Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 21:37

General

  • Target

    2024-05-22_49f2445fc5c9c1a3d763ecc86f90c2a5_bkransomware_karagany.exe

  • Size

    677KB

  • MD5

    49f2445fc5c9c1a3d763ecc86f90c2a5

  • SHA1

    536146616d1922a38ebe4b7a8daec7cb0a265839

  • SHA256

    d780fb210e7e2d9eacedd28b9924c071a0eee11a223e9a2f01fcfda8319657a3

  • SHA512

    1e1ab26496d26acebd8f4426b17369f23cbfed2bf85cdff9ca701cbc861a8b17c17ca60ef7479df83fced3ff45f7c00e8c3380f9e2bf141eccad457d0acc46c1

  • SSDEEP

    12288:NvXk11p/SInr8vv2BDeT+bVYHTb3FRk/rMNxaXqqlPbJKTGv5DYFXOBnXREHa:tk1z/i328ab4F+rM/aXq6bJfBUam6

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-22_49f2445fc5c9c1a3d763ecc86f90c2a5_bkransomware_karagany.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-22_49f2445fc5c9c1a3d763ecc86f90c2a5_bkransomware_karagany.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3560
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2264
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:756
  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4684
  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1824
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:908
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

    Filesize

    2.1MB

    MD5

    d09dff1a65e9fe767feb20c3fc336310

    SHA1

    784910e9d723cd5ed1a84c69ba7734094342276e

    SHA256

    8794ded72441cda57238993f54b497061caaa010a42e9190ecc64e6281ebeb03

    SHA512

    8c7f09040fe4ebb979817c4efb1da29d01310476cb9828376f2e6fd6ea792ae6cbe8bb73162a3ca63bfab37f333da3b79cd0548f77549ab48109d58d83e7c048

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

    Filesize

    797KB

    MD5

    ccf032fac5afb14077f1e965424d21c5

    SHA1

    d21d7f0c635480dd921205d1596202d96e455456

    SHA256

    d4c6e9573550a5228a5a33148fcab950a9d1cf026db88259c0105cd65015e2f3

    SHA512

    3c3ff53e767472bd4c7b82710248d61903325e4b58eefbac7a4a819b56900e0474a9fd5c0bfef08fb08fad0ed78889c9bbc847925e3460b40a085546abc2eb89

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    1.1MB

    MD5

    acdc75cf83de19a9ce3ee1d3a1b89e57

    SHA1

    5f5cb597865d86d6b1b32ee677cd7236aae92f7c

    SHA256

    3685bff6d9e705c094af99356ec0d36119ecbf039079cb17c4ad6751379f1f81

    SHA512

    1bbb1e0cc619ca2560f1f4661fe9044ffdc9337820270f4bb7de93b2b5b42fe4bd389c79a159c48e47303226ab1483eb466bb839da184e46aebf9342b0ecd6f8

  • C:\Program Files\7-Zip\7zFM.exe

    Filesize

    1.5MB

    MD5

    eb7e7cf5991da108c518ad2f0d31f75f

    SHA1

    719076aaef64f4766b156656440b35fd364db300

    SHA256

    612215bcabb3e63f5d74c13563ff98c3242ec8312fe81a8e1bfe6a5e59e446cd

    SHA512

    57dc30ecbe4c7846a80c5871cfbcd5071eb3d860089b254de93862ca9fa12bffd1cd526c9a0849a4b29836ebe44c62b45f9249de14c8726c39a107679167ce05

  • C:\Program Files\7-Zip\7zG.exe

    Filesize

    1.2MB

    MD5

    d95d2431bf3f394562d6b39fb156f4a6

    SHA1

    ca064f288a0fb3ff8d8cb8d830edccfa2c325e9a

    SHA256

    426a75930cbb06641ba87cc69598f77785131ba2f3649fd229ee67ff03b0a9cd

    SHA512

    1e31ed2a217a43ee2d981ee7af38df32ea96e378971e5c1ca0bab51f69f73072a151884a7c4a72168371c0130d7e507475b659f89064a0765bf84be02a4943ad

  • C:\Program Files\7-Zip\Uninstall.exe

    Filesize

    582KB

    MD5

    0690a4443aba08c7a247d6debbec3c40

    SHA1

    bed4dd1e330abb5623ec4601dfa50d93da09f1b6

    SHA256

    d6eaffb66b0a651c2fa34a880b7c847ef3a861a5a916a92c3320a33789b7aa56

    SHA512

    867855f3bf6ccbcfcb5a904117fa341d45f4762c54bb187d053d5e3f8821345745c46691d572ffeb14bd87683e31ba8f6ac290f97c30c97368800214c5cc15d7

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

    Filesize

    840KB

    MD5

    c7b8f28215da0aea06dd9d621ab766e2

    SHA1

    79dca8389ac26f31fa73458ab1ac7484dea5a04c

    SHA256

    bf834e97922a40e2b73dc8d9e0e8acfa205b2ac624152aa0f121f32fde8ec922

    SHA512

    ed44c150badec31a83510f2349c3355a4f6de2db3d7c3afc79c5152aea6a68129a56d0c63468d2f4daad316b86ec894de45851d77ca8376cc979c608d8695327

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

    Filesize

    4.6MB

    MD5

    f64372ff72430e91cd76b9c0c051f234

    SHA1

    6b03ac63b381c79d1a0f14e51c3be53c7ef931fe

    SHA256

    7501910240a75ebe5e2dc5d4b9fb4686428889d455376c768cc75306805c4292

    SHA512

    be13953282da45335f995014dc59697d3aedb529a1f4d12e56d86c41f909b249518b0528897a40ab475527af7dbbacf51bfb5cd7f3d448ed3a4eca4d4e5210cb

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

    Filesize

    910KB

    MD5

    9789f186a58f6294cecf537322393c6b

    SHA1

    9b2e4313a13c3bd5e222aaec3fe606152584d06d

    SHA256

    03a17be4b361eb07497be0c8f95cc403d347041d3a3c9376f688023b08dccfeb

    SHA512

    cde6ed1bffb799771a79c5ff184eab971d983d54cce9376c03094a141383cb48cbf1b90a7d84617b011c4c84d60a62102fecdc4da763407324d2de1e5c812d05

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

    Filesize

    24.0MB

    MD5

    53cf5759182dcdc386ea1226e8b358c1

    SHA1

    18b3c819d5a4ddc11dca9fd7b7ec1022bce8fa2f

    SHA256

    8776acc1509bff01e14471fb38d7639277511fdeb419156583f88ab665e5c6ce

    SHA512

    dec93001f5c0ddcd56c6aacc294a89e6fb802f1b868659d58e1fc0bb85a0c2815a4702a177e60c53feba74d6bb584988bbff27439fba3d056a6b07cb5834926b

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

    Filesize

    2.7MB

    MD5

    1b6e2dd330693bc9426d647d837c71ae

    SHA1

    cabab430f18173ebf5e8c9d414822010d1209916

    SHA256

    f0de4e7c6c6baf9fbcc725a4b7eda3afc150273bde0386c990e15c0d4a94afd5

    SHA512

    7f2892e2a202a4eadefd6c9c63a2593fa381350e33d0371803caa9856fc586aa08a05b54e949e550e53fe69fc93c6fe481459510442e78f5b4fef537b6f0e473

  • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

    Filesize

    1.1MB

    MD5

    f903ed417ee5274dfaa4378336e4c3a6

    SHA1

    501264de0fb9fdc003607ad1eadaccd43b0d6639

    SHA256

    fa2f4ad21611811ab58ee3263c2dc11389b9bd8bf58353b6d2a187eefd1c5382

    SHA512

    b9b6afdc1bcbb8d4aa9b300b8ffd71fecc856bd9c104622e0b6e3451f4e8a0732cd3cc9183f0baa7ce42be2d0a0c599a7cb7df4ce77e71aef7a593be34f86590

  • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

    Filesize

    805KB

    MD5

    32ffd2d9b90f0034bbc245d69c334c78

    SHA1

    e33b4f3a70c66095aae0964eb238f4bf0bc0eb6e

    SHA256

    0fb515dbfecf7f5a1a8c9859a096374c13e9cafe3776e98db7033a42b37ac149

    SHA512

    7449b13767b843d18454dd662fe8099ba8669c8b1e90da308367a25bdc0819ac9c342103a5c0d72fc30d9c681d38673b4c9ceed104ba2fd52cab00ff22438ddb

  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

    Filesize

    656KB

    MD5

    4f62de2e94d01337bca1126d96f8e3c6

    SHA1

    9aff60c28d308b9ed1bb991bfe04ff0fbd30fa16

    SHA256

    37d21d7d58162a9315dbcfb87c355450f31537a67afcdce206da3c12136dc72f

    SHA512

    5190146dd89789fe64746e8073232c0668bfad45885fc5efbb2f059ce894ec77b67dd0b9cead22b4d05100be4adcefd40457c660a086ad40901f2d08db78957c

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

    Filesize

    5.4MB

    MD5

    c1cdde06efbc112a60d561ec96215c7c

    SHA1

    09f079abe27d20a5b2c70e72b7b580fb8e6dd322

    SHA256

    a0a73599440a735228f3800f966a1c75af133dd535feaa56a0f47574c30ac316

    SHA512

    86ab6f3d54ef3b2740b195002f9356d54db290d233a02cb7a1a26228f3f8464c4da4e696847e6e91c3be79749999762521b32b9d09a4f7061d8d0d730627e62e

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

    Filesize

    5.4MB

    MD5

    0ff340e22b17b4e58859c08ee3ea0392

    SHA1

    eae2d41175d3aeacad22df40deb5e03cb7c0bb62

    SHA256

    a4fdd537a3e35aa8da06dff984982d94b61b4749969f2ee538b6cf332d8cbbf4

    SHA512

    d4e4a0646e664cca731f3c2ca3026791028af9c403f46dd4a85a579607bc78ef528477045ad21223867c3a57b300f3e74d4c05927394342b58cedf614b6c39fe

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

    Filesize

    2.0MB

    MD5

    eace84b20647999e8ee9342366504853

    SHA1

    44772590ce1a5648fc3a326e1ffb8399eb473188

    SHA256

    55bbfc972f8c7d9ff37978ae1f58b1b3cf087b148f504196d9df0d0bb114eb23

    SHA512

    296d223ee1470849f1627bc439bea9170cb5db2bd9750729ec32907ae3b8bbfac8bdd325abfa5fa67a8174a5672aa0b297d1660c4b16d4611ce733430a68cf0e

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

    Filesize

    2.2MB

    MD5

    92f90d82cd053335d1fb7ca39011aa28

    SHA1

    f2d1ec8a477bde1670c671b15a4e4cc142214d80

    SHA256

    17478f8df299f5b8efeb0afd4ec37432e56e807116f3ab9d7db04e93820d2b2d

    SHA512

    fd47dbbb753835fe457c259966c2e99804e4af9bde5e65b57311c684cbef79df1269de9ca8193156c35df6832a455364740aa0d11febdf720fe9e78da78ebae4

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

    Filesize

    1.8MB

    MD5

    7392a329344282155cfe2a2fb4543072

    SHA1

    cb632b8df56710886c4d82e5a2e3affdca99ee1a

    SHA256

    19ca633c68c6014b9f7ba53180c0dc71b942ac279b3c1f9cf2b6dbb187bec25d

    SHA512

    aace753775e965c7e1106f721e43f127896f2af53502e9355790d612c55f6d0419f21133e568810362ac93f89b52144ec4aad0ecf32ad1eb3beb89c8a52831dd

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

    Filesize

    1.7MB

    MD5

    2f733dfdf8a85d97fc3debd34374cb57

    SHA1

    fe6eca8b019ecada6051f2fe84c5da01e8f39861

    SHA256

    37d7654be0330ff6514d2f518aae1c74e9d4df804d00e4ace6335f35acd24b00

    SHA512

    150424b38b0069f302c0a882b5ad23f983a7e5eba96b6ab7bc16371e03b718487c3a674f49eb930da21637af2c50f73090de33f53bed55a51a54562525e48df5

  • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

    Filesize

    581KB

    MD5

    1404c2d5ac3359b424cee2b58b5f16d9

    SHA1

    8779cf70402f901e502515d9b6395e843755e60d

    SHA256

    a6bd722d834e24eddc07f1aa3c192ea26165833924c6bfe7011b1c18eacb0488

    SHA512

    0e72bd1065e27e4b69bed3be020d3f758f948320ea5dc957e14c11cd7e26b7a078310fa5ab79020fce6d1c387ab5c08e07331b0ff025c86b385ad7bdf912cb6c

  • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

    Filesize

    581KB

    MD5

    098af2d9538b686a5fe2ec3789ddf66b

    SHA1

    561609deb42f1bd6ba4e10ad21b7af23a512ae40

    SHA256

    e78bebe48ecec07ae0fd42d0d0437e644abc2414b23add9c7c0ca9be47cb4c6f

    SHA512

    ab8d9ad8419ddede8d6f61fd004bfcfaa4f50e226004b7ede2b2e8afddd9c951dd7183ee0b1d32df339386c9ee65583811064d8b83cfa68521dde9d968217852

  • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

    Filesize

    581KB

    MD5

    6e6789f7bd58b47ac79a7989013bdcb1

    SHA1

    a84ce76e9b64ca18d2c8712f79a06c9d78d1ea1d

    SHA256

    2b139e9e7d75d6f3a09f294b10e81d916b5ea30b9d6868b1dc2b8cc15ca87a3b

    SHA512

    5153ec44f67b3f864e96b926651964c2f20dd0ea231d174a362dd0fe3b145b8a2d03b0a8f7f8c662e38d4a688ec8f5347c1a539f41b6e94577c51219413dd1cc

  • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

    Filesize

    601KB

    MD5

    d4be2566b83b1d050740e6c14116e344

    SHA1

    5df1237e5e8912ec900fdfd00d33717449dde1d9

    SHA256

    88c638496828bebfe3f1501ff9c316b3e27ea779874048a8519cf2089718cb24

    SHA512

    74e2f671d46afec1de30011a359af785c5268682eeb24c3a940d3ea1b853a609813d089d2378ecbcb8b7ed07da6925bcaa4b4596f75f91e6e77d1c14c61c2943

  • C:\Program Files\Java\jdk-1.8\bin\jar.exe

    Filesize

    581KB

    MD5

    45b8d8b7e4a397d22af6e246fd0ccd4b

    SHA1

    8df03ac112fa7ddd5fb855eac2800da51a766f38

    SHA256

    ebd5c88e79d6b6db0e01d27cf91fb88c87e5c6aebd1aed3ab834f4e3b7cb53d1

    SHA512

    53752872d5c451b41f69ec340c7066550ddc1c9165572ed28cbdc03b60689081fe6c1b3bb8833f39634306e0d05d6036265e1659b31d073b858895451edb42c3

  • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

    Filesize

    581KB

    MD5

    3ce951c60f5944332608fe09b2aaeb69

    SHA1

    10cd8a270128780a5011f94ac745a5b0d73b8382

    SHA256

    309ffa649a96db69b2de6fba47df499d43027b8e2a9d0e0c989cf5a469c7908a

    SHA512

    42755a9662757746ff2eeb21f220f582f86892cb85ede225e23f4e9752862314685dda142f1e780c552496a4bd76f38a5d1d5b34374011c165a6a02c53e22aa3

  • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

    Filesize

    581KB

    MD5

    b75d14bff3069fd6a466859728046c02

    SHA1

    3fe5ce747ba339237150171a046287767d1f782d

    SHA256

    491bafa19bf3fe62865befac6e16e33749f89fe2313efc40b00e74bc1611c667

    SHA512

    6ecc0a93c9054bedf5d0fd018937ad07992125065c2aabdbf92cd1da27a1c28b7aa8bd97aedfa90109090f1f83002de5b865bce0862c10bb61a497f3e15246b3

  • C:\Program Files\Java\jdk-1.8\bin\java.exe

    Filesize

    841KB

    MD5

    a42e378436a1d84d56d3a43dab826e82

    SHA1

    fd644d267afe808c4991a22b156c9ff4771780ef

    SHA256

    4c3f6d9ebfbb84ff12424885e68eaba5dbe95780321756c13ad7deb3ccfdb2e8

    SHA512

    8f35daac5e5fe915ded9df10c2707f005c20183493346f42ec8a698607598e84f30b42f1410a1d3c0ed5a6513932e65305a08b36cc5ae30cfadcc4913f9889ba

  • C:\Program Files\Java\jdk-1.8\bin\javac.exe

    Filesize

    581KB

    MD5

    c16f2236d65c3f0197dd44a9bc78e1c5

    SHA1

    9371196de24188a7a98c46f054cffa40db1a3968

    SHA256

    1f9008ff92d086aa455469d8b291ed178255cac16277a7571015f26e163a478b

    SHA512

    62a33bacf659b0538511593db2c48a0cb32c68e6c35e49e9c6c62402f5a10a3d414e2fd92975ccb55d208e0f9ff2b613dab4819284d1a56b81fe400bb9218ae1

  • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

    Filesize

    581KB

    MD5

    4f93b402c978b7d639dec3a78cc32438

    SHA1

    51058c5bde7ca3717d8576292856ff0b983fdd63

    SHA256

    f7db9e28f9927ada01a5027c81c22a770b2c8cb3bd41a44cf4a6a9a803ec127d

    SHA512

    4746f35ae06de43176512243dfbfbf5913f0684f5532a13714521ebbd4493dc1f27ce870de5018018b1a2dc6cf72fee7c6ac4df16cc0639abfcf47c92c55fcda

  • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

    Filesize

    717KB

    MD5

    00ae847e91d0949bc9702be2cad092ae

    SHA1

    d7c2dba4c276e48564f28eefc4b452fd0a7aee10

    SHA256

    decb61a8a95e99a04c106fed1c4c941189be76f2e59c9e3224d884835fcbda55

    SHA512

    c54288d7526bec91a1909168a65d736d7c7ee3bf2508dc652f6e4eba85372e517f3acda5cc5ce663b5f23801778710b24d6845df0b7c4d3f41292e10a07dceaa

  • C:\Program Files\Java\jdk-1.8\bin\javah.exe

    Filesize

    581KB

    MD5

    895b3523f5ab9c4b7adac6525a08d03d

    SHA1

    982599621385d047787f32ecc17ae07dc6a2cc9d

    SHA256

    24cf5b116acddcf293d76b6d9705907b0bcd19db45951827bbf77c3530efcab1

    SHA512

    63f0dece5d432c7d8e8db5522bc482e1a31c9834cbd3df29d2f3a083086798bb79df823efe91fcfc8b7f963b0a9a1fee311f59023af71cd37cd3fce424524beb

  • C:\Program Files\Java\jdk-1.8\bin\javap.exe

    Filesize

    581KB

    MD5

    95ce72ac87c2e015d00d7ed18194af98

    SHA1

    de50839874eb714b3cab136a680ba6b4ff3202db

    SHA256

    4b1191125b9b419a4bf3c1efca6fe2d5dab5dd213ddd70fcb26df0bd89847e3f

    SHA512

    efe146a12cfa68c208db94a4c0b99709fcaf2f598c7d5cbb578a6cc07f1efd701d4a895bce81ff7bca694cc32aea6ee591d3ad8a969d75b3d6cec2129626a683

  • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

    Filesize

    717KB

    MD5

    10bf9449e0d5a64567d3cb8b9d7ea35e

    SHA1

    96617d71d8a99da67eafb7cd380d275f242a2e50

    SHA256

    126403788c7f45d2bdaaa3267527c1110d85a64d4650fabde1ecd12ea41de87b

    SHA512

    fdce1953cd47172aad748acb294acc771c48bc9b24939d030d61c87fa5857553783cb4dfda2501b35892681cf7aaa66b5e81d3f3ec0a245c6348fa4e6b7ec208

  • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

    Filesize

    841KB

    MD5

    f07764542bdc700528d9de45c1654acd

    SHA1

    f1a97aeeaf7f83cb219077ca0a19026a5daded8a

    SHA256

    0284612876a54a8847955065c30172a1c0a257c2de5b1d50f5d6a3999c4fd558

    SHA512

    ffbaf0bdf5028047a2d5ca40545479c99e806f897fedf901235463e9a35ff309c3fe5beac88d85d275f051d63102a6f861166a66df31f21a8b66d781b90d7854

  • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

    Filesize

    1020KB

    MD5

    3cdc4a6cf4f1632a9314fe1a41c5033f

    SHA1

    6dd2d5a40ed852e6596e07bbbb786da23e99fca4

    SHA256

    0a60d0e3bb727c40f1b418fc220dd6a4d7ecf447603e7d1290e0192e100c77d0

    SHA512

    bf8bf6564c71850eca6d754ac2f9d8a0cd9cee47da698230be3843bd17365a29ab5de4bdf7225492e851e2ec312375b676074858e34a90a7ce88baba8727d297

  • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

    Filesize

    581KB

    MD5

    6badcfb94826502874d0de1738bd25d6

    SHA1

    e90e680bdd77176e5d2e0b8e79aac71c71ff1d1a

    SHA256

    4415c5613c6fa22da4b18854698f444016ddcff1847c2a84a539081ba055ece2

    SHA512

    bbb169eaf0d0fbdf3fbb4130bc2faac26343c397154e7e92077aff47c0167dcb6ca7ff4e22bd42f9ea3550735548d80121b424c2679aee4805a573a6ee210a20

  • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

    Filesize

    581KB

    MD5

    0570ec79bccb7601fcdc9a2f2393afcd

    SHA1

    901f29914a8cad2a78765fbd92f54c7b2800adf7

    SHA256

    7cea1f5cef46a9cca7efa0dcf032195620a8b677f49b0673a429b1f8d9712cfc

    SHA512

    ff20e7a8ca3145f46d41d25cf9f44c8935198e4b46d597ace81741475bdbbcf92a51c1821476a0fffa6d07c8f519788ffff96f2ed1dc1138b3cc6749f171e252

  • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

    Filesize

    581KB

    MD5

    5c5dac901e5892831cf186a368aa2b21

    SHA1

    c451a136d1ceb95e3eaf198100316c98009a3284

    SHA256

    77b82a501148bed60d1e672279cda9a46bdda87eb41373f20bb6bd71a0a794cb

    SHA512

    fd9403041aa87d16205632fe859975056fd46b636cdb9bd1d378dab8cbbd38856cc9ac2512ceeecca51646bbe7199a347f60278bb26fca602a8c4f5d03f7d10b

  • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

    Filesize

    581KB

    MD5

    72e0031446d4dae83c0fd2b1514d7dc8

    SHA1

    de7b9e21981d576bbf8aed10773acc98c3401d38

    SHA256

    6726f8677f41666353a78e1847c27940407e1892e378082edbeb2a4eedaa04f0

    SHA512

    c4032ca82a231b9dfe11c68d06236d1c2ba6fc7c50d7d898af3be52ebec6471290aa123c8d722317a077c84b13b26b9884c98db119aa22ef232ca6f0f9cf90e3

  • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

    Filesize

    581KB

    MD5

    93ca6e9f5a74f1aca3a114c98e84a343

    SHA1

    2d9f0a81ca674a6836f5a65c9c7645bc72a63a59

    SHA256

    b7f4a707b1b613174e1645ecb3c572ccdd8c22192f87903c5c9324ac982ff274

    SHA512

    86f0ba9b3f68e9e085522600df6bef91e102877d1d78b5cc675146eb19796e3e5f54edefd40b4afa18d344a80a3b41f6a0f7ebf877400a00e7d3a6578a46a399

  • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

    Filesize

    581KB

    MD5

    e3b6bfea0fffff626f1393ffdb9ea88d

    SHA1

    3f1ccb0f380170e1e86504cb22d68fa59165d2ca

    SHA256

    9707bf493b2810be095d7782da5331b7bee34d91586b8d79bdfb7409ea61a039

    SHA512

    a14c53c78037f8fd71308e02034b68d5eba4267cd68dff705386126a472c4421ea1f45f3c205faeb6278358a2aa607cb247feb54969f08aaf37ceb00d48e5309

  • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

    Filesize

    581KB

    MD5

    d3485b1ee0cf65c1b2777af30b381b12

    SHA1

    52188d4051ef19708246bd6a036845eab622e424

    SHA256

    e73643003941bd147a1342688260fff057a89b1361731dee9f0ad637d1fa06d9

    SHA512

    0943cf84165ac7b1683cd313372c2ca7a0c9fd09828850816a9ba56a20f4be3ea5e68d147702779d1e6442038f9f1c9e3f8ffc05f9f1689606b87c6aac4ef42e

  • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

    Filesize

    581KB

    MD5

    222caaed2f43dc53752273a1bf5e4a42

    SHA1

    004fc3068557f3785952c82a0aa3dc51c05ced13

    SHA256

    096b2e5b46de4f8bbd9e8b943a2a3ab875db5b0d1cbed17a1177584cae56b089

    SHA512

    df1f9a1803c8d08d0fc68dfaeff305e505cf2842d5eae6e4f6c90e75abaa96bebded26a8e487b900bedea2eaa257b431b34a25c14e085c92b8350d0c93f9c1e2

  • C:\Program Files\Java\jdk-1.8\bin\jps.exe

    Filesize

    581KB

    MD5

    fd64d061f3124692beaf8545bc6e89d9

    SHA1

    5a5ee081730759b7feeb54a2631a9622ccd636c1

    SHA256

    94361ade170e1dfa6647f59f0d0624ad1fb9f56abad34089e00786b8b9a3e4ac

    SHA512

    26306f49eee66af87965f99fd3506cf1113c13e3f9a64ec1ce23e54ec9bda6a59cacda647939dea262a5192e565546bfbec2dcb255176123d49f37b2269b11bc

  • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

    Filesize

    581KB

    MD5

    f61c71f50d154930511a913a68521c97

    SHA1

    2ed85736aec10abd92b11e22835d38fddf1e7872

    SHA256

    c28c9e7dcfe11886004dcbf34a3cd0cd9248f6719333d0740713b0755b5dc190

    SHA512

    d4cefd7e1f091043a113d19dac8a70c8576fd54fa286695a7dcef56d1f1cf02ce41c86700f8231b73961e1d1728df3a0982d289b071f9cb77cdbfe217e11cd29

  • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

    Filesize

    581KB

    MD5

    2596abc27c05b8df4318427067411b35

    SHA1

    3e51f53d45537a7d8d45068cb438f38ef0e42a28

    SHA256

    585e14994260d956328b24d5cbe1adfc7f7efadb3f7df6f9e78ee226070bab67

    SHA512

    081478b8710b48e5423eff9c85c1cbea0623258a711690243c734b5403d5d35cb3631770f1d160ce540a8e81eee56bc9542557d797f22f6745860aa88a652b68

  • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

    Filesize

    581KB

    MD5

    e435f423360d6a7cb0942c309b7857cb

    SHA1

    096410190d9477486957ace15a64c1d2d15d18b5

    SHA256

    db52c3cb9ca316822f8c401e8d4bab343875ab1eaf043c4b1b05be243c59cabd

    SHA512

    a1656d2d976853206a8d6d188ca01807da67825b5330287703858c21e8fab48757d11ee2c9c795652ca2f5176f4ffc5b3ea8af8d9713eac9efa6a76f87174fe0

  • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

    Filesize

    581KB

    MD5

    3aea6a115dffd4585b702c0ad22117d0

    SHA1

    2c3b4b7f8f08e064d5df3d0d6ea44b160c6eab9d

    SHA256

    bf3c13d62b829246027681b6aab8b58267bd0d4d8a8ae176f29536a5d314311d

    SHA512

    c059a65e9034804f5704422736ddde3f66309dfa430328db9f2704069dbe4951428ade8026181d5f1caa67a19aa91ec947a66f5b41d930a2a524b46c27442d52

  • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

    Filesize

    581KB

    MD5

    52501223afe5d9c0fc2b69d11f920ffd

    SHA1

    41ca15b61015fc172462efad76b8006832f98775

    SHA256

    be5a8a018dc53216dd44e9f046f22d7d4e957ffd3ea9ee8d7fe8a7964acd4c0e

    SHA512

    e56cb90db2eb27e2ba50eb46cb8fd8f234dce10d271c8dba70b18858335ff5f6b93533193148944c14b0a372415f3325a328042c70907cf3ddb23e8963c1a60b

  • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

    Filesize

    581KB

    MD5

    65a7ece47490c6d402c3277920a95fbd

    SHA1

    a538069683fd6af85b193e718c3fc1c5d97e2b98

    SHA256

    8fbed769449932b8f450f797566cd9aa682eb48857d0e588b3cf28cd88f7ea97

    SHA512

    5395f3156a60cd1ded46eed38540e7b15cd8496b1f12fcbf895ae4d57a13bb51b921f66aa88127e8d735f5b0fdb8c041fdc4c1e1a2748242d2da175cfb36d83c

  • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

    Filesize

    581KB

    MD5

    c66e0bed8ba2148c68324b328f8eb6e2

    SHA1

    3e79dbed01d4e113aa05c278c6b91cf03565af3e

    SHA256

    c50aa4b2d2c4c72a2d9e770d7f4fc9a106302cb358dab89a9d01f5bb9ece9fea

    SHA512

    2ff1bb4d973b5388ea4685454dfec4fee0e3fe8024318a1254dc58fbd083fbb0287bc806decd3ab7f41b64794330ad1e09b534285756d43151d6614294a50299

  • C:\Program Files\Java\jdk-1.8\bin\klist.exe

    Filesize

    581KB

    MD5

    1913f5e22f5167bcdbb2cf5a979fad76

    SHA1

    01d4b0b9fe035cc5dad8fb285f9b51f074522872

    SHA256

    cf82f63c81b6d8a97bda7faa8717ead4324a078eae193aca7769d76b699b013e

    SHA512

    4a8c6959a665f108906e941f03a477cdae52ef968be766d955a4675579277c644307770f17575c837117df271ff2debd312d969ae17f15b2eb923da543acd861

  • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

    Filesize

    581KB

    MD5

    9ebbe20df927601262b2b387a879339f

    SHA1

    84d0ab011a3da24146733781545aeb2a4444d856

    SHA256

    a95f332a3123193046d6b2a1e1d8d3eeb4a37224bccaa78b364398a65b5e9436

    SHA512

    09e6fd1f3d65116169ae5ab13c16cc21e4779b948173ea7556108a57152987e8356f1be16c723924da7f3ef95048f0b9950b31a43e6be701a8c23b898b7e56ce

  • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

    Filesize

    581KB

    MD5

    db9a95afddb22f97a26367f6cd7a81da

    SHA1

    d2f0bb4c4d3bfce9494f354d503025c9a9bf6d9d

    SHA256

    bf8f0d1dd7c384559378f0d522ffe63420dafde9ebfc49f5aa1776b56b8ab1a9

    SHA512

    2940638c8c2edaa6ce859de0b29a8376e8d654aca4865aa478a4c24fa112c8df22a7af63c9cf856eb85bbc7cdb13a982c16a0e9c596de30f69dbcb9f084a066e

  • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

    Filesize

    581KB

    MD5

    4a071a5125a82da441c75825e4974254

    SHA1

    bce08e3a3ce9ae1afdeccb1932dada72155f7ebe

    SHA256

    7ab442405ba3f95873df762fdd0e99717ae7e8cb2dea3256db63074cee7522fa

    SHA512

    35a06522bad5ce1339df9e613b2cda8d9388188ff35e4f1fc1ac85c399ebcbe167c4815daae6dd909242bbbddc2defc01159fad1366486a4644544d81d7f9c1a

  • C:\Program Files\Java\jdk-1.8\bin\pack200.exe

    Filesize

    581KB

    MD5

    c791e5d5f339c9637b45108d0e4e41f6

    SHA1

    162510be8d38dcb3bc0a8c669ad2211a544be8d2

    SHA256

    7c0ddc8da565ed313b328416a8fbdb0fb6fa141634ab82e26ae57597375c9402

    SHA512

    4ffd0889cb882d6fc354f783d4b9524901bd10aa996fcb1a45beeb4e74c318ae4aaff1ce0623a115979504ff6b3560b837ea0e625130eb689e1bd09078ff25c5

  • C:\Program Files\Java\jdk-1.8\bin\policytool.exe

    Filesize

    581KB

    MD5

    ba0bdbff96c10fd8efe830836d055949

    SHA1

    b008270754fbfb7d20b059faf639b25be454ebd2

    SHA256

    c9bd57a84ddd29cc86bfdef60637b8a23958b5f552a0a22cf7af04c84f5381d2

    SHA512

    6f8d6d728023d72a794b1b56ac9490a225e57b9ec0d1ed6b21062b3929bf5bbf312357170cdad8c0a23d7676ae6382d5e7802d98403f13b9e3dce6790bf3be3f

  • C:\Program Files\Java\jdk-1.8\bin\rmic.exe

    Filesize

    581KB

    MD5

    acb43a56aef7e22179ac2b37953fc414

    SHA1

    eba0f99f28ca31e5150aa0491e4158bb27c04940

    SHA256

    46955bbf4261cc917b92be4a3f13184b227bd4622a656ec95077fcc1cd3c1557

    SHA512

    4142e98dff46bf09237b33693aee83f2dfaa2d778ac5ae0dcb647069bb05b31b881f52acea107da71c603c8274b6630eb77f7040fafa9abe272fa4841785604b

  • C:\Program Files\dotnet\dotnet.exe

    Filesize

    701KB

    MD5

    502eb63b32bc5182841de8185caa2451

    SHA1

    4eb01ab4d606b0b76ab4bf73fa80a872a47ed9c9

    SHA256

    13744352cf57e8805e6439e1df3884e52757e939c85a27d686268e8e77b93339

    SHA512

    ff77da19b3daf628f204e56cd5bfa9d3bc57ab3fc7e978021cc55cb3d4077bc82e421612a71107b089d55d1328c58d6eecef1b8dd4bf4381b32b3a9fb200d758

  • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

    Filesize

    659KB

    MD5

    d597fd2513d8685a6566df5da73cbf53

    SHA1

    64b33792a63e456c6d62afc9fd2ba15a7d83ef3a

    SHA256

    e6a13da511f9f4dc25da0891242bbe418d08a6b1ec8de2f4e556f9ce547a5366

    SHA512

    63677a7a4a11861db2af36e3690493f507afd19bf3580475e43fd6c9b177879261ebde8932b3f1ef1807f681af792a64332a172f7bcebecd0fe3c0d03ad2843e

  • C:\Windows\System32\alg.exe

    Filesize

    661KB

    MD5

    8bb4c72fa47c8fe99de6fb33c7869f74

    SHA1

    6fe07e7e5fff4e5778c07e494f3178f0f31c9368

    SHA256

    689a74578a817f4f303f7f78aebb5dc2016f43999a35cfdc12488c18ba790b40

    SHA512

    5c558d3b2a205fcf6a0995db109a569011678109059efc2f0843b3cd6032ff49e1a273b30d7d5bcdefb2df0dcc3b04d1c8c18fd33f261bf75ff3668d362dfa5d

  • C:\Windows\system32\AppVClient.exe

    Filesize

    1.3MB

    MD5

    f555d8466b6788eccc5848fc343498ce

    SHA1

    cdc2f88d984cb90e3fbe8d02b15b2d2c58ae6ad4

    SHA256

    11ca170f67d36f7aae62faa6893517bf76ea920e44debf1884ff88b2af9b3d7e

    SHA512

    a7287a2e10773cd97cb33e10445a5def087f83e1054f23b642e3d246706a6fdb4301bf93065e1738a54c726f7918c5b89dc7788031cb5fe6454c4aca9cd283ce

  • memory/756-26-0x0000000140000000-0x00000001400A9000-memory.dmp

    Filesize

    676KB

  • memory/756-249-0x0000000140000000-0x00000001400A9000-memory.dmp

    Filesize

    676KB

  • memory/756-40-0x0000000000720000-0x0000000000780000-memory.dmp

    Filesize

    384KB

  • memory/908-66-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/908-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

    Filesize

    384KB

  • memory/908-87-0x0000000000C00000-0x0000000000C60000-memory.dmp

    Filesize

    384KB

  • memory/908-89-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/908-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

    Filesize

    384KB

  • memory/1824-60-0x0000000140000000-0x000000014022B000-memory.dmp

    Filesize

    2.2MB

  • memory/1824-251-0x0000000140000000-0x000000014022B000-memory.dmp

    Filesize

    2.2MB

  • memory/1824-54-0x00000000001A0000-0x0000000000200000-memory.dmp

    Filesize

    384KB

  • memory/1824-63-0x00000000001A0000-0x0000000000200000-memory.dmp

    Filesize

    384KB

  • memory/1904-254-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/1904-84-0x0000000140000000-0x00000001400CF000-memory.dmp

    Filesize

    828KB

  • memory/1904-77-0x0000000000830000-0x0000000000890000-memory.dmp

    Filesize

    384KB

  • memory/1904-85-0x0000000000830000-0x0000000000890000-memory.dmp

    Filesize

    384KB

  • memory/2264-12-0x0000000000720000-0x0000000000780000-memory.dmp

    Filesize

    384KB

  • memory/2264-248-0x0000000140000000-0x00000001400AA000-memory.dmp

    Filesize

    680KB

  • memory/2264-20-0x0000000000720000-0x0000000000780000-memory.dmp

    Filesize

    384KB

  • memory/2264-19-0x0000000000720000-0x0000000000780000-memory.dmp

    Filesize

    384KB

  • memory/2264-18-0x0000000140000000-0x00000001400AA000-memory.dmp

    Filesize

    680KB

  • memory/3560-0-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/3560-38-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/3560-8-0x0000000000610000-0x0000000000677000-memory.dmp

    Filesize

    412KB

  • memory/3560-1-0x0000000000610000-0x0000000000677000-memory.dmp

    Filesize

    412KB

  • memory/4684-43-0x0000000000E70000-0x0000000000ED0000-memory.dmp

    Filesize

    384KB

  • memory/4684-250-0x0000000140000000-0x000000014024B000-memory.dmp

    Filesize

    2.3MB

  • memory/4684-42-0x0000000140000000-0x000000014024B000-memory.dmp

    Filesize

    2.3MB

  • memory/4684-51-0x0000000000E70000-0x0000000000ED0000-memory.dmp

    Filesize

    384KB