a959b4a11dee5fe32944

      SHA256

      4728687dcda5e0c6c9565e69ebe46b7030d6abeb7775795a704fe18584934480

      SHA512

      9f2f7dedc34c785b8ff471c03f074f5185bb66ebef92f0769d9fc9c487b688481a833b12702190bdf528290d43e9d10355514ad0953f8a27fbf82a9468210b8d

    • C:\Windows\System32\alg.exe

      Filesize

      1.2MB

      MD5

      706e74e5da1ae01478d7f69d211d1e03

      SHA1

      fcc6fd53ae455adf12500b5710ae95401f5a3d89

      SHA256

      e4ae24c22d6e45c7c0ca5780c0aea7b212b3adfe8e25b960db1035922b82d392

      SHA512

      0f985d624080dbb5b4575478828f46ec28ca2e4e5b7cefd9c626813541f8b92f618f22d402973de36d00b6f9aef4051440bb2a60d90426f31b87d2f26be61f45

    • C:\Windows\system32\AppVClient.exe

      Filesize

      1.3MB

      MD5

      ee756ad3a521772cbeca690c455da8bb

      SHA1

      db5eaf32f373a2b047552654e44306e4188a15b6

      SHA256

      cab44beadbd6dd33f5906786b6901946150a992a1266d11cc02b84bbe18a7780

      SHA512

      3cd601324c22e96fda1bb3d5a2563fef79b8ab9a40b77471a7554d6b675af73a17929333d616fb03f162295deec1625072e6ff675c11f7adf93f6c7b6d9b2fb8

    • C:\Windows\system32\fxssvc.exe

      Filesize

      1.2MB

      MD5

      fdc113df2b5d8ed225e272cf29d03900

      SHA1

      bd601f2e78cdc1bf03cb8f9834159ebea86316fc

      SHA256

      f39e37af97568ca2aec6d41288bcbbe5278371445b927ea8f028d0f2cfa53a00

      SHA512

      7384036656b45a460c0f776614edd8178c4f67f92763639085636745d680cfdc2d72fead1c5812e89c175507f0b58101970838d294d83e0efe7ee7e9494700bc

    • memory/232-12-0x0000000000630000-0x0000000000690000-memory.dmp

      Filesize

      384KB

    • memory/232-23-0x0000000000630000-0x0000000000690000-memory.dmp

      Filesize

      384KB

    • memory/232-22-0x0000000140000000-0x0000000140141000-memory.dmp

      Filesize

      1.3MB

    • memory/232-261-0x0000000140000000-0x0000000140141000-memory.dmp

      Filesize

      1.3MB

    • memory/2252-56-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/2252-62-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/2252-85-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/2400-88-0x00000000004F0000-0x0000000000550000-memory.dmp

      Filesize

      384KB

    • memory/2400-266-0x0000000140000000-0x0000000140166000-memory.dmp

      Filesize

      1.4MB

    • memory/2400-96-0x0000000140000000-0x0000000140166000-memory.dmp

      Filesize

      1.4MB

    • memory/2400-94-0x00000000004F0000-0x0000000000550000-memory.dmp

      Filesize

      384KB

    • memory/2520-84-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/2520-102-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/2520-71-0x0000000000D80000-0x0000000000DE0000-memory.dmp

      Filesize

      384KB

    • memory/2520-65-0x0000000000D80000-0x0000000000DE0000-memory.dmp

      Filesize

      384KB

    • memory/4144-30-0x0000000140000000-0x0000000140140000-memory.dmp

      Filesize

      1.2MB

    • memory/4144-262-0x0000000140000000-0x0000000140140000-memory.dmp

      Filesize

      1.2MB

    • memory/4144-33-0x00000000006A0000-0x0000000000700000-memory.dmp

      Filesize

      384KB

    • memory/4144-26-0x00000000006A0000-0x0000000000700000-memory.dmp

      Filesize

      384KB

    • memory/4184-265-0x0000000140000000-0x000000014024B000-memory.dmp

      Filesize

      2.3MB

    • memory/4184-51-0x0000000000C30000-0x0000000000C90000-memory.dmp

      Filesize

      384KB

    • memory/4184-49-0x0000000140000000-0x000000014024B000-memory.dmp

      Filesize

      2.3MB

    • memory/4184-50-0x0000000000C30000-0x0000000000C90000-memory.dmp

      Filesize

      384KB

    • memory/4184-43-0x0000000000C30000-0x0000000000C90000-memory.dmp

      Filesize

      384KB

    • memory/4892-40-0x0000000000400000-0x000000000059D000-memory.dmp

      Filesize

      1.6MB

    • memory/4892-0-0x0000000000400000-0x000000000059D000-memory.dmp

      Filesize

      1.6MB

    • memory/4892-8-0x0000000000820000-0x0000000000886000-memory.dmp

      Filesize

      408KB

    • memory/4892-1-0x0000000000820000-0x0000000000886000-memory.dmp

      Filesize

      408KB

    • memory/4912-86-0x0000000140000000-0x0000000140166000-memory.dmp

      Filesize

      1.4MB

    • memory/4912-80-0x0000000000CD0000-0x0000000000D30000-memory.dmp

      Filesize

      384KB

    • memory/4912-99-0x0000000140000000-0x0000000140166000-memory.dmp

      Filesize

      1.4MB

    • memory/4912-74-0x0000000000CD0000-0x0000000000D30000-memory.dmp

      Filesize

      384KB