Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 01:07

General

  • Target

    2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exe

  • Size

    677KB

  • MD5

    e5fce993243da65fe56a6f97b0f66922

  • SHA1

    269302bd729999a3c5b5e662731df7411ce1457c

  • SHA256

    5feab5ede15b808db51a1e592b569049d1bf94f9abc3bfce59e4113df7e47704

  • SHA512

    e1d72d0373bc91b4e5317b37d0a484f862576db5e0a8caa8743c76de11d60387e5a66095f1742cfcdb6ff268d79ad2feffd0847e3d9195804cfe92d7c173df0e

  • SSDEEP

    12288:hvXk1oUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8R:5k1oatr0zAiX90z/F0jsFB3SQkW

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3420
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4520
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1808
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:208
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4972
    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4940
    • C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3984
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:452
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4996
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:1632

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe

        Filesize

        2.2MB

        MD5

        eb1e4b74080ed439bbfbf872d20dd1a5

        SHA1

        f8452344ad577de3a2ef826de54de0e147af822b

        SHA256

        911ea34be6edb595050fe2e098d2481f47e758f2b7c366390f667b8dfa0b4307

        SHA512

        64539d98f7f0b7f0f4becd2da01938e0b4fa41c6327bc2f21dc41f22cbca50aaeee2e5d6ee0dcf39c83f295f44077780df7699cec94c09f4dc201735e9c82b4c

      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

        Filesize

        781KB

        MD5

        34d87463cde09236868ec015a98193e9

        SHA1

        940c956121c3d1b32a88a71c32077b4e656142a8

        SHA256

        32b822aec478424216046d8f4f18a61ca9b9913a2d5cbc65890fa0619d1bceb8

        SHA512

        b28c8d3c3d53ecfe9448afac947fc3f68093a570e144457d0f4493648dfe16d32abf5aba7ac064559bed544acf604755d37ab2c6413686ed1e68df94d0fd3827

      • C:\Program Files\7-Zip\7z.exe

        Filesize

        1.1MB

        MD5

        0ef698e859eed713df8d652b8158cdbf

        SHA1

        3fc5e0e97c3bb7f8cff855cd7ed542cc2bcb5bb3

        SHA256

        7b487deddffe03c22bbc7b9f025dc95dda37e0ddcd1a005054d40ebcb38e1ac2

        SHA512

        80b8954339208220ae72ddb49e3b9f3dc14bc9bd97dd9df6507dd22244244f2eca0b53fcb265e50f76b1d40a6a2ea8917a399aa5861c97a3aa1e31d4c9c52922

      • C:\Program Files\7-Zip\7zFM.exe

        Filesize

        1.5MB

        MD5

        2081865e42d13a0dfbb577a50a790990

        SHA1

        908e3cf0736ca9c82af0590bc310e4b5979056f6

        SHA256

        110aa3ea4ee65244062ff6d33cb9a91046b3975e8da480f46ef951008df0bfad

        SHA512

        6fad7ca594844ddc18eb59059d7892110bf8609782e2046090492daab3eb824290454ac999d8e253a8693f9d0511aabfefd939e92e6453b0aae6ac4ec7ff2870

      • C:\Program Files\7-Zip\7zG.exe

        Filesize

        1.2MB

        MD5

        0846f1886eaafcb7459bc17fa69ddc3e

        SHA1

        d1b6ad5ca1a239c7ccf779bb756e5836934b2820

        SHA256

        850c414ed59ab3aa81fab782e4ed9e6762a05ba0aee0dd26d5daffa1988cc921

        SHA512

        e9c0264cd1effd27b90d4f9f4dfe63eeb8f80a21536b796c4d6619ac72df850fdf22e16e1fbf3c8182fb96b19109837fb100fbf717d4f73f1774206b20166541

      • C:\Program Files\7-Zip\Uninstall.exe

        Filesize

        582KB

        MD5

        d22092a2a646cefbcf17f897cdca3127

        SHA1

        b276b5d4bed03bf4960d466c654efd030b198fea

        SHA256

        e5cb83b3a7833e95dd02295060cc3cc61fcd329ea7a75a40035e5c11809778ba

        SHA512

        331c3e296712c39c508aaf1269caea9997ac918dab19ad3e05667e7011304d9ee8a07fd34919b7762a8836765c26992d627558b3825620f7c28a706877ebf15f

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

        Filesize

        840KB

        MD5

        a3eb7af3e22198cf6a11988c981009f5

        SHA1

        d0105b1a601b08acfbece8157e209aec14ec93a5

        SHA256

        009beeb4012a16e44f4267541be10321fb6e94d06fa28e30ac6a6b580e57e387

        SHA512

        7995e38d9a2522e810fcfe9df8ce8922d7fc6f006fd8c01ac152e58bcc33e1bc0edf54e167c85750bb5dc0f330e2d9bac0d05ebf6606c93dc97f0d112a9b76e5

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

        Filesize

        4.6MB

        MD5

        546a17bec5109835093bd775061c7499

        SHA1

        d59dbd1115ee1e4d47788b016c7ab3c4e772b50d

        SHA256

        4bdadbbc9ff2daafdcf8e6e7012dda88754e93ee44a0c9267ec1205aab369901

        SHA512

        a3990c47e2fd35caec059053411744abbf7ce999147e8193a430957d1bbe9261ce93abfd3a94e4e9a4f84e62a2ecdfb4536b3cb3e0d0a4e29feed0c6307eecb9

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

        Filesize

        910KB

        MD5

        e94184e40af868d1694a5bf070204a01

        SHA1

        ae7e64a217936f51a72857cbc71e6e36341ce232

        SHA256

        4a652f71a733057a6fb4ffa503a7afcd9702fea0ab26fd6a577c4e6699c2979d

        SHA512

        48f1abeaf0f4bb47aa30892f046e8714d4d33b419bbbcddebf655bebfcb2bcb97a4c8889c0cb6b1fb9b62e03e06897048a1430fd0b598cc0f770f485dc798b7c

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

        Filesize

        24.0MB

        MD5

        cb30125958c4215f5c13519716c3e8bf

        SHA1

        32fa0072c04240bd11b4b86576139813c90bf31b

        SHA256

        4696d2744945b60fd146474fe2928a8c7d5f7e88e9c57817e8680d500af355a4

        SHA512

        50d4fc6ae21711476615cdd46a62679fb2a497b4b1c8bd826a68c0cd43c4f3b5f23d198f891e6ddf1d21aea74649cab28fcb6c46e1d1109c4af034ba1b37eff7

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

        Filesize

        2.7MB

        MD5

        01635d750721b6d3606bb283dc83a9eb

        SHA1

        63f8d1f6572e6aab70c2ff8cad463c8d30079865

        SHA256

        a9787d126904ab08da2ac4aeac0b4f1860e6505fce8cd724c0fef5a4cb6feaab

        SHA512

        38ffaf75328ece5cc81c09d4bc5419fcb540e54bfdeb5638f5a26330e56823224247b7a3ca0fe6d67228f9b3e93c0a83866ebb44fd6ef14c26690e09ff874a63

      • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

        Filesize

        1.1MB

        MD5

        54a4709cd9780bb1bb340e439c3e5445

        SHA1

        c628291287752eb5d10d46d94e2ae5e5e4b6b9e3

        SHA256

        a53557dc70dfddd24abf084d1257ebe9795ce86e14ba3d437081841c587ea694

        SHA512

        4843f079d3a79fdaef1bd3f32c035f5b220569bbf8ab7ff095baf37cf29c373a6a7331e3a8eb800127e91661cf9991205fcba456db3eb0973e25798b9bf48a86

      • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

        Filesize

        805KB

        MD5

        c8079ab417a3eec5a0bcf5578841af63

        SHA1

        3b92e50737833abc238a68659ef63dfa28439d27

        SHA256

        af2434001c38ce37d0871e59091a8e5b702cce8bf0ee4ff60826b4ae2b453f24

        SHA512

        9e827cf3db71988673d404262c4e311921653f2ddb6d4a57f2210c62e7e8fd95c2736184e8d62f8c67886aff954aa26264178d21e4abdac8ccc721679677d7e9

      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

        Filesize

        656KB

        MD5

        2cf06f51efe0655b61407194cddce5bd

        SHA1

        873fe51db632f8ce254d634dfadee556d4021f8d

        SHA256

        0e0c23c0255a3cd2f552de1232f87afc98976709cdf78b9ca71aae48f74fc456

        SHA512

        c1da97cc4c3c341f47d8bdd5613fbcca37227d0512c9ba8028188573116553a705c613bad165c9f19393ad19496595c881cf822a14249aa18b4d6d07cd2bb867

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

        Filesize

        4.8MB

        MD5

        49f76995d3bb4feb74595b124022fc24

        SHA1

        a04a81e8a0d607e051980d90c9fc5b46101c68f3

        SHA256

        3bbe4a18ea222bb255ddeff97c3bda2d4f68f16c4be5cbd6f7722e015a5b8561

        SHA512

        420bf88e21d45c116a24a4c53f3c51cba916a78d72a824bae6362d19ed2375b8ac4712c5b1f1b45699393d024221f3933084449e0b463068b8ce6d12cc82d858

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

        Filesize

        4.8MB

        MD5

        868585c6f7339c10a583b57ee69d76f8

        SHA1

        a179aafaad4adff6628816773e579f59622af232

        SHA256

        1124e648b6a0355996f543ad4a9bea5de8a8e50df2935131efeeb75999dc7c7b

        SHA512

        41fdc2a0fd96052df19ec58bb83eaf16668fc184d3718c4587cc5a712b41da42f7aa190bb3383e73926aa9a676414b2e1238969ecf12d67149ef84d455766a97

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

        Filesize

        2.2MB

        MD5

        671df3e09862a10a181a7f11ce97ccfb

        SHA1

        c76533de90a7d74d8c98ffae0732752cbbf2361d

        SHA256

        1d28114663c147b6f01b976755eb1eb0e8acb662f2677283c5b1efcf129fbdec

        SHA512

        66e105165c79cece06c33733068f437d17084fe96981293469e3f38fcf4c21dbe1aa547987c7c785a7a274682e4e16f46ff1a21f7efa21c415972dd46048f16f

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

        Filesize

        2.1MB

        MD5

        37ffa1de55fbf3c18243f20e4f95e95a

        SHA1

        fbed3ea114caab5d76bef02aaf7af1bf8a8f1004

        SHA256

        2e58028f0ce3ea186316e8b88161dc4c6eef0ecd50d7fbcd323da1f27b939d6b

        SHA512

        bfbe6a340a453dccada0b0c4ac45c54ed4d760e99c657aba3f61adf81e20db5af3aac4441020cef0c606aaa33c129a51b06365963597fa2336d6c7d0544f130a

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

        Filesize

        1.8MB

        MD5

        abfa2f9988c35bc356466d5ca3e650f9

        SHA1

        7cc5dbabf0771d64ddcee4436062604a348944e3

        SHA256

        3ddcefdf81ffb179f4845005d386a3b124cc652ec4ac3cf7358c7a9c575d2ff5

        SHA512

        8622e61a430165853af2954273328be1a493cfe59be51b8a4904c90bc21aecae55a7751127e20d1af613ca98d66877a587ca0a16b34ac05944fae3b67b90a1db

      • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

        Filesize

        1.5MB

        MD5

        06b0a244f399a3308986fb65d48e55a2

        SHA1

        657ee179a5830431e7e91a907d5391d6458adac9

        SHA256

        fa6c5a84887040ddf813eaa9f4321dbec83a393bbd37b8fb95bca13cc1320b07

        SHA512

        552f240cd28e83c8b4a152b7a86cfdeab2ed4a6e64f963f37f92165cb0f05f07167122e5cf7b3b25030ff6d24f67f5076e2fe6ef6a19a16f41831caa3ff8a589

      • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

        Filesize

        581KB

        MD5

        cd0b725e073a632bc9a14fde69c40dce

        SHA1

        e3ce4295a52ff972ef55f5b8241d1121d906a35f

        SHA256

        d8f4a45d4abf5956c51b6d1160ae4e3315d2ba29e6a0d87dd1cf376166fe4212

        SHA512

        e7fe00bdcca9eb7e2bc7d954d47f5151b1a03e7bb3444e56bf8351fa81d0368bafc111602c51c6a904142c0971e471a91c72e65493eb6de4639a2b0dbcc0965a

      • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

        Filesize

        581KB

        MD5

        f65498b7b1f81de6bf7b9a0bedffaf36

        SHA1

        e9a34f801577accf4f217b50b7630579e44f3375

        SHA256

        c01150c634a617bf8f7832a2c7ecdea85777e1dab96e029596f924cb52e4c57d

        SHA512

        7babdc9e1c5bb394023c5a44defac0a2af3e290cef1fab3d09042f6c918dac3c4a52bf3f2d88c8e820d6aeb04b4bc992050aa14694e759598e3323acdf58786a

      • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

        Filesize

        581KB

        MD5

        eb59a4f330d86907bbd5ca6403803cb4

        SHA1

        313426cfbd1466100ea4eeb19d8c9323f2f3e125

        SHA256

        7b61376463fd6162578d697d7ddf38c8ee19febcfe18933699ee2804d4b9ab5d

        SHA512

        8c1fa447636e1ea0bb07c68efbbbd5ed80eb7dd482fd845bc84797d68f1c5a22e837b5a4b4e7f8c198e1233388d55ced095e4979e16023032cd65893a99637da

      • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

        Filesize

        601KB

        MD5

        7e05dd580d5f8f06982cba6002313438

        SHA1

        c3f147a818514489f14db49dd41fc37340cbee31

        SHA256

        ffe281130796bc3eb38501e51f6e71c7f1a2eb9c471dca6acae10f52adefd271

        SHA512

        dcf68cfd0f91f2a9f21d70c70b83c1bfac02cc3ce9ba4a795ae840c7f39e73320b6adea47207d604e1969154eca59f34198aef153b89d7f7a9c729a86084cbf8

      • C:\Program Files\Java\jdk-1.8\bin\jar.exe

        Filesize

        581KB

        MD5

        92e75f476030ec8c88d02006a36c6113

        SHA1

        9fcb722fe562d8d99a0d7da1f107e8b99270971a

        SHA256

        2a9ce3071abf2a9891d350f4b1b3d023a46713271c5a2da748f9041e3a5a2846

        SHA512

        2cd5df74cca0a676e51fa6dacbb4d3224baceec0e40bc76fb0679643ec689f8e4e027a35d7cde881b1c06eb5b052126e8358e39eb1231296e53b7a356a260afd

      • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

        Filesize

        581KB

        MD5

        d0bc37f66deefe150f6234c0bf1f6c2a

        SHA1

        2e9fa65ec11468c07680ea81bb0f8f8c9921907d

        SHA256

        90df41901a8161aa91495b07ae221c1e5ec4a4f08d409d8a7ad5e7e7f78d9ee3

        SHA512

        529b9ec45b4277cff20a470e2bc22f0035d90e2bedf33de0985e59571067ce5ee9eecc52a1b3754ea84713abafe7491a29128f94e123ac9bbcacda2780a1c622

      • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

        Filesize

        581KB

        MD5

        f57bc0d297f96e25aae40bdaf79d6cb9

        SHA1

        6c82f87cc62ee316432cddd0674e59cc4ddf777b

        SHA256

        486241b62e031d50ae8fca78cd2b396468a74763b5a556bd1fc6d343a31a038f

        SHA512

        e5dae88768162d030bd299c95fbd43997dff64d549b1400cf5c6efef263a266c65c01c4671d4c703d068fc7b1c9f948b3dea7cc6668ebf411da76184f04ab6db

      • C:\Program Files\Java\jdk-1.8\bin\java.exe

        Filesize

        841KB

        MD5

        a4c4426783073fcf717d79bec29bcdb6

        SHA1

        c2b55928c4e79595770a81168a2c5da722474a4b

        SHA256

        785932741ba423815331c523f2c59ab35768deedcc8fe4784f897e86290ab53d

        SHA512

        0ab8be39ebc7d49a7964d4888b3a8f7a306dc368a7dce1c03b298471c8c91d8aa97d1aedc9b60fc9e2c4c5cae1277b3068144d6105a209db135fdb167203b9db

      • C:\Program Files\Java\jdk-1.8\bin\javac.exe

        Filesize

        581KB

        MD5

        f1cdddf5454315e40206f767cc1f6bbb

        SHA1

        420db6bca02be8f387812c179f6166c958397c3b

        SHA256

        619fe9b10df1b6161a929e6f14e8202c2ac9bca65cdcc90767b1133a2bb8cb47

        SHA512

        f651cbe35ce3d3edb2a1acc95273f76bb580ff948ea2a2e5d07429f33cc637805564d30d17cb6addd320d3943151b0f58d7f288c70267c168ad5eb8a12eac6b8

      • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

        Filesize

        581KB

        MD5

        284d161c846e7edea80dff45de044461

        SHA1

        9dca7eacb215a37716b834590a722f106fcf65da

        SHA256

        f7abff0c47e3af15f6c6fe2ae63968b5715293bb303190c23f2cad31e5221b91

        SHA512

        80e1e198298620a45a088a4828cbece7bfc80a39ebbd3b9351cbd77292d2405c653baa16f5d95b4fe960263bc9079994e315cece69730e98f17d3e5c4a845d9c

      • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

        Filesize

        717KB

        MD5

        2764f45301865e7e9eb2b8e2a0d2d6ba

        SHA1

        e1b29f7884db8c0e0abbca7f8d5744f9533340d6

        SHA256

        461d18591b83559894c502baf53730ef5137b93422114e640a78532b53e82c37

        SHA512

        b361859ecf29c5879d550597e949796e147c416012252e0736d0b930b3e2f9c5e8bb6990c760bff2dcb5b547d7321ccbe2759c8657f0ef601269721e703f1149

      • C:\Program Files\Java\jdk-1.8\bin\javah.exe

        Filesize

        581KB

        MD5

        0da347ed307ccbea1115c0882d68b18b

        SHA1

        09c92b613aab998ae1f92b16b9b608a632c05d37

        SHA256

        7aa51d5e22faead6551eeac0751cd27bfa6babf9df3f92ee9c89029605c6c9f0

        SHA512

        2c5b90fea38bbdc758d869a42bdbf791e4414c37fe7b08401b33de83d900377590419130f0518a09c223702014ebf96c7671d583addb60577e3e10d91061e8d4

      • C:\Program Files\Java\jdk-1.8\bin\javap.exe

        Filesize

        581KB

        MD5

        21277be71d93c7e94606f3b1321d5f2d

        SHA1

        9a9d2c9db590c0afa6ef974e34f7c0014d6952dc

        SHA256

        552f68eb5ac59e754f5b236794e47af0f12e042d551163a7e36baa83b44b9115

        SHA512

        752a441f92a916ecebc24ca23cc9c21efddab666b375ec0fb31657e5937803642a33e786f028dec8dc0bb2f86183384411aed34fa4c7eae6b8847087c2e9f607

      • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

        Filesize

        717KB

        MD5

        81b37f6e4ae3ba7ed4b216cd4d4cea11

        SHA1

        bf63af4fc0323fa86903204a7fc515097f335f3d

        SHA256

        a43b366e88a64b9cdc0d09d1f8ac96d5800f1e165ba7f1796c75124743bf4504

        SHA512

        53be813d7ab221b80b56b82ae80a432b1d59e4a571f5322622dbceba2e065e337f5fdcd3f6d38e58ac48d6b33c18d5a4ffb469f21992cb7d7c46d3d82342cacc

      • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

        Filesize

        841KB

        MD5

        3656ed0210ac54c555d302a3f0defbec

        SHA1

        66cfd123d8b3836fc3a0ee564653d492c61786fe

        SHA256

        0ea039e48bc05f29db451a545e90d546effeeb7e60ccc29c2b7bd37657cf6162

        SHA512

        92a3c1292d8081b856a03e4d81ab480b00984d174ad7042e0a3d006f68f3a139bc7a55fc8343c5356b29167d2eee77aa0ac46e10582758d31c271813e32a3eb0

      • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

        Filesize

        1020KB

        MD5

        063c743917a2d1e79c934debff789aff

        SHA1

        3f153a671b2cf3b436cc911d23c27ff2a6a046b4

        SHA256

        526ea2670f1b86f270f16bb864f6bf11531ac5c53428ba2fff85fa42093cfae9

        SHA512

        cd9a4610e9c44a7f394be5163268544b07ff66585b6bf760c63e10f7ee1c4ed2d32a2122a12e4b44e2def2d6ca578a8ead3cb5e6d93eb6841bc2eecb04155f18

      • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

        Filesize

        581KB

        MD5

        1a9e5c03f1bf6431dd96ca373988f7c0

        SHA1

        3befb5375520bd0741e0ff1d4c59b755ad011ae5

        SHA256

        e301e198960f423d3d62b078d6ea056232d06cc7fd4981f17b6a713a3371c465

        SHA512

        9d669b4f4785aef8d75dc3a22a22aca1ef6ff0161b399c7c2a12a503d18c8c53bf63092150dc6386d866955269e5c7a56237781ecc24bdc91ff47a3203c294c4

      • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

        Filesize

        581KB

        MD5

        fd659f8682e32bf7ed43382f5c26b109

        SHA1

        2d26541bb10ee461379a14b5aba5fcb2dfef4026

        SHA256

        e0df650b2ac63f487c18f2774351eca13fcf683b435e343761fddfea1d87786c

        SHA512

        2bfcf3e85797a01c1a5b9adfafe2ab660582b09a55108665feaf1b508cadaf28c9165024d420cd424e019d2a15ab6be73de5a77b90a9c21953ed9caff4d19296

      • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

        Filesize

        581KB

        MD5

        cc1f402826aad2859810812dddb1fb7b

        SHA1

        674de8862f1b5b306ef20c06d445498f28c80ee9

        SHA256

        a6a51b764d4a14faf3e6036bb17963d572664b402646c03abd47037387ea82dd

        SHA512

        9bb946c34143e78ad2b1e3e7a9bbeba768a8e9557f59595cfe2d92c1d09105088fe3bcec3bd3330e9183bebe6511e1f4a6682703ae7e195c115a5dd264014429

      • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

        Filesize

        581KB

        MD5

        dc3eee266288070c4387908bb8e543ce

        SHA1

        7c637a9b2897294953650bb47dfce5c68ddbbf46

        SHA256

        fb05bb1fc5bd7faabd8f2b20a0b75aa05ee2279f739ad1154aa7d281aa6ca2bf

        SHA512

        b0dea51250747b7e8ce8b73e73aa1ef5f17c9c3e40f677a18502cf18cc4ef2aa84d0076db7496b8b7f8afc4467baeda0283dfb0b03659d83b32f2574fe8407e4

      • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

        Filesize

        581KB

        MD5

        d70e83c771761f9e711e134734bcdfcc

        SHA1

        c8b8a61e6d78a108fea1f19a94e90ba51a708783

        SHA256

        6a8b6c11f0dd5ac2e56039fd10261655fa155dcd484d610f74f0165977bb83d5

        SHA512

        5ee4e0538fb39c1febab45e18cc04d81c13d15a2f9ee142a48cc805bc28ba50df3dec1de10100735f39af06f934b7f2b60529c5fe77347e844ace6c99a0b0f9c

      • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

        Filesize

        581KB

        MD5

        702e3662011ba4569d9d8c2b823d9e57

        SHA1

        a7d76eed7a2813aeb9b4a6740c56e84e38b91ce2

        SHA256

        7f82e413ddd386cb86f2be52a39e3de7aa87a7dd1fc4d8e739514c9066f59d14

        SHA512

        4c76caa325bc15250012cf8f403db6e1db0f935a7cf1a8414964e170545e71f23be4cd165231e4cc29b662f8bd0744013056a69a4e8486f07dfb16e4a6415ae6

      • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

        Filesize

        581KB

        MD5

        e43bf95d24dbc2153d81c457901da705

        SHA1

        25c40ad96bef1fb19a9952e3f98b64f229e83ab3

        SHA256

        6e1293e23991042716900dffa459474675bb7f71f67aefc1763fa98f8b211ac8

        SHA512

        a879c4d7015210944fbd00dac4466e43a93ba7aede930a61f5598339927b4cc3725c977374ac31f1f233b0a6d92d60681e7f50b0b7f648c61d3bdfadad92f25b

      • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

        Filesize

        581KB

        MD5

        aa0c47e707febc346261b9038955f381

        SHA1

        4d551ca729d15a3219c3723563f066492e5f5385

        SHA256

        74e1769932d6a20a0e15d6e84b632f9cf038d79e9708963fc90325cf6a307ed3

        SHA512

        03eacbe123c9cf482a30e09f69ee5dea7999284a4faca9fca35bb5d17d2f5a694de0fcaf281c21519a37330c0bbb60ef3f559fb1ec4c87882351adc46e229665

      • C:\Program Files\Java\jdk-1.8\bin\jps.exe

        Filesize

        581KB

        MD5

        232133f1a632e99eaffc2c1be3515969

        SHA1

        ba56a7a6febc2557e9c8dae4105e1aa40337f7dd

        SHA256

        aabd7044669324a5abcc38c3aea6ecbe70e8d9f5f0f462adcf4d4ea7a546670d

        SHA512

        3e37b350faf5ab9a3bc62e04a1428b0881696403b816b86a6d443eb48dfcdffe26c730498d8e329aa1f5e94f744d276ddc64abf1a5c9dfb274d6da62f359957e

      • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

        Filesize

        581KB

        MD5

        85d95799cd62f341f24592ce52994059

        SHA1

        0c68b20391791dbdc9abec5043757d91edbf1bc1

        SHA256

        e961f68f7eb53990ad51244306eb6557429dee002a033cd65294ba7a481008e9

        SHA512

        b8e0fbaea6205b49b7fed6b665df6d96b8a3ebda12f2258509d3635d3ed7cd4d8ded013a8f6606a3ffe65a5e83bd0a66b3fbd8fb17a73190c69c082f52b0bcfa

      • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

        Filesize

        581KB

        MD5

        4e3e6fdfbb4febc336093b932a19f178

        SHA1

        500677d74bf04a157136eaf13d888280c1bcf383

        SHA256

        80a791e01ce93eb5d0504b6a9688881467891026ae553cce6b31f1ec4a20d1fd

        SHA512

        2f5200934b685065b6b7e40da92e805884a6d3a44c784302d3131948bce761fe473e2cbb2f6848ed13d87874b67976aab649a66eb28273787797d914369a062d

      • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

        Filesize

        581KB

        MD5

        ec6cd4f86cf7c9ad1917f60a90417072

        SHA1

        eed00d2e7279348afd8cca6f42076ad4adf5bd7c

        SHA256

        682e6b3d7076c8ddba7e43e934e23c8c867bb8d9ce6926bdeeb57bc2b6fe487e

        SHA512

        ac306691392cef5d76b292a10a874afb2874f3563bd99d1e70f0ea266e0e698faca9ef685274d8266ba186c6064ece37607b6fe64ede4906ace7fd4a25e9911c

      • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

        Filesize

        581KB

        MD5

        5a40f7ff6e939b8b5ba6f2217161526b

        SHA1

        5dbe3d10664c05dd3da8bb759a7e86af669f4138

        SHA256

        43bc398c63ebfd97217c03f73125c103aa68b7581e2fad3ef0fb2ea9d1f0979c

        SHA512

        33df935e6891aab3f46e51525e23d23bf21dd3453fe5a290292a204ad5d4ebb0e768dcae6b5e69e31a50c049db7280c08ac1339c07273a1fba27a1f50328250b

      • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

        Filesize

        581KB

        MD5

        04b51df93d4be4bf8470c5db820cb766

        SHA1

        c77e900858ee2131c15376c6b102abae8012253c

        SHA256

        cf58e68bfc71394066f54cd033a0fc23dc28fbc92e2f81f5a6c7bba09f02e6cb

        SHA512

        694806284302a79ff743fe7f60c86a5a432cfd6c74ab7989ffe307df2ae7cde724b1cd9d7a84e3251f69dfa37a1586c42a7571526891ca53b74c5ad93cf3d370

      • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

        Filesize

        581KB

        MD5

        b8036f11fe825538b6e94d51c8745d1e

        SHA1

        71eddeb89da6143bd211a16d6b870d39e74cec64

        SHA256

        c670239021983ad34f7fa48ceeb965134082af792541d92c5652d7ee58467039

        SHA512

        135d403a9d2ed3a74d594559020f4b4f55292ebd3b217df2225d4297405c3cccf178d2c4f9651707f3f89d66eb2a95a20753ce265931dfd44278f44c4b9d4a9b

      • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

        Filesize

        581KB

        MD5

        7c9673c1d3809940feef7a9130f6b224

        SHA1

        0127069b0137798ee9ba978d43b289a7298dc163

        SHA256

        dc6678962c83df160c2dfc1fbdf8e9c8f5c2e599c7c50512c43ff83af8aea3b6

        SHA512

        2711299ad8487f3b51159d46435937a7d34c11f0d4bbe339e40047a8297a48d05d5e39ed546dbe1a3d8567f987cb443d9b42d7d772bb3aa8b9c42458707ae0b6

      • C:\Program Files\Java\jdk-1.8\bin\klist.exe

        Filesize

        581KB

        MD5

        25a3ce0daec5884139b9af2bb4314699

        SHA1

        7085256ed4b3f76d5ae894325ff614f9bbfcde4f

        SHA256

        85a2892ca2591ddb8ebd05b58b44f2e726af6f8178f7871550027690e87fb8e2

        SHA512

        142ba4530a5d156ad2d6d3d22b9973c2aea646548cfc843d99d945f118fa0dcf42bf89c888aef6df765cbc0e1bb81050dc8e1b645588e0161f0bbee5cc7667c1

      • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

        Filesize

        581KB

        MD5

        be648378109e224e4d8a1e45e3464180

        SHA1

        e57beb87d69ef0b7b8db9377e41217e1e1c8492f

        SHA256

        04b4d5e42e51f0d7caeebc444b7186160cf3dffc313ad90e01a683dfe150e49f

        SHA512

        06c3fadfc10363d1c0e0bc33ddb46efc1dd0e57ac59cf522d7b7798465d14843be8dc7ab0a42927601f085ba788522f8eeb8f00de852c5ae14ab0246d2e5b43a

      • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

        Filesize

        581KB

        MD5

        3c37cc8d4bcb6e2961ea4f4f0c6a4208

        SHA1

        42273de12194dbb2826ff6eea7434f44b40163cf

        SHA256

        f896702f557372412dca595e6464ef421df225ef30ba97a3da3b1aaa14f5de15

        SHA512

        00abb8484673033b6ddee066d76efcc39cdd92376ccb5dac643b3ffd9bd947c92f25c6b7a8c8053211490eb476f4e1e33074757699ed472dc22eb4049d19289d

      • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

        Filesize

        581KB

        MD5

        5fcad22e871de4552b8fd854663352c7

        SHA1

        ed1e7a68a1811a25313f527eb016630e792d1145

        SHA256

        8d8b9ebe563de260177149b7f57f2c9e0212a629e552e5772bd77dc362b78d7b

        SHA512

        fdf4ad25ba2678da33e40772fcec6094c4c63febef3725dc161eba0eeb47a73acac4202ef96681dd4df412bbdc3c7264a101a7a2cdac59f4f65d34a89bb508bf

      • C:\Program Files\dotnet\dotnet.exe

        Filesize

        696KB

        MD5

        c10d263b4258ae9699c7e3eccaabc346

        SHA1

        e8ccb50e0db0172e66821e7f18b135330e823f47

        SHA256

        e40dae62e3d393f2925b13dc49bca81a50bdc7f77b8e5639a18e86f1ccd29a69

        SHA512

        1fd2636a758b4baed9a6a5020ca36dcd6df7b4ff89ea05b63e9a2ffa71c987d6d20b01fab9ea763871588bacfe8f80924d0646320ee8bdc759149959eee3ce29

      • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

        Filesize

        659KB

        MD5

        8a34d075803e475ee0fe9f243ea5f9b4

        SHA1

        45927cdfc285d39bff82bffb441bac7808228256

        SHA256

        879061c957e988cbe04f0b9b69bbb9729d0c894072a0bffc92cf0ddc78776ada

        SHA512

        a2429eb08cd5a327877a5716ff6e15461eae7c78fd8c602cdb3ca156890af45912412f5c510f4f937a96294945442126f1aec859ac906c0790af3996b1cb4d4f

      • C:\Windows\System32\alg.exe

        Filesize

        661KB

        MD5

        cbb4d8563c4b813db006610c1cb9dbff

        SHA1

        22f87369bbc31229a2eeb780fead8dd91662e88e

        SHA256

        40cba48431bc23322917beba3305d06b8bc9e10056325d601fa7d62fe3014386

        SHA512

        3607c758962faa771df202a4b8dcd1c595c37cfc7c62d8fe8e0ca48fb6ad9dc2515c7308036615f775efac78d9e62bf19ddbf634c8db61392f6e276a82c7abaa

      • C:\Windows\system32\AppVClient.exe

        Filesize

        1.3MB

        MD5

        46bdbb176d35e289b8994cf6f746cdd6

        SHA1

        e153131980af806c21c2b1b24eb5d1bef687c6bd

        SHA256

        0e2b8a850e29466d51f055c62b83f9b1723b908f3157f0c8eeb041476b10dbc1

        SHA512

        1cdced7dc0017d08a6d9f4aa8a2c35eab12ec3cf6cbf20d90bb4a018c8f7fb45a631d39a5862635b1967ec6d49f64647a918f52de8db7d53acf3d8b72a9d66da

      • C:\Windows\system32\fxssvc.exe

        Filesize

        1.2MB

        MD5

        9e18c9c42cd9972e949466d313cb0211

        SHA1

        d199a26e36cceed0a82f58badbeb0973030bc1f2

        SHA256

        3653fc550e5fa9adc23c79802fe8cef0783da82cbe99f46225a9455d8de4e268

        SHA512

        5e49dc635977d55e6d6366b83eb977579116329cf54eb7ecb7ddaa0ca9115c22840d67dfdfb86772320cf5eb2989c13f08cfbd9a6e0f3079cbed69e57ea8d1b7

      • C:\odt\office2016setup.exe

        Filesize

        5.6MB

        MD5

        81a48c6aa8c37c8028f3508ee60792ae

        SHA1

        74f0d0d38a37974f68377739b333e95c29d7f7a4

        SHA256

        f9ab61f1eefb31b7f6fe611c53894301c3e6109060dccfc927b2494943e76a56

        SHA512

        e3b1496352b5bfc15a9e8e0a3f467db340d744c5df347cf21548dadb0c2be2b40da33d644d46342747d3915146253feacdcc39146c364090a30c9ed0994c3d75

      • memory/452-80-0x0000000002280000-0x00000000022E0000-memory.dmp

        Filesize

        384KB

      • memory/452-79-0x0000000140000000-0x00000001400CA000-memory.dmp

        Filesize

        808KB

      • memory/452-89-0x0000000002280000-0x00000000022E0000-memory.dmp

        Filesize

        384KB

      • memory/452-91-0x0000000140000000-0x00000001400CA000-memory.dmp

        Filesize

        808KB

      • memory/452-86-0x0000000002280000-0x00000000022E0000-memory.dmp

        Filesize

        384KB

      • memory/1808-26-0x00000000004C0000-0x0000000000520000-memory.dmp

        Filesize

        384KB

      • memory/1808-34-0x00000000004C0000-0x0000000000520000-memory.dmp

        Filesize

        384KB

      • memory/1808-152-0x0000000140000000-0x00000001400A9000-memory.dmp

        Filesize

        676KB

      • memory/1808-25-0x0000000140000000-0x00000001400A9000-memory.dmp

        Filesize

        676KB

      • memory/3420-1-0x00000000022E0000-0x0000000002347000-memory.dmp

        Filesize

        412KB

      • memory/3420-6-0x00000000022E0000-0x0000000002347000-memory.dmp

        Filesize

        412KB

      • memory/3420-7-0x00000000022E0000-0x0000000002347000-memory.dmp

        Filesize

        412KB

      • memory/3420-41-0x0000000000400000-0x00000000004B0000-memory.dmp

        Filesize

        704KB

      • memory/3420-0-0x0000000000400000-0x00000000004B0000-memory.dmp

        Filesize

        704KB

      • memory/3984-68-0x0000000000890000-0x00000000008F0000-memory.dmp

        Filesize

        384KB

      • memory/3984-74-0x0000000000890000-0x00000000008F0000-memory.dmp

        Filesize

        384KB

      • memory/3984-76-0x0000000140000000-0x0000000140245000-memory.dmp

        Filesize

        2.3MB

      • memory/3984-240-0x0000000140000000-0x0000000140245000-memory.dmp

        Filesize

        2.3MB

      • memory/4520-13-0x0000000000760000-0x00000000007C0000-memory.dmp

        Filesize

        384KB

      • memory/4520-19-0x0000000000760000-0x00000000007C0000-memory.dmp

        Filesize

        384KB

      • memory/4520-112-0x0000000140000000-0x00000001400AA000-memory.dmp

        Filesize

        680KB

      • memory/4520-12-0x0000000140000000-0x00000001400AA000-memory.dmp

        Filesize

        680KB

      • memory/4940-229-0x0000000140000000-0x0000000140237000-memory.dmp

        Filesize

        2.2MB

      • memory/4940-61-0x0000000000510000-0x0000000000570000-memory.dmp

        Filesize

        384KB

      • memory/4940-56-0x0000000000510000-0x0000000000570000-memory.dmp

        Filesize

        384KB

      • memory/4940-54-0x0000000140000000-0x0000000140237000-memory.dmp

        Filesize

        2.2MB

      • memory/4972-52-0x0000000000530000-0x0000000000590000-memory.dmp

        Filesize

        384KB

      • memory/4972-44-0x0000000000530000-0x0000000000590000-memory.dmp

        Filesize

        384KB

      • memory/4972-42-0x0000000140000000-0x0000000140135000-memory.dmp

        Filesize

        1.2MB

      • memory/4972-63-0x0000000000530000-0x0000000000590000-memory.dmp

        Filesize

        384KB

      • memory/4972-66-0x0000000140000000-0x0000000140135000-memory.dmp

        Filesize

        1.2MB

      • memory/4996-94-0x0000000140000000-0x00000001400CF000-memory.dmp

        Filesize

        828KB

      • memory/4996-95-0x00000000007E0000-0x0000000000840000-memory.dmp

        Filesize

        384KB

      • memory/4996-260-0x0000000140000000-0x00000001400CF000-memory.dmp

        Filesize

        828KB