Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 11:47

General

  • Target

    2024-05-24_15f0b05790ef32b58c534f2973aa6ad2_bkransomware_karagany.exe

  • Size

    677KB

  • MD5

    15f0b05790ef32b58c534f2973aa6ad2

  • SHA1

    55302bf251fd8bc05b421a00f668f369ae6c9730

  • SHA256

    fb74f627769972918c10cf2bed743894c64dde19e698276a285576eef64b2c09

  • SHA512

    2be89600f05ef69a891e42f95121ece7a9e0ec85b0ddee55b8c935c3c9af161de47639e2449bcef600266f163a316aa9e721a27fd80016adf6c359770616f993

  • SSDEEP

    12288:MvXk1s6JvY67VMBNO/aXpXI22+VufvdIOKek1h4TA8bXQJYe:ok1s6J17W8CX32+KJNA80T

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-24_15f0b05790ef32b58c534f2973aa6ad2_bkransomware_karagany.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-24_15f0b05790ef32b58c534f2973aa6ad2_bkransomware_karagany.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4180
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3828
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3172
  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1008
  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4608
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:4732
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1672

Network

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    Filesize

    2.1MB

    MD5

    892bdf797568c4cc60f9e46c7ff36ce5

    SHA1

    fc6b39e7d12a7ad05343b3e42e1383489d514fb7

    SHA256

    ae3def2f39531b5f3fb385c9893959be3e4af6e78342df32ea6f4b5fb47053f8

    SHA512

    190ea7d5ff61768b3b498018c26e22d234c6005695f65913104ad43fefc097743d4045e3393dadb92c798b66c3ff2ba0c20ac925e2facd452c553584357bd8c4

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    Filesize

    797KB

    MD5

    58339c7d0ee3521384973c38ecc52017

    SHA1

    2df5eff9c8c6739b47d9f170377cce208c7739a5

    SHA256

    c14b9203a9806ae18fd37325b3c555a4db1d37f52d362d8a1b80263865504c78

    SHA512

    1ef4f42801a3d61845c323333f5271703ee11a80355faea15282cbae43e17eb1123d17ae68cba295c849ce385d38a554e63fe8ab028d38793a1f83e6c2aa57fd

  • C:\Program Files\7-Zip\7z.exe
    Filesize

    1.1MB

    MD5

    4543980c33566181c45be75abd62d9ad

    SHA1

    9647780345d7bf509e8ffee1f009e13fefb99510

    SHA256

    998275896ff83209aa404c95e5fdbe64244e981a8ec9255b37fcb961e026d438

    SHA512

    e14906f1b9a26a1105a720d2948b329e10ff94460e5ce94926e9465abda3fac49826bac5ac5350f659f77635ebc344633a279a5f886e4c5b6244281421a0ba38

  • C:\Program Files\7-Zip\7zFM.exe
    Filesize

    1.5MB

    MD5

    86a498a36e73850eccb59a20000e870e

    SHA1

    381f2a19c5f545893ac4b3f3c938ca34b0d060e1

    SHA256

    2a086518e36a112fcee32e290c3b48bc7597e440a5811e54a5dd8b6f7a25184d

    SHA512

    8425d4dcc64d4bd6397fcc966f66ca9fe3af372daf7d62d0098e98e3bc681f903bbe7379b55cf82d032bafb9803fc3d8b104a388ae1e4843e6bbb0b0dcc9db2e

  • C:\Program Files\7-Zip\7zG.exe
    Filesize

    1.2MB

    MD5

    d1c8b5954a062314e04a17b9a59a90c5

    SHA1

    898df32e0bd3c28a0b78438a9f0ebc054d74eeb6

    SHA256

    fa1a898ea2f83d8173b0cace03a23691d4c2a89ed8e1d8c00a1707f039f96bc6

    SHA512

    64ba9de00e6848f5cfc0dcc662e6c4a1202c6ac6fbcba6ece8293f7d6b340d20c6c44926a41c8f031b818ffbd8e755898cabdb5dc5d876b7da0652ba08e4c8a0

  • C:\Program Files\7-Zip\Uninstall.exe
    Filesize

    582KB

    MD5

    d9cef7a6f60e1e5b3d3133d02e01d2f4

    SHA1

    f1769c6b73b49b83328c19ff69d4af27606ae342

    SHA256

    c18abef1ce256d203cb748a7c5c9ebbca8930bee903156985840f1b98eb95d73

    SHA512

    f62f8da1f5ad8ba9a372b417cb9b5812b814b5b649961c08d49f182794f4a98ae27d3c8e0ae7036b921f386c363a551a2261892df1fe805d64262d9f5e59ae11

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
    Filesize

    840KB

    MD5

    df4e31b7cf36684a3358363c0d8d999f

    SHA1

    49fd9262e768f5e0464ba3b23549ec5c708554e9

    SHA256

    f927c9eb3a70b6aeb866e1a9d3b1f67a64a5c4da6e2bbd4aa9b600ebdf471653

    SHA512

    c1c12dde777ec46cceb81c6671df309b0466efdcdd7c757c52154110b0eeeb29b9dd15431ae979ecd86aa1a8991a656a2754e55d3ada00c1e25baed0e153403c

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
    Filesize

    4.6MB

    MD5

    696fe51b737f69c730e15da5af9ff709

    SHA1

    b748940914a7fdf61b4bc8e91c756ecdd452c6db

    SHA256

    2a1ac7cfa1c55c20c89f82e369068d9511bdf7a898ab7e4f3fa19b14fc0c946b

    SHA512

    dc92c25fb364a5e313ab15721134b4b3cdbec1669ecd56984f313e006556ec1d025ce3f4050b4b7d5160a811199cc2370124648e59fbe9d827a86fbf8ae62de8

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
    Filesize

    910KB

    MD5

    9bcf75d45578ce611a0f14ca9aaa9275

    SHA1

    373a8f951347f5e474697df333f08237f3b67f46

    SHA256

    40fcf68d87cd376c70422c25e4deff601a1cadf8bd25e4b572bfcad48403722b

    SHA512

    ffc2bbe1a49408b7c204333031a2d1baa56d0ecbef72afcddf17f5559b0169425d9e14a6bde223b6ff69ba769b60eba7096242f2a0b858857e4fc419d1146208

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
    Filesize

    24.0MB

    MD5

    bef44198bd6c2b7c384fe0cb8e7dfa41

    SHA1

    d39fba4eff0164579d6f3c2a15063a146f5848ac

    SHA256

    ff85d088486f0666d9e2ba54cd1db87776142fe99cdd48d307f1c3b4d5cf8c9d

    SHA512

    0f3dd5c121f3904d53982d05bfa719c8c197f46b821fdb9ec16742c748a0d4e04915a25a8eda3184b2c1cb07c9c9862773491a7ed0a696da139119cda35167da

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
    Filesize

    2.7MB

    MD5

    81de65408d58dba1e5c8adaaacfb0027

    SHA1

    539d97153e1be8f26fe6de1215eb5fc2a39ebc86

    SHA256

    a92c9ed84e23d5c7d1bf68dc38a6e4e6de8d63fb2dd32159f327ad5dffaf517d

    SHA512

    d5fb1ab655466fcf54915ace990e18b0b3286cd6a9676c89ce4cf25ddc97471306670eca25bb1e85a47a0ebfc95f3d34488bff5bb5d7e3b0fbbcfc3cc99b38f2

  • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
    Filesize

    1.1MB

    MD5

    5d979966eb55bb4ef8f62594aa8f7794

    SHA1

    2d3e6e71c5b74d9bb2ee4b44eee2d134e3935ea4

    SHA256

    7222d646ccf3fc62d358595fb4cb17d5f4f44809c55d880e57b2207969378079

    SHA512

    9f96be2f3cc1dbce6a6b63bf879500c40182988302c21841dbec08e4d38f12888e18b2e5a81bd025a424a7e6ad465a132974d1771ae4e68c077d9a8f5574a973

  • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
    Filesize

    805KB

    MD5

    7f5dcc1dcaedbf5b86c49bec1e1c54a7

    SHA1

    1b9930318b3961eeb04db2a282cefe5b63c6d677

    SHA256

    767f8df7bb2edc35f4955d26f02d7622f04be03a476b310710349def63240afc

    SHA512

    e4f40781783937b92507fe8ace18f10e10e12f055b69c606ad1b613efdd2d3961e461fadfa9b841f0abd7a697af326d45633ce99d5da29262a12b35ed629c501

  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
    Filesize

    656KB

    MD5

    23c2704ceb0b1e6146fa5ff4eb7a61ac

    SHA1

    0a700943a902e0f457d5feaf75cf30e710bdebd9

    SHA256

    88dc7eda99f1540b92157c0ef274021a2656a179cf79cdcea37aa141d566e8ca

    SHA512

    65605e07bd3850859a05f6a03a5b6709fa8731410ecf9317670678e6b01207f6e63dc437b4bccda631e05786017d8e1df241714c21e5a98957c6ed9695f19d3b

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    Filesize

    5.4MB

    MD5

    650bf01b05db0fa4ab8b8e7d6ecc9279

    SHA1

    430fd1d0e199a74bcc813090042fa144e19b2a7b

    SHA256

    7b85207520187bf42678356d2a5583d660c42dd8c325172e435bd7c9e475ba87

    SHA512

    64c38f659af1041e1d927a3bd70657d6496850e9b57e6840c63f7a34810ef1d249d56e15d35c6770ed58d8c3444027326a8e09314bb3329f1c369c1a4e717bbf

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
    Filesize

    5.4MB

    MD5

    c17bba5175ee7d34669aec1195ffaace

    SHA1

    ec04ffc313b08f653e4ca8a4b947ca655b93eed8

    SHA256

    76e037c5fe53c986ee414d9faa45f41fcad8b771bee1b0d40872e485fcbee1a6

    SHA512

    0d32c3446443d52752bb0f0ea1214e874b9201d9f2760d21e8d04e190a672a3e693c384b867d40d9b4e61e660e22313e20e5c0e45bd5f8db18b6b4aa734fb466

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
    Filesize

    2.0MB

    MD5

    44e18706187cb861b6b9e2743375b11b

    SHA1

    3a61d8ffe11232eb68c9d4f68812d9e9205ce5aa

    SHA256

    ce45ccf62945f464fe499ecb19d36410b7027237cc499e3ac83ad84690bcdd08

    SHA512

    b867df0b668d8f9c99f4eb2ce54243cc08016b370aca1395977844338fcb5108510f5a837e0edb36c669f8562acd300b39bb96cfc88924b71da517939d4a0e58

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
    Filesize

    2.2MB

    MD5

    7610942a0358568a243ed0a01023e5e7

    SHA1

    2cbbebb9ba8112cc8489dd2acabced0747bc4839

    SHA256

    010c8cd07020874553d8c59972da03778bbb7b3dd334864355fec1a9009cc958

    SHA512

    e072d7fac86bccd2812ef8390f19620ee7784036b4253010b32867a6834ae77e383102a7207905731cbf5dcaba96d1e7f6fd7f7b17835c8e31fcf7354134b143

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
    Filesize

    1.8MB

    MD5

    6ac0a325f61b8f0e4f9b59b472696336

    SHA1

    68377e62443549f90db9bd5f6435b6c6e7cfb56f

    SHA256

    3f4c208a4c332972c48fe40bfd24c25245b109d6e455fd4794005bf716b6b191

    SHA512

    0d123a47af29672c7871f93c3830adea6d369085908aa088550cd120488715d2784ce93c93548c6d1d2ae73be7fa8745226863151bd1007fc5784fe4a4e75023

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
    Filesize

    1.7MB

    MD5

    87beacb1630f1057be8969fc78650391

    SHA1

    73e24a75b4761ba5e781b415b0dce123d830f29b

    SHA256

    91abfb758bb67ac1ec7c1874003f0b45540454cabc392198670bcec816e1e74b

    SHA512

    32971be0b520e813190da0c15d268eb3234da5be8afb4a64a3a3a83179137bc03555de1026cdcd49b10f189c44a64a905c42e42e904db9ee53d2f601a7c1d41d

  • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
    Filesize

    581KB

    MD5

    4dffab9dd9155a2a8ae5b6f73dd57f3f

    SHA1

    85a899edf98cab7098e881227324764a49e64dda

    SHA256

    45e8395527bb7f5ebfd47d6b1dddaaa2e0765bc11020a1227e3e37cd905a8435

    SHA512

    cd39ffe22ede5545cfc24d558341b51bf08f0de3c7f515f5a3340ffc765d46f2d293a68ad485a96b30512a245f14a473de4d40311d3f0a51c21419743a179367

  • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
    Filesize

    581KB

    MD5

    c8121059f231092c4857cc35f3ac02fd

    SHA1

    226b96057f23765fff74c4339ee50ea6e81b80ec

    SHA256

    43490e895993af42e7990b6d67852cc19c3b19bc10c290f8ac47adec984b714f

    SHA512

    c06777792ddfd4c3d204bd68f8d9b837ac9df218a0114d2694b46b821b503038048d6e7239a7c1f87ca8746f8743dc4b0feb795feb8f2ace8cecab901a25acb2

  • C:\Program Files\Java\jdk-1.8\bin\idlj.exe
    Filesize

    581KB

    MD5

    a099ba5d4aca7516f7dbb53b6fd256c9

    SHA1

    c9de1639287ee22b8e9603b2458a6c88ecf1ae49

    SHA256

    5bcce664a278af61defa7578904fdfdbc8d86f6b96fd8e553f62681700dc8dfc

    SHA512

    5ce05f0f7e4b6360d2f58bd534127757b8b8eec56b6c55a08365755a1fbd79ee886ecd4cb1ce7b11801c4f59771183f6b3ee8f3febeb9c9e386619ee77357b00

  • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
    Filesize

    601KB

    MD5

    0f6a8baf31146ad4814adeadd9cf33d4

    SHA1

    185317decd41ec19f18223bcd6f0af326be9d5e5

    SHA256

    555e40a64b64d51e03bfca32eee6cf1f12a7f66f73cccd95c4c07cfd46b3a052

    SHA512

    d33c56f698e08c9441560cc9b012cc3cbacb5c14228d35907d21534a3ce6e3e054f34de39e64ac5513ea0699d157993ebca483cd157591bad8a31a8380c84083

  • C:\Program Files\Java\jdk-1.8\bin\jar.exe
    Filesize

    581KB

    MD5

    55c3949bfd32290962526d5ff536fcd2

    SHA1

    7b4ddf21dc29623c52ffbc419e16a3b71041ee9e

    SHA256

    1bf5dda7503d34d8e4680fdcded125f250af73f58199e2edf1f78b9990b67fb5

    SHA512

    f07a47d02459d9bbe86a4048feeed8bc28cfd4155f2076333ba23dc48f87e92e2f871de732f3e5285a0281ac26c8005a81c114890109f558d0dcc0d32300c161

  • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
    Filesize

    581KB

    MD5

    09c9e2a14b984a7b6636231f82442a3b

    SHA1

    02047dac060b93f56747a5ffe97962cca6ad36a7

    SHA256

    8ca0979965f51953ad2545c84c54797a0a1ec172be9dfa489b6f58577e204ed7

    SHA512

    69bb87d5d4b9892465f2aa321e53461864e234b865d1e8e49fab6d4ed9f4e132d5738b423a49d82300187c62578b92b66e20cb69f9dc0b3b4277ec65728d90e5

  • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
    Filesize

    581KB

    MD5

    b496eac73bbe476086f02eefbcb50c45

    SHA1

    218faf2ba2abf290aed9bfd224efea1d8ebc4159

    SHA256

    f6389b28d47dbf5e3c22c20f418d11af496dec5c03e1e38bcaf73bbb9e4768ac

    SHA512

    1e9d8cecfd1d6f39a098b3ed02a83d3f8c915dfa09a622284a3bcc82dcb8b3b0c4b6f326be35c0a7ce83c3090a73ae077cb84575faacaa694094629a0255fe84

  • C:\Program Files\Java\jdk-1.8\bin\java.exe
    Filesize

    841KB

    MD5

    15a08f7f35310f93c5ee3e66bb603bac

    SHA1

    39d8d44213bc61e97e4e4dec2d188dd5e8643f0f

    SHA256

    031acb040ccc33fd75743d5d6f9cf8c77aeeb6ec3dfbda7aed7b707e4b86dcec

    SHA512

    37e077252a2141630274bc49fc75ad5de8e3feea118523769c5f6e69a59325cd1ebaa8f3b3103de23250926782d1fd6fa1469c6444904ceab31833475db5fce5

  • C:\Program Files\Java\jdk-1.8\bin\javac.exe
    Filesize

    581KB

    MD5

    4818e93c9fb1aa72789ad21c9ca7e109

    SHA1

    94418df48df35dfe5d82246ad6c59e01d4229525

    SHA256

    3c6524a9e0fbb886edb1d14a822b41f38f6f361bbc0c94606f07d39acde5f91a

    SHA512

    2d8c984d59d8b5bcefcc660897969f179d582e1ff57f4a027b136ab290d5905637a7aad626152f6ed8257264cc3c1e736ff6ed2cb82c91721facf6586e56c69b

  • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
    Filesize

    581KB

    MD5

    806b1a8743f4cd0a647f4e8ecd52e101

    SHA1

    d9127750261bf1a5cf76f7f72c223305fd3e0d4d

    SHA256

    4e35188feea5ba61b8712766e951fb12ab7a533ac9a5298ad27d757b81ca0048

    SHA512

    ceb604935d44033b1f66bc5a629a241e94c25f962f643a3502e99b751a8ddc2cf9cd1329f3099b29e59b44e46167cc9bebaf3ddb584cce9fc31d93d3c110020a

  • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
    Filesize

    717KB

    MD5

    c3c877e5dbfa300a2abf2e656f7f2d76

    SHA1

    9a48028a0e1368bcf342a0742b677f7d300e722d

    SHA256

    3c5ff8bfa9d394d947bcee67d34fb4cbeb79fdedc829ee0017ee4325cd571ac3

    SHA512

    86dd67b37e18095431d6cd050f086ccd32f690cf5501a80874289c4b64788cff524a41b4084fe222c640187c059b2d7cc00494ae23343c29a262dfa21e77113f

  • C:\Program Files\Java\jdk-1.8\bin\javah.exe
    Filesize

    581KB

    MD5

    d24c85c418860daa8fc04d839b30b380

    SHA1

    08b92ee00dd953298c891679a05915e84a5486e9

    SHA256

    5c0bbd38707ecd7dc07bd319e994e5644421259cd7c61ed719102f8ab483d861

    SHA512

    35ec12d706ab240d1c8141924778f5ed600025fe5e8834c3d4ee6b363e0fb4a0bf34a46e06d9e33d48c0c40df05f94b240c4a8c51adc43b0a884ec9fc367ae55

  • C:\Program Files\Java\jdk-1.8\bin\javap.exe
    Filesize

    581KB

    MD5

    84bbbf320f8d9b9de59ac30e42adb450

    SHA1

    f147bd008a142a57a03b23804c2f948b678074aa

    SHA256

    a3591667b6ef8e4e99d27c767b68cb48cad0434debf0be97e6677aca4d4ac8dc

    SHA512

    6d31c398ae2adaec9598d7da4d6bfef722622787c6acfe8ca2e07d75194bd8c5c28fa381d3ea24c547dff83a715b147fe792b08c2681f92ca32044a389e3bcc5

  • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
    Filesize

    717KB

    MD5

    2d9b42a3be702eed391df8ff1e08df34

    SHA1

    4fc767bce033d0965a06440d280cadfe639b3289

    SHA256

    63207904077d3bc42e1556047375de69355fad52bb54744677248de5ae309b07

    SHA512

    4fa23b174e5cecf1ffa1c7c58c38862359ba21cd7b9a9aaf7eb77a4bcfad952f330c6a9ed29e3f5007078ec56c9129be9c572135182b306fff94823ad820873b

  • C:\Program Files\Java\jdk-1.8\bin\javaw.exe
    Filesize

    841KB

    MD5

    249c2494003cb4c987d32dc80e509703

    SHA1

    b94d41af3b87a2f6961995a4859361018d25445d

    SHA256

    69ae09b3bdf9149492df8e0177945bd84e0f57609dff9f6a7920a1a85e25f18c

    SHA512

    d4e5eb5efd7aa1c8dfda2f78ba476415acc949da075a949d763b3f8b9b4b4d742af695a2d5b0053789ce9dd6a78bcfd402b2759eab60b9e8498956db84f8d56b

  • C:\Program Files\Java\jdk-1.8\bin\javaws.exe
    Filesize

    1020KB

    MD5

    19e56ca10853f082e92206fb14429d2f

    SHA1

    64ea45aab80bfa39095cc6f1cc76eaba760420ee

    SHA256

    5a8bf94d9a1cdef344bc6417f038293d5dfdb10eb820c2c15a73b0e188a51bf0

    SHA512

    17122f1cf4f23a4a3950493a2411c87cd815a03ac6af07eafd1933af527b4b9f508942a221dca7fac6dc2b35f124617d9719fd3e70635c6179f5711243652aa6

  • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
    Filesize

    581KB

    MD5

    a93ee6635f700719217031a3247f89b1

    SHA1

    ead6257a981b8bf307a4c8e19599924b1bb9296b

    SHA256

    5128518c1fe70ca78e38f998f35f1c4d1b52a45b26d6ffaee8b2bdd41e8917de

    SHA512

    0e2282019f533045222c8687d53606e03d6bf0869e470c95be375f27329f5be127fad8d9d4571c77b35a15ad1fd146eeea9198000f6425858510a75831e593af

  • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
    Filesize

    581KB

    MD5

    4b51467b0037517856e3f58aaa93c191

    SHA1

    04479d542bcb2f4bc18f33b7d1c52fe1d4bd3cd2

    SHA256

    87b5f8bc582464b094cad25b4f1f4eaf8cecf9a95543418eaacd6192a6f953cd

    SHA512

    1d4a61454b44ceb7752b1ae7e14243b6e63d1a1858abfcef3357e5bbed89a77726a8737fa46b11f8410c792883d34678ee4c11520b145174158279fe4c10f68d

  • C:\Program Files\Java\jdk-1.8\bin\jdb.exe
    Filesize

    581KB

    MD5

    a7d2270a484ffaa02c108761feafc27b

    SHA1

    da7dbf336c154b991df68aeb6202cc691c37a077

    SHA256

    d62d3e77420c24a7636a4782884ed0cc18727d6c0787e8ff4e6d1654a1c7b319

    SHA512

    bf70c62a9a071c14b152d1d5223fb3f6a6cc3771a2040ea92fcf9b2d4f62949eb203ddc3b1d48963667787cef14c9579d34b41e76caab25306ecddd22f89649c

  • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
    Filesize

    581KB

    MD5

    439ae99da7d44b22fd4339843c95d75b

    SHA1

    f96b72991b9d80a19e8e8845b58aa27f3289416e

    SHA256

    1275bdbc68de93325c16d9dccc0d47fc67c6a2763f3bc95b48ba6a8720179b56

    SHA512

    1fa550884b9d9d8c2038cadf552d38451233364916e89ac8d867a0fe143efb5dd2154ec70611dfe81a308f9c6a5ab62dfef945f94d64fa309eee21b580e560bd

  • C:\Program Files\Java\jdk-1.8\bin\jhat.exe
    Filesize

    581KB

    MD5

    886bf28d0e99bd4afcb57f50b7bce51f

    SHA1

    d144df6f8bc211493291b10292640a28e3506399

    SHA256

    5a6f65629dc5e3d4cd81b6daafcaa6d9410db79ce8ff1086c9e5499f9b76c5db

    SHA512

    8bc60e9b94057f68d3b7d2738408ed4d93768d6d5b73ef815457aebce48404df11b5a110ffffca7547adab73ebfaf5f366411e0e5b4ffb15d5ed85f674509af9

  • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
    Filesize

    581KB

    MD5

    21658510cc3c32956231cf7c0f230b69

    SHA1

    49db0331be38dfa35c2bb721ee46b080c78458b9

    SHA256

    e26c10960e8ecd12217d151e203b9b64e4026f33b26752a286f62df6c377577a

    SHA512

    749c8995d6778beb8e0c92d4227efd6db28a9abab82f5ccbb6ee2024333382e8237f3eceeb0fa8bd65e6df64486f96fa375233f7f4d03e9543a8a402c89e0303

  • C:\Program Files\Java\jdk-1.8\bin\jjs.exe
    Filesize

    581KB

    MD5

    fc82d607315c111c542c80ebe85b9828

    SHA1

    9851a93432f1832bf41a651e126fb1369f7c16a6

    SHA256

    80c67db46ac4783cf6ad58e4c3142f6deecb7b950fcc36b3bbca6bac9d4d0ffe

    SHA512

    edf36a9171b030905254a4ba9a00c818625c4af2d33b9d52a369f72a42c01a7a4f5bc451f3e070599b0f2e6bc477989fb929dede6d93ba6880a15e7feed57de0

  • C:\Program Files\Java\jdk-1.8\bin\jmap.exe
    Filesize

    581KB

    MD5

    c992380f8f88596dc6871576f77dc0b3

    SHA1

    70198ceb00473887cd6ed1697c21881194f2dc17

    SHA256

    8fa03bffced75e45e342f86c010e35eb3d898763fa11901dc05af8a4c31fde27

    SHA512

    1a4c96da9b7bfce0b4544ef462f47d0ac98969faf03204dcd63b64ff2fe17499e2c64fde56707d44fc92e29a6bc9f8e22158913118e902b77508b259250e38b3

  • C:\Program Files\Java\jdk-1.8\bin\jps.exe
    Filesize

    581KB

    MD5

    845c1f1e875fd7479fe47b71eac71039

    SHA1

    3e3ba7e95693b40526974eb26bf0ac9482ef85b9

    SHA256

    8846a07afbd892178e99d0a0e59a9d25698ee00ae4aa10dae35da612f592de35

    SHA512

    a4653480f25091aabc334ab3ac98525d022538282b73749fe5af51a64f52e6a7ff7514be50c4170ba2b4bded90e6072bc760a3f67973f7bdfd9cb3f7954fe8bb

  • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
    Filesize

    581KB

    MD5

    49ee515a57be96f7fe83957329a2ae1f

    SHA1

    204050580edb6cfd75ef64ca6e768029fd2eb6b5

    SHA256

    d76eae7f1b9f939d25ac50a22ec81fc49ef48220f6a76c06940839e14dc81c98

    SHA512

    166c792593328900c6148f93281339103b2bdec1cddbd9d6a0985979a5c91f9c99c266f235d20106a7911d22ebbdf31c658acf49f152f54c047937373763ada6

  • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
    Filesize

    581KB

    MD5

    431ffc1f3ccac3365dd198783b32fca1

    SHA1

    a4d5535229c0d6c32f455ffe4f825486892eb45f

    SHA256

    ddccc0adce5a012176fc025443392639e8715070fcd8abae171bb6da664a95fd

    SHA512

    4a78aa43761b3bd2a30550ff781549e431f73cc2223c4e9b2c9eea761dc99d85c8688468fe6c7dee1a6bfb692c3fa55ee207c0d26ae6c02cea837b5cf14917ff

  • C:\Program Files\Java\jdk-1.8\bin\jstack.exe
    Filesize

    581KB

    MD5

    988b3317521e0bdc16c0475ecbc9fb56

    SHA1

    65d3e9758bca21e66e72f8cbfe495e3bce6f38fa

    SHA256

    4eba0abf5b52094db055d6dd29decfdad8468ebb1f43c8f8e49115e40edc981c

    SHA512

    0faf178146524ae01a31b13dfe37500150761fbcf0793495f3e93a30856923d1c77d50317127ebf0abaeccb7eb1fa86eedab13cf7e9e07a0a048fba243b70d51

  • C:\Program Files\Java\jdk-1.8\bin\jstat.exe
    Filesize

    581KB

    MD5

    8088d1c3318ea7f39557b75d731645fd

    SHA1

    d0767aac054323330657526486255a3bf39090a7

    SHA256

    224aac72d0408a1a160ca33096ab1886dd2e9fc0ec179c0abc02cd3045682fc5

    SHA512

    d25226c49c0237f788e03d7bd201849071eec714140f90e9f52eefd5fec90103d0bf9a6ca4fefc70d80370b7535d29abc8bd6b8e992824855193973550a29d6e

  • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
    Filesize

    581KB

    MD5

    23fbe76c012b436a5569fa023daa9952

    SHA1

    c9842ed61541ead3f3bd3ea86825621d43291537

    SHA256

    7d0930f54b15c7a97e847c4701a92f4aff5b369a3fcd5bfe5062143042a0400d

    SHA512

    9ce9458dc4246748bbd42311899de3f44cd10f1e059ed7f72eb0df5bcd405d375578e157f0178d90afa92fdf101d2942893346aa369fe300c93caf6c2f4112ae

  • C:\Program Files\Java\jdk-1.8\bin\keytool.exe
    Filesize

    581KB

    MD5

    892f80a1c99b3c520de8076ccc83af60

    SHA1

    13d89ed92a9d13ebfcc7d977b130f05e926d3f19

    SHA256

    85038a7e375ea1ab37c0cc066a85201dfa01b6837ee20ab22d5c56d0fa20d875

    SHA512

    d9a5a8f92bd57785579829f87940762f045528b498b03ca986e2b89c04dd1fcf70858ab3ca8e1188723362785646810162bfef3c4fcc6e5a44268c8173a6c6d7

  • C:\Program Files\Java\jdk-1.8\bin\kinit.exe
    Filesize

    581KB

    MD5

    d617804f55453c1e5113c415f30c7807

    SHA1

    e821d3600964a7311712773a2c38b4ef68073618

    SHA256

    ac10cd6f2a8a192481f428b84f6413b2fc9963c9ac0cb44b014b81992224bfe7

    SHA512

    7f0d6ee579cf63232a988c3de31eea608737e0222a2fa35dff8f8854cebb8c340726bf43549ac43eaedf4bd5a8a5e7da7c39b2c7321ae03f984d729b2e0ab03b

  • C:\Program Files\Java\jdk-1.8\bin\klist.exe
    Filesize

    581KB

    MD5

    ffa031762dfa6a006e8c2c94445fd90c

    SHA1

    ef16cbfed57dd44776a424af5530a249b9270557

    SHA256

    6db8723da32c791cd4de43c4114d94d3ff49fe15b3e6c218c34caf169edc301b

    SHA512

    286353a34a108cadbdb810b5c0c9cad3449dd259a35f88312a74386b9b85cf4782a126e0cbb94efdb8fb4c0e05a50a514a12dd06aa11872f5c97ac00fae8e58c

  • C:\Program Files\Java\jdk-1.8\bin\ktab.exe
    Filesize

    581KB

    MD5

    8a2e7a8e4d3d8c9ed37f9815ae487a83

    SHA1

    811337c1733332f7752aa5af1e273a4f37e43129

    SHA256

    06bfab0c21b10b126af6db1df9bd7c4715bb52703526fdaf35cf774ea210bb55

    SHA512

    eecb708ab8aed1f18fe6f90f2be2f5507730dc5ab6cd8ed8e72981a1615bc40bed3af73b8f36e1341ea7eb1fffa340c0b3d7989fa2e603f19a1f8383863b96c8

  • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
    Filesize

    581KB

    MD5

    c269e1b6e5328a1d788f7afb05241c6c

    SHA1

    3fa0b5db7ea39952ba08802a173ea66b5141dde7

    SHA256

    85a18915c9c9c9f762a06c23159c4b6bd508c541221e9a3b876e0bd676a845c2

    SHA512

    f8f17b963a048c9d6f6481fb57f0572aa2287e77ffab5f1fb1b3b19e4835b6e7f4e921cda0e4dd377c1f241ee66a53b503e62363041b0c3a43d50a9e014b232a

  • C:\Program Files\Java\jdk-1.8\bin\orbd.exe
    Filesize

    581KB

    MD5

    02b616780362f958c6916a1799d8a226

    SHA1

    a8508ae20ba1ad5b5d548d2ef0d41b33b2d7bff8

    SHA256

    60345d36ce47a5f800373eb85b8c76bf0efb9cd5160d55d8cc892ae40c69fdb7

    SHA512

    726153dffb68859831d5b784469e974347e7c9e3a7fcdb1baa4cba4a882550a44e8d70817bf2f22f26328abba36c78b307ff28596baeec20845efdafea822f86

  • C:\Program Files\Java\jdk-1.8\bin\pack200.exe
    Filesize

    581KB

    MD5

    25d9831741f349867df5e25c6b39af98

    SHA1

    c6391f8e6333f730608bf49fb9abee94e0fdfd23

    SHA256

    c4476235b23bc91f1cb5847ea1f2bf21b417964b08d06379a6e8e3025b7eab02

    SHA512

    2f8f2a513cf082e3f5615bd6e04a8c9bb717074861a27dee9b09ecac61f5d4b6e6ad9e27ccb03e519fdcbb2af09cc53ec8b172f3ca43f72f2045bb35a0c52997

  • C:\Program Files\Java\jdk-1.8\bin\policytool.exe
    Filesize

    581KB

    MD5

    df88d7b536e470327187453e0ae4002d

    SHA1

    4ffc40ed3cb272bb584c937abbb5f5da6cd4a002

    SHA256

    076ef8e10294718928f6e5a0e13980fd40bbdde03f79fbe54ccd97b98fb02fde

    SHA512

    fa187658b4007f1276e2c520142b3c6441dbb9bac02231c9c60e6d9ec4109b23859614f4a0516af6d53236d332cb28f69595478860b3a555995c903d872892f8

  • C:\Program Files\Java\jdk-1.8\bin\rmic.exe
    Filesize

    581KB

    MD5

    e0c51faf09a6f984dbff47a8ad710e86

    SHA1

    7d915ce3a444b4dbbe6c6ae1fcac3623129da70f

    SHA256

    cee444ace8073a7c60b1f747a2057b2822a6c2bd23903a25a72b3c907c3c4fa5

    SHA512

    1b28b2647c33cca61818c122a254ef8e8cc27a187bc539eba8062bcee18f0e8f5901e611a04cae95603cc93e435100014c7db6b60c72ff3383860c56a684b822

  • C:\Program Files\dotnet\dotnet.exe
    Filesize

    701KB

    MD5

    933c89442f88af7bafc41accf0a22458

    SHA1

    2114466ab7ee00c3b80b024287cd21865c837aea

    SHA256

    93f3067f03e27726755f659e3b0ae0fc3a2c40f733c50fa7c98a9cbafeb6e72c

    SHA512

    191d4b29e89c80eb9d2988f497149f65a20ca8eb4935f2408727e392bc18c8d162a7fec8981a5ace233dd4b7772aacfcc6cfe59ba4643248c797b12464ff9550

  • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    Filesize

    659KB

    MD5

    a7f332818cf5c572774c2ba7af101f20

    SHA1

    6dec67ec4f49779529d52f4e2df9dc5e24670ef0

    SHA256

    0aebe7a4a97e5febfb6bfcd1ac208f6d8b4ad49bee4b412be127e71527c71584

    SHA512

    c0813641d633fb3df5c208069aad96415500fbd6ba5bdab6e1dc384fbe3c3c28eeac8b7e751270aa1bb76b1cd5f21f96afc5b8a737587284b551cd7693052eac

  • C:\Windows\System32\alg.exe
    Filesize

    661KB

    MD5

    641f8e3be018518a7af1e5621c06f6df

    SHA1

    b05a386c1f8b4ce277200e8b9690cab6eca4864d

    SHA256

    8263fc2a9dee034363dfcc2eb32bcea69b5a9d8a398b4337a116b343a8700057

    SHA512

    c013bb9e661fa9e945065fc5e332b5c27c7caba9f81e1141c4f9d258f6963155b80d00c2396f6460a844f586154cdbb6751c0a78872fe50a7554495bb29c134d

  • C:\Windows\system32\AppVClient.exe
    Filesize

    1.3MB

    MD5

    c95eae1d480ce702ef939a685046d4f4

    SHA1

    0a6977b9dee493bb4b3963b4f5042cdd37268acf

    SHA256

    0fdc7d1f48e1e7e793e4eb303cf3f04ff59c0f5fec485c5c353316385f44faea

    SHA512

    4164c4ff438c94d9a1a97af233cf8cc79e3357f17c972da352004d50294094b39b6163ef2a2c98ced11e023fe22bab4f4ada9a2ac9e8610402a117656a0e13c8

  • memory/1008-247-0x0000000140000000-0x000000014024B000-memory.dmp
    Filesize

    2.3MB

  • memory/1008-48-0x0000000000C80000-0x0000000000CE0000-memory.dmp
    Filesize

    384KB

  • memory/1008-42-0x0000000000C80000-0x0000000000CE0000-memory.dmp
    Filesize

    384KB

  • memory/1008-41-0x0000000140000000-0x000000014024B000-memory.dmp
    Filesize

    2.3MB

  • memory/1672-251-0x0000000140000000-0x00000001400CF000-memory.dmp
    Filesize

    828KB

  • memory/1672-78-0x0000000140000000-0x00000001400CF000-memory.dmp
    Filesize

    828KB

  • memory/1672-79-0x00000000007B0000-0x0000000000810000-memory.dmp
    Filesize

    384KB

  • memory/1672-85-0x00000000007B0000-0x0000000000810000-memory.dmp
    Filesize

    384KB

  • memory/3172-25-0x0000000140000000-0x00000001400A9000-memory.dmp
    Filesize

    676KB

  • memory/3172-29-0x0000000000580000-0x00000000005E0000-memory.dmp
    Filesize

    384KB

  • memory/3172-246-0x0000000140000000-0x00000001400A9000-memory.dmp
    Filesize

    676KB

  • memory/3172-39-0x0000000000580000-0x00000000005E0000-memory.dmp
    Filesize

    384KB

  • memory/3828-12-0x0000000140000000-0x00000001400AA000-memory.dmp
    Filesize

    680KB

  • memory/3828-20-0x0000000000750000-0x00000000007B0000-memory.dmp
    Filesize

    384KB

  • memory/3828-14-0x0000000000750000-0x00000000007B0000-memory.dmp
    Filesize

    384KB

  • memory/3828-245-0x0000000140000000-0x00000001400AA000-memory.dmp
    Filesize

    680KB

  • memory/4180-37-0x0000000000400000-0x00000000004B0000-memory.dmp
    Filesize

    704KB

  • memory/4180-0-0x0000000000400000-0x00000000004B0000-memory.dmp
    Filesize

    704KB

  • memory/4180-8-0x00000000021F0000-0x0000000002257000-memory.dmp
    Filesize

    412KB

  • memory/4180-2-0x00000000021F0000-0x0000000002257000-memory.dmp
    Filesize

    412KB

  • memory/4608-58-0x00000000001A0000-0x0000000000200000-memory.dmp
    Filesize

    384KB

  • memory/4608-61-0x0000000140000000-0x000000014022B000-memory.dmp
    Filesize

    2.2MB

  • memory/4608-53-0x00000000001A0000-0x0000000000200000-memory.dmp
    Filesize

    384KB

  • memory/4608-250-0x0000000140000000-0x000000014022B000-memory.dmp
    Filesize

    2.2MB

  • memory/4732-77-0x0000000140000000-0x00000001400CF000-memory.dmp
    Filesize

    828KB

  • memory/4732-74-0x0000000000CE0000-0x0000000000D40000-memory.dmp
    Filesize

    384KB

  • memory/4732-69-0x0000000000CE0000-0x0000000000D40000-memory.dmp
    Filesize

    384KB

  • memory/4732-63-0x0000000000CE0000-0x0000000000D40000-memory.dmp
    Filesize

    384KB

  • memory/4732-71-0x0000000140000000-0x00000001400CF000-memory.dmp
    Filesize

    828KB