Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 14:20

General

  • Target

    2024-05-24_cb87de1b577da9b2611cf81b6f80bb5e_bkransomware_karagany.exe

  • Size

    677KB

  • MD5

    cb87de1b577da9b2611cf81b6f80bb5e

  • SHA1

    a102cd4aa513d1cb045dff28087060fc1dbe4254

  • SHA256

    e2d357dc0684fdf09725104365e916822a7f45137eebbd4794411235499accb4

  • SHA512

    fdf8363a6c99af706b9b3dae0b73c82888a86547a94caabb9e642d56f88c663433951d073177487efec97686a632fb1fff9c6486003296e1a60be870d4c72a23

  • SSDEEP

    12288:OvXk1NgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:yk1N7ozX0j52pMkuLoiSJVlIL29mhNq6

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-24_cb87de1b577da9b2611cf81b6f80bb5e_bkransomware_karagany.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-24_cb87de1b577da9b2611cf81b6f80bb5e_bkransomware_karagany.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4016
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4732
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3104
  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2168
  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2448
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:3140
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:4792

Network

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    Filesize

    2.1MB

    MD5

    7c261a077aa0671701d481284e807f0b

    SHA1

    342933399bc4d38eb0aeec65fe1900a6e890c85a

    SHA256

    98643aa099ab8d4029ef2af2759c1c6b1621006b7aa79f2e72a89723dc975b4b

    SHA512

    3a1a21b5eeff5fa1e59dffe7cc2ced6505d8aedc8d69ff9fda96d8dc5fb11b35ceb6d054e7cecccacee08a555208717c5671a2277d8c254e9cdd033e5dd4a874

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    Filesize

    797KB

    MD5

    e1ae9177eb811ba7582255aecc8def64

    SHA1

    d7b57fecf5089b781b80743496bb7f561c25b9fa

    SHA256

    b394b1c71fbc3f60df1e9c1d2295d840670a8d4e680e8e7423762853cbd606a0

    SHA512

    d8873a6b2e71d96c2eb6ede1874646dc49aa0564e2c9a02de7a2dfbe5a7451020d56805b66c0a9089361928542852c9b75b12c67a7ce5d2e5f87bba7dd74ab65

  • C:\Program Files\7-Zip\7z.exe
    Filesize

    1.1MB

    MD5

    42c5d2112d9f3f109e9cf79cfd50cad9

    SHA1

    4ef7d5e23002246174471de14c1e56a704eba6e7

    SHA256

    3aba50ba1344e7c253d5bf120b279ef73c5114c77465dcef906e7aade437b7ee

    SHA512

    d7f9939086691f892d82cdd9dc169db1cc61b19948987b823384ddea131ad8fd6841a769b32cfe62e7eaaf31d6004626e918911e0eb09d714a429fa21bf5f7e5

  • C:\Program Files\7-Zip\7zFM.exe
    Filesize

    1.5MB

    MD5

    b32e8596ba4ece667ce47f1c7dcb6e2f

    SHA1

    79bf9d37a3a0fcecf6820bc792cf930505880bd2

    SHA256

    fd10a0d54a478dad474af58e2ffb53e0942d1fc53c08df78974eced67a7c03e1

    SHA512

    826135a70feb622b88ef89c9cd9fb5653d2e017c12f69153e4adb7253a49af33bfc02ae06e9e341c0c023135ed5b0ec499f57e30ec11433c5cef1da30ee4b03a

  • C:\Program Files\7-Zip\7zG.exe
    Filesize

    1.2MB

    MD5

    fcfe279bf3241215b22c6c8680634cf2

    SHA1

    ce8a91b70849d6cbf94da549ac4a017641d753aa

    SHA256

    ee4604af97db776b95f9d52506b2dffa24dcbf665d96b0b9d7784872795268e2

    SHA512

    e49079f29f8c8adbd10a691a2f8b825434d70ea0d0c6817d5e901e28782a88dba17b03cbc71858ff38a5007990ddc3408a0e854f4a2923dbcd1ca1ea9b89eae8

  • C:\Program Files\7-Zip\Uninstall.exe
    Filesize

    582KB

    MD5

    01b841c82803362ef64b23e96a5f1573

    SHA1

    ace4c3944ed23d067b2c5530dad7cf55205c1aa4

    SHA256

    8feab839e4962c627bc805fb8d58c75beb91dd08cf2721375656fac6b0e96014

    SHA512

    fed0ddf6bdc9f90ce2584ef481ddbd98b0c3fdc7774c421f4078e8d72db35ee36dd0320fbf7a845e0144b31083146e90860f1b45a4e9a32f002b88a3e873dc60

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
    Filesize

    840KB

    MD5

    0f493aafb21bc70e967d873f323f0d42

    SHA1

    8a1a25afa7d7c2b444ea47443eef0991c1526ea0

    SHA256

    e75126b7c23e3118dd841c2ba2e30593f636320e43731e07e2f4dd9eaa0444fb

    SHA512

    72255d687ed7d24c129974118a2b3a12d489a86b1e77a64650d29db674b8456fd03de6e9cf25a2bab5c286424cef1bd67d07d3ffe2a5667253667be5e4bc110d

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
    Filesize

    4.6MB

    MD5

    d2cc481db1aa531c1ff69a17cc6fd68c

    SHA1

    b8d1aa425e75989559d0925670255f90b1b05232

    SHA256

    81e96e6de290d1bcc52075fb666c28151e5606e20dbf988fe2c1d4dcaca39c89

    SHA512

    844888c55cd54f75b1b2225178d0f1926f9b03dd17a895a65bd13c1c8bf3fb7bf68f91115cfd14a899ab4136a2e18d5c9cc8de00a617b113197ced05c682c33a

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
    Filesize

    910KB

    MD5

    2aaa869fc8021351d8a3e4c95c2f7fd5

    SHA1

    39ab9218461a1eecc7837a58e8edb8356c67ed9c

    SHA256

    04914f4e57f834bcb34105fc98f337f2340925ac038d05760a61e12a7941c1ec

    SHA512

    0ae6da64677b3e518c778006addde623d915ca122b4f15904ab8a1bf0af98d3ce7f9db2ad07c15d8bdd333ed7246f4fcdde285e41f10b2ac0537371f0f0db6d3

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
    Filesize

    24.0MB

    MD5

    8a0bdf76e89fde2feb3a80fbda90aa65

    SHA1

    ed8e9c24a20a1428d2cb52c7128367633e56df0b

    SHA256

    146b59dabadaa8bb55ccacd4f714b906c8fb1ffa0b50eff2eba69742b5ff8710

    SHA512

    5a166473608d5dacbe0f60bbb27c4eb163c3b8a50b7298918fcc62794a6eb983cc91d88d8734d410a8a587d2f1bbca83bee868d0d5a71339e221d61701d7076b

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
    Filesize

    2.7MB

    MD5

    477273f8bce22f0ea39720df79f90d16

    SHA1

    393c6fd05ab04fd0568950fbbb13603e6e28365b

    SHA256

    5addbcd1888c7d0449c3d1db17f21142c54a6894b6135804d883be818ee503d1

    SHA512

    38802b093d6d6d35911d3e2a197cf4748d659afeafa0329f473666876fab4807efd5ddc76cfd17b3c12f6e28f6c558cc20e09db92c64317fccf114a93592084a

  • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
    Filesize

    1.1MB

    MD5

    4fd5f9adabc3e2d29656f675a769bbfb

    SHA1

    70e21e71e82e6526e909029c6e7474d07196d2c6

    SHA256

    6d334c7860e2c41039f562fcf3643aa7c2fcf7019af9725ff0e915fbff703f49

    SHA512

    e80513b218c5d64ab24d807831d419194f24a80fca60de5c8f4aa26a7faa2b8f4e749cb9992e89fa1d812cb2d9bd2feba892ae289db71ec8f6da0979f65bca9f

  • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
    Filesize

    805KB

    MD5

    2944ca0eb513580e35a6e58262b9636c

    SHA1

    f2de67f992c005edba1d4e5a633006ca6c127684

    SHA256

    2dba81c2ccca82e44f70811c785f67794ccdf0f5c312c999a7f1f9b9447ce423

    SHA512

    cbc25ab3c29c850512cf735034467bce7aad158996ad430cb27a303816e8152ebe8ca1715eaa22993ef3b9fdfe88bf4170b3cb3c06ffd6b1aa4cbd9a52539e8b

  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
    Filesize

    656KB

    MD5

    ba335c39a548cd51e4863d686f227169

    SHA1

    8dfa275829daf8a3dc162ff5c2171aa9834638f5

    SHA256

    63551215850e6fb634a083a180bca03d88927bb3bc3eaaead57dccc812229275

    SHA512

    7f5b96488fd9c004073c0a9aeef4c8d30c30de4f416368b763d789abc9a62efe23a8b32412e81ebf991f0d36f08aec2a98973c80393e0cbae68f067691984520

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    Filesize

    5.4MB

    MD5

    8c14bc869b5d6186c945d121fb1ba298

    SHA1

    78afe4da489162004310dac6792f2b1cb2ff9192

    SHA256

    723a530c8129abcea591b7787689fd0f4d8bbf1df28b225b62dee60e708a7d98

    SHA512

    ffe2ec07956a82daed79538a9f1f252d61c4675fe3c419a8fe5108cb35559f5e6103243978452211545c9beff5910fca6d0a965ba4db0ecfd0dd12fca7f7de9c

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
    Filesize

    5.4MB

    MD5

    b01fbabe5db82b6d50fa6ec8dc3638c8

    SHA1

    524a4475f9e2aa6f9ca6c12f2d47674faf23c3bf

    SHA256

    86ad6aee3c5515e3d791aa73f2230b2a1694d96da0c8d2c550dba9b1ec7a70c9

    SHA512

    7a0886af41a515adbf6a2bd9841f03333fa6a486292e5f7910248a61c325f8298dd2c43c69e40d529919d41ab0a2948b8eace13a4b9509deb54bf296357daac6

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
    Filesize

    2.0MB

    MD5

    274f9d52074aaa4b6b3cad567486962a

    SHA1

    433afd35cf7d0cb8b3b4666e40c3c6deae503051

    SHA256

    06175de856510f5766911aceafc18034f02655b5da967721aa63efc1b5d4eccd

    SHA512

    47b3adb563b871a58ac6c53a9e592b9348afc7329954328546fc1ba7c30d14b14af5798fc688322c89cd21c90a6e583d28083e50c8f0bbf9cbe1c856a51b18cf

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
    Filesize

    2.2MB

    MD5

    7dd1d4a0f8eab8aac3c838391dcfd7b4

    SHA1

    a75a21c77d6c79bdf9f91ddc4f86cb1f01946fb0

    SHA256

    da3d807683a212170033aa5e90819486b82b43a4a97033bfc94e132d364ba74f

    SHA512

    687a0969581aed6544885fd91c165fad265040b971a7533c1c3f8e9021dfb295d4466d601e14839391a85b899fd007b7fc23bc367795a06d50a60ff3ce4f69d8

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
    Filesize

    1.8MB

    MD5

    7dec90570ea43b1f6e225d4706c727ef

    SHA1

    1522e80a57a9be0e66f2e9b9c63223c3ccca57b5

    SHA256

    d381a1d451c28c0ed620c60f616876066b36d478a23ed06d38d8ab2642ff68d6

    SHA512

    973ef8091d359e2dc34db4ae197c8662dc1b276d057e95b9310b49cb581f77739406a8f3d7c6eed92ed75f9555d68037101a1e1a4e53679665068b61bbdc524c

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
    Filesize

    1.7MB

    MD5

    0c4635cdd7f7a5d95ea55185ecaa4186

    SHA1

    759613af6ec86e926db2058330f7a4cca691515f

    SHA256

    18486d4082b9f94a3feeb4e3ee7c664337ee996e6bd5a92f463cb29e26f3c1b2

    SHA512

    481b528098e2b62ea7c562f70aa9b6b13a5e993e7f30a2386a15818bb5c4efa4d711aabc9dfff7396b28c0ee379676cc149e2bc9af8a95ff3ec0ed82fe43e650

  • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
    Filesize

    581KB

    MD5

    6cda79f985b5d45105781c9d8d8a140c

    SHA1

    43f1e25001c811d8d826dd342c5f5e1dd2ef9371

    SHA256

    2b484278fa6c16f928e0a3b972413e5e75f89763b170187dd8aae6888f0939b4

    SHA512

    2c4b2b0dea8ee6a0acb083a4d8e0349ae07dd92d32e9b96ac90ec2cb4658e107c13bd015da1bce70cd78bfd3d9f1aca69bfe467ac7cfe0b293abde9b0badcf1a

  • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
    Filesize

    581KB

    MD5

    f148d4f6ec96756e71fc28386ffe93a7

    SHA1

    9715e636feb6eabb259daec383c5e3f24d68ba27

    SHA256

    a21387e6206c3c44e1ca57cc4557f5a41b4e9e5f55c1488b0c3f88c7ccd9c92b

    SHA512

    8b16fb0ddb160370405de77c2abf31b3a7e3569c63aa3763d940ed121c736b8f05eb74921afffdeefc82da7a61fe3d89f4c8fe92155be1c6ce29a2f363ea7cde

  • C:\Program Files\Java\jdk-1.8\bin\idlj.exe
    Filesize

    581KB

    MD5

    1167a5d99d28d603d1b17d8a38d709a6

    SHA1

    66aa773ed4e9b57a6d13bd581990eeb1663de66f

    SHA256

    4db70a4d5ff2025ad71f4f174d6fbe95e30111750cf5ffb136d846229333ab57

    SHA512

    456d3a7e4b28bd2e5250048441f5a864d1f465fd959eab105a4add25f38fab47c87c4c15923b6d77a835b6224c43b24954106e2957860cf795a16a6044b2f564

  • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
    Filesize

    601KB

    MD5

    424a972bf7d9694444cc715b860fd577

    SHA1

    1477875b9091cb66dee0334a4c0b3b235858f00f

    SHA256

    ec63e49bd1744fb14889332aba8f45c01e706705ad3157fadc32ee3b855cb278

    SHA512

    2d5893daff996747caaaedd68a46014cf8cfde6a0719bedc8f067a4c3741c2a178de35347b6c3ca6771a526facb42eeae820524296eb24084789cfd9ecc22441

  • C:\Program Files\Java\jdk-1.8\bin\jar.exe
    Filesize

    581KB

    MD5

    9dc925b185d52f71463483d626a21b1b

    SHA1

    bb279a5cf72659ecb3fa0bcf6d9a7740a7a4bff6

    SHA256

    ad9860934a13fe86286f19a1c4bf3941d337ce4de7b2ac8ec17f40b0967388b2

    SHA512

    11d7dbedf4c7f186ea070399cb57eb18f3719d976f2ca2fae41c5384c65322999dca458ada9480aee3cae5cc9165da70e6dcb89ca17452ec15269ddb6b4bce39

  • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
    Filesize

    581KB

    MD5

    60587ad890fa05ff2d00d0832fe4cb71

    SHA1

    9ff948d913ecc3c960954648f1fdc0d23a4bb551

    SHA256

    6100f593b36bddb222dafc175cd58d0d79411e41875e5196f9cb8beb888be0f1

    SHA512

    63a5b4304137e83eb7f2a75c09c8f612b6061d4808ddb53f72c03093c04a9d55ec1eeb0eea4329c1199424e5ea596861673ff101f234a0e722a372ddcbc79545

  • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
    Filesize

    581KB

    MD5

    d2c24231ac31ee4487e08c9378e2409c

    SHA1

    d6745ba1c4ecd8c6efd667c2133151f9c42dc09c

    SHA256

    9d4cfdb77cfe1ebcf079f62bbec44e031c76963a3ca124375f33bdeeaed76633

    SHA512

    4c414c65517af00c81128225420e54bd1c726bf038241055ac7861ad3254cc2354bc90e736a662c852936a14acd0b55f8192ea9790f6f0ed9d94edf7aefd2960

  • C:\Program Files\Java\jdk-1.8\bin\java.exe
    Filesize

    841KB

    MD5

    aeb3bde855bb579bb3d4f0d315bba404

    SHA1

    d5290060d8e46edbf9ba37ef254f811213fb6c6d

    SHA256

    a0cab3dede595fba528cc241cf25e3f3f64045d8e5931e69b8b779af97141b54

    SHA512

    e88be0c659b8c7e622cabec79444d27a0d673336ae8991b1d60240792464c8534562e8cda027ef7a0bab3f72c4f4bb5dba08d2cd6a9c4be02e4a7425730d9462

  • C:\Program Files\Java\jdk-1.8\bin\javac.exe
    Filesize

    581KB

    MD5

    cb99ced8bc27390639787a9ec46c1eb5

    SHA1

    3504b357c0ed0d6ee633026a7df7ea5f8039c8a3

    SHA256

    46c3891a072b871b52da0cfd77adfe9cc04fed9b7a6e7fcf41f8530d65ec5f90

    SHA512

    2e34a3ba776f020630752194fff035e5f4e2c9369ea53292990f6966ca48ff33c5ed7cc5e66279c0737a380df799234d459413953b538eebb5b84069948cf03f

  • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
    Filesize

    581KB

    MD5

    f12d8f4d835d8bf44fe52ff42647e5e0

    SHA1

    7162a590de6657c5656c8c3e64b73673e5dabfd0

    SHA256

    4cf1b64cd4f0284281277413f5b4a395a197a7ecf75e35fa13f9bbe7e86095a4

    SHA512

    90863006f55bc57bdde8bdb814e5f6b9550dbc4416b35e5842e5ebcdbd93f896f07ee258fb9f0fdfb0156b7d9a5ccc537bb5a8b4b3357a9bac183f3bd588ebf4

  • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
    Filesize

    717KB

    MD5

    a653279f83194c7cc25e667d6c3efaef

    SHA1

    a416d5d8a6abb6509387328c5c699679b5326e36

    SHA256

    bf6541eac53b5583685640ebe988b9321a99d7c1e8a5b4b9edea6d56ade5e26b

    SHA512

    50c4c6ac26b09b67b19a45f0c9982f09da7afca5569242741c8216c23c184649d623105539bfa5a539c21441727b6569043aaee64748cd8a433ac4fbe17dcd07

  • C:\Program Files\Java\jdk-1.8\bin\javah.exe
    Filesize

    581KB

    MD5

    38b6a892baa32e007db1b320ff7f9881

    SHA1

    50d9754dada9e385da8b5688294117b3fcbf5bbe

    SHA256

    f1c98739e8564c72cbecafdb99fae94cce2c1608c722f7dde46152bee9ed5f4a

    SHA512

    e12c32ab8ccbdd61969aa60309a628f972146a7f010d049ebcd7a3db6bf7936d6b19f7fc2032408d0ee3bf9d44d338d1feda4b15778a54250e5d3321c39c4321

  • C:\Program Files\Java\jdk-1.8\bin\javap.exe
    Filesize

    581KB

    MD5

    896023d88b043c416d187d4e8be0e19b

    SHA1

    f037732b2768e65de66fea87c597e694c99b7900

    SHA256

    6fa6d1867ecd96854cc11ccbe103b8596b488b98f957c9f79eef1573259d884c

    SHA512

    e0a44814aeab0de0daf16b068677bc62acfcb1f19aad353728df12d4adcfa8c188d7ab227df050062ab853d748e2e144a4d35705f1149b94b8a30599e074a19b

  • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
    Filesize

    717KB

    MD5

    8cd3961570e77619e8b90dd4c29b5411

    SHA1

    1f5c22af9fb4e41579b01e01df26e69069123cd5

    SHA256

    1cb252c9691c24d7e1ff7dc698f24bea4374ced2f2b5c54f737c58dc8f76931a

    SHA512

    ad5d4d67a0e1b95f1e57fab8eedd157d7ea2f7c7d23b4f7e13752cdb8d0c63d8b6dd137df7f81a348973de78f9c2fda6d8cc5c9da56c931efbc6658af7dee864

  • C:\Program Files\Java\jdk-1.8\bin\javaw.exe
    Filesize

    841KB

    MD5

    37e8495390ab209071eefc156e15d9ac

    SHA1

    885a14d93fc56705b3252c247a660d5c76db8d6a

    SHA256

    cfb7a279237c90c819bf5e12826769319f3e13838584f924ad3b1f4a50a49fc2

    SHA512

    37f4d14c6255f8166c56edf8dd1852f424f5149621ac527e9b7b0b8ffe862b346061d101a27499895cb79b303d0c4254a4976a9173e9921086288c403fa16ffb

  • C:\Program Files\Java\jdk-1.8\bin\javaws.exe
    Filesize

    1020KB

    MD5

    a31a9464e0ea2e766f3c843662407101

    SHA1

    89967709bd3fb403d352c79ee05feeb88e73a05f

    SHA256

    cad86869fa6b625faafee5153cd4327f0745cbf26db1591a6ba00014d8d9d8d2

    SHA512

    e8008c6c497b1833cd3c470b88e407ac3a7372ab33265cf3b19f4bc817efba8421c068fb256966c56dc09f4cde145386215beb673a148eeb66f3b5a92f48c64d

  • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
    Filesize

    581KB

    MD5

    67d53181f658eeeccb3f48bac912f4d8

    SHA1

    0918c8657c79abd7619096a4510c7aa338a8f046

    SHA256

    7cfc4ae7593d15dea114a6a3cb2e33d2c0d2f85c2afceef92c3a4798987a8392

    SHA512

    366f8ffe70bd410666b7d98436c5cb7fdcf20a3d848eae31fbcfd749b8285834a76b71c64292be0d931896f86465f56146e671ac6d64da75ed49c7a0d9258a39

  • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
    Filesize

    581KB

    MD5

    fe0e5b4847bdcf063de5f7c673bcd87a

    SHA1

    f8bd93acbde7b4a4797a784897f5052dadf9d7e8

    SHA256

    5851b0d283a2d22bbf54ec37053468ace7d6eaa75f307883bac524015c823a6a

    SHA512

    55f21a391b18d56a209dfd1313e54953ead6569535594da6dec3988986ba05f5e16030a7c25120a1aa0668aff480bf82f0d2f15d35f5f4ee6b5f9be2b3482ea8

  • C:\Program Files\Java\jdk-1.8\bin\jdb.exe
    Filesize

    581KB

    MD5

    5361e2861f4051ec17bf4a95d352c9cd

    SHA1

    8c256e78e5d75c73cb0c3f7f00c5ec3941fd51eb

    SHA256

    583bbc952b95b63b126e86b890c0c8b8c5e9a6c5257ead6d7142273c7e5347a9

    SHA512

    430968a8f1ed0764cc8a030b7bf0c6c3f2d76ebc48f17552733ffd461dda65a4be2b79ea2b62ec9973057f858b4bfd771017f8200636e1e3502923f2b16876a3

  • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
    Filesize

    581KB

    MD5

    734844dcc29f6313223ef1614d14cacb

    SHA1

    597d7f46d83563c1637a69aaa339cd65688c030e

    SHA256

    256b84a6f25505e12fce8558bc462bfe1defd4b1e1d32262a9cffe179d5af463

    SHA512

    697ece93602a60ca8f011098a9828ce9cc18091cbe35be3b7846c97328182836e50abefbdc9d80751b5adf653bb0ea17e20833b96b191774677045a73d67fb0f

  • C:\Program Files\Java\jdk-1.8\bin\jhat.exe
    Filesize

    581KB

    MD5

    135041154c5edc0b75b036699cd2d64e

    SHA1

    e01a09eaefb5883e3a5021a05a1fcd31b0c8d1ea

    SHA256

    7f80f7994ac89afb0aa0ef33aafeb76e4a8a30d9ebdb4558ec13ad4e3ed6f4f7

    SHA512

    f789e9da5adbbd6a9a932c6097b851b47455eb151564519cd9fad21b0fa8949e57c3ad877759f0b81cf36b58efdde33d42847dcf5d8f7cf20a087003457a5338

  • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
    Filesize

    581KB

    MD5

    d8d03a2c82bc6f0d5a431e55af41aa74

    SHA1

    764e5cded1bbef4657250e03a24c9829b7809c45

    SHA256

    1268d66bff76acf6618e13c7b12a68a1b14e228f1d4a25312fc18a5aa468b1d3

    SHA512

    3bb6db61495499f3a677f3649620bd4957ad9d25e82d8574bb083cf351553890e6d280ba82459f7a3e3c7906a9d7f94b766b7aafc8585908128e2932fd427ae3

  • C:\Program Files\Java\jdk-1.8\bin\jjs.exe
    Filesize

    581KB

    MD5

    d171b4f8a381d9106cd0f66c92b52c1c

    SHA1

    6264c430e2c7bdd87b16a2a11747ce94c5181f5e

    SHA256

    3b5f7aeaa169c2eca719e03dbed32971c1c652f67b6852ed03c854f32daf31ad

    SHA512

    1ccc38c52f3cd8eb702f9e5deb7cbdd5c1c749116efda449ce690607b855994b88fc56312afde7674221a9d65752856543aaaef262e9d01aca4199b522852f7d

  • C:\Program Files\Java\jdk-1.8\bin\jmap.exe
    Filesize

    581KB

    MD5

    38cee2a5761a28cb9b9d1ca39c3735b4

    SHA1

    b0bcddf1ee944a491e77f4de1eb60374aa9d3177

    SHA256

    003d10deca6a923a3509b7057dfac14ca384788e33e26c9458bf5ed6053f9373

    SHA512

    2057d1654f4f3f204c7eba5458ac64f214e9657b806c7c982087134644c2cd2d6922d6e03af0529c75b0343d4f3cb1c056490e2190de6a377f89f586307e7567

  • C:\Program Files\Java\jdk-1.8\bin\jps.exe
    Filesize

    581KB

    MD5

    f0e74405370cc5deef7f27fe143c67c7

    SHA1

    e57daf3c95a22cd031307028bc0735d4772abd7c

    SHA256

    a888369be857c6781429c1f94d85ca049cd92348849ab31b03168e5e5e9296ee

    SHA512

    53106685403aba4f4a288453ea396c8b1d640f7621fe36f1da983264b2c7689cd81cea8b1c7652ed59d53e52ec2c10929e1102fd259f8d45586b8caa7325f6ce

  • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
    Filesize

    581KB

    MD5

    b20d66f84673736733c272522a759c7e

    SHA1

    5ff69c6b165a7d29c62cd264e1a272f3e89740a3

    SHA256

    d3385c77aa035919f8cd00e1b9d8ce0f4c463485113f308394084f6905fb651d

    SHA512

    d639e6c51e256e5196812d2f35e03ff0e2da1fcb220ba1af59f5b0c6b58ed7ae991327810a5a16246ce26a8c99859ea37f95dfa498fb22e5bda4ad28ad0654ec

  • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
    Filesize

    581KB

    MD5

    9023743e641731b4a269fa13522e3fb4

    SHA1

    1a1a0fe3ac2a55f4706696cfd2b9af1e1b79da7d

    SHA256

    aeb7eee260997f19cadf06f658ed227481ea7d0be06b276afc7a25cd376bd26f

    SHA512

    0cec04a6d4b12c6672806f0a8d606e4a4263de4451dd26c5ba6299ccd81c1783d1b1c94c69e9281fef9004bd0779d7af7318edf39697623187a4a8539860337c

  • C:\Program Files\Java\jdk-1.8\bin\jstack.exe
    Filesize

    581KB

    MD5

    b38ef86b9beeac5066d91934a76c1a44

    SHA1

    2dedf670605b6e8c5df9ac3df646db2f89321c2d

    SHA256

    3c4c34e932a6a0934578bc392192219590c36b87671aa679a9256a8a2a79ef1d

    SHA512

    2664e200e2b6efdc0b9b7a56ba89cabf57cba24875b70b239be1cec213bc9b8409f036ac6b98f54f1909f1433a6eb75fd3c2fdb9579499333f12a0608bffb006

  • C:\Program Files\Java\jdk-1.8\bin\jstat.exe
    Filesize

    581KB

    MD5

    b6082b5bcae70456dfa2dc05cf2f74da

    SHA1

    14bfa5caadf323f3e4983b8b9ca6893ce2a5f5e1

    SHA256

    c28fa43ad5e2343999b9974f9c3a4582a76157520aaa0660a52df28a40e202bb

    SHA512

    1d8d3778468bc7382e7568547aae6a509b5c7ff2eb12facc15df19fc3233c6777b69202b48c603a833bfcd10bf90bc93f79c5153d87b16961e4bfaf3da3e22bf

  • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
    Filesize

    581KB

    MD5

    bca61ea054245564d8c64951bfd67123

    SHA1

    66859e08952d9ea58736a1b1e27387c88dc5caf5

    SHA256

    2faa2c75f23ff27fbc05d4bcc9a776c76d7385fc30c62344e9195dd84d9b2d76

    SHA512

    9b3e29e75219ad67833e1b4bb9d54a13006cf7159f8b2722f6774f7ee7639919d238abf3fdd724c6c7bb953f0370ddf34e976ad44b198ae737940214f58010a5

  • C:\Program Files\Java\jdk-1.8\bin\keytool.exe
    Filesize

    581KB

    MD5

    3515c5e93a0b84db9609c80583350f45

    SHA1

    c89546e663575d4d3a2dde5d3af2cbff77469686

    SHA256

    c83767a57e2da560e87b23dc65329f28870e8233661a123fa61523b7311f0a90

    SHA512

    76a2236ee0ab1f2ba69a86f0b3c39405d51fad8aed5a86906b71bffbbf0cfaa39633332104690dc0434416598ac8f0c40b7a0003f14ac3bc82e37e0c952b6f05

  • C:\Program Files\Java\jdk-1.8\bin\kinit.exe
    Filesize

    581KB

    MD5

    74495f82333dd1557cf6b7c6863a9c21

    SHA1

    c1cc9b6a6df8a7147337750892f29d47126ed546

    SHA256

    3b67f01870d79bb019dffb21bbe00f56be02775e984386919cbf9131fe0e4a6e

    SHA512

    5a7e546916e6adac02f758900d3e73d20c65b7a0374e6c646f2454802d16fb26588a9dfbcae1a9dad6da49ab82e43c9726483714526fc227b07bd319c9fcec2d

  • C:\Program Files\Java\jdk-1.8\bin\klist.exe
    Filesize

    581KB

    MD5

    408a55d3d6f36a77bfdcba95b64522fc

    SHA1

    4b919a89c3fd208c81c10df9e55388ba619f5ad8

    SHA256

    b7f478d353558851d833d4a66ca9371a88c056aacff7c99f1baa3c1d08631869

    SHA512

    aa2d378647baa2044dee2007513265dc32a8531998c60cc0fe2c8a385e5be5e8a7b6e22dd22e8607dc1b43790cfcae9e76933d461bb0cf294128935aefe530d4

  • C:\Program Files\Java\jdk-1.8\bin\ktab.exe
    Filesize

    581KB

    MD5

    d68eef6663f1c8369f34f6a0cc4499f4

    SHA1

    0cf115c82a1b9448646834e7eba81dd2d3e82bb0

    SHA256

    54af82a2fe47de596ace58ac9ee1dae3db306dca9d9c7c79d3c2d118ad4bec88

    SHA512

    0566d705fd37a167ac9b1ffc98c0d450d73a700b5397d455b305ad39ad81ed6787f0b4e598655bd9589973905219694866368f3f8cc8d5c9d36d4aa424a1ca7e

  • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
    Filesize

    581KB

    MD5

    f90e2080c0ee8877e8cd0cf859d2f830

    SHA1

    0d60ca5e56f01c27c67c27dd13ee43280729a59b

    SHA256

    5fde87de514f277503952ddc75ee80d389617b98b483726211be43f218114f41

    SHA512

    ab6f5c9c2017b1ec135210cf5904a8105d4f64dd5dd3d3caed56518761a24dbdaf6df5451c0ffc3e28bc1dca768e01a889a56684a78c6d9accc5d6b850acd1b7

  • C:\Program Files\Java\jdk-1.8\bin\orbd.exe
    Filesize

    581KB

    MD5

    87fe7100293f556864a9e245e558dfb9

    SHA1

    443f5bc8519a635c230e33a67f48a0c5bc1b4108

    SHA256

    d961a38c40e876375884c6cbc0fb79c718b1cddbc5eaa696a0e51c38163389a5

    SHA512

    5ac02b724cef4beff93b3d76581484d5db4fd9e855320206d26e02c0278f8f60b8805e8c8d161f8eb30f318ecbb866cdf5bc94a411f04675ae345d2216a7c74d

  • C:\Program Files\Java\jdk-1.8\bin\pack200.exe
    Filesize

    581KB

    MD5

    7aee97f371247ad9a5cf7627524d071a

    SHA1

    6cffc04a0f421b4d13a60bf21c1a8ee4a49e92cb

    SHA256

    bd813257269db6ea2c1c6f78bec56cbd500f6ea146cfd9b7ed606cf4386015c1

    SHA512

    417a866a7c4c56f574dad642939cc7cf822b2e46dc8bdd3497c3cda3aaee212f4264f4b799dd172c52ee074890b8bd56e050d4dedc31d23ca0da0a13191cf0d4

  • C:\Program Files\Java\jdk-1.8\bin\policytool.exe
    Filesize

    581KB

    MD5

    42e7db62fe89dab2cda9171fcb464c38

    SHA1

    bff517318d0936ee0d97e4ef46c78ae19df4e0cc

    SHA256

    05fc98d33215e9c33d3f60622c3e1193841b0e910f5b97bc04fe9ae751d0d329

    SHA512

    4608558caf8766d035f74496ce89510ea89ddbc5ad10677ed59e5cd834e2abce4d62c77f0b7817af1f49b515be7c1b23035ed9d67fd84998de17c623fce88df1

  • C:\Program Files\Java\jdk-1.8\bin\rmic.exe
    Filesize

    581KB

    MD5

    10b2b50609d46d83af8218622b97d31c

    SHA1

    94293dbae05591588bec774b288b8a24e678d518

    SHA256

    ebd5a1798b9d97dafd1aa2f316d9d396650f20cdcbd04929be4cdc1edf9144a2

    SHA512

    c7c09e5d7eae69a0e3219102cfa15ae23f2bb954eb3ede3a97b1b95ab42517439a95913bae058672d766f62d30a4a2c30fa1c33b5c07a7bfa1d9db39623ac2d6

  • C:\Program Files\dotnet\dotnet.exe
    Filesize

    701KB

    MD5

    8a22c5e4dd148f17834249ba28c90d65

    SHA1

    8640ccad247d45464788bb200504af9f51bdf925

    SHA256

    e6008b08db9aa542c706871a75fb63fa88a98d9365584df766a530f9d85b7053

    SHA512

    cf4f39e490de46bd59e9ad9d0146f1ddb26021f3337946754aef90f9b306aabaf719a2cc5404df32fcc247a91d904ecc8519711b3a3c73d6559c363180c43659

  • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    Filesize

    659KB

    MD5

    ce9e669970189a7f32aec8ea278f3aa5

    SHA1

    cb2cd505ed1032f044e1dccc01d0648464317d5d

    SHA256

    bd6840a0f56eae83c2a1bf804db8395f19cb0e0f8689f8513c7f8a747c1dce58

    SHA512

    8d064f9e844263b873fd30532c7bc4b750aa9bbb10fe9d57c01af6e23551b0297b65fedf63b7ec6b39b1cfe512fecf6196910df23a8ba64a7e523e31210c6167

  • C:\Windows\System32\alg.exe
    Filesize

    661KB

    MD5

    1842e89df01363014c2a9b78a79b799d

    SHA1

    642614864f2069f43b25ae842c3e25ca6bce07aa

    SHA256

    ee58d4d1f0afa4ac7106b592ffff13c8d24f79ed173bd61429ef462da65185e6

    SHA512

    d87407928929bc079d533c4978aab84288502de1207f4171e4929b1f6a081cf24448df4c229f2b26ba19e04567154d9d67462a262f1d0ac96a3e9a90968fb737

  • C:\Windows\system32\AppVClient.exe
    Filesize

    1.3MB

    MD5

    4a748c1ae15bb661d0a241735d9a9141

    SHA1

    2402762baf81f48b8974334035f862596d9244df

    SHA256

    3f0b759324b91168b9ca4198fe4d44917e1d6b2dd16e604edef3adc053141330

    SHA512

    7b05b6b2e296e74216d1af0c851682aec5e755c024eca66963a7a4a97a22421695e2c47391ea54fd00492ed25f69689cb8eb54d63e25c9476ef42a0955813dcd

  • memory/2168-248-0x0000000140000000-0x000000014024B000-memory.dmp
    Filesize

    2.3MB

  • memory/2168-41-0x0000000000850000-0x00000000008B0000-memory.dmp
    Filesize

    384KB

  • memory/2168-50-0x0000000000850000-0x00000000008B0000-memory.dmp
    Filesize

    384KB

  • memory/2168-49-0x0000000140000000-0x000000014024B000-memory.dmp
    Filesize

    2.3MB

  • memory/2448-249-0x0000000140000000-0x000000014022B000-memory.dmp
    Filesize

    2.2MB

  • memory/2448-53-0x00000000001A0000-0x0000000000200000-memory.dmp
    Filesize

    384KB

  • memory/2448-61-0x0000000140000000-0x000000014022B000-memory.dmp
    Filesize

    2.2MB

  • memory/2448-59-0x00000000001A0000-0x0000000000200000-memory.dmp
    Filesize

    384KB

  • memory/3104-247-0x0000000140000000-0x00000001400A9000-memory.dmp
    Filesize

    676KB

  • memory/3104-32-0x00000000006D0000-0x0000000000730000-memory.dmp
    Filesize

    384KB

  • memory/3104-25-0x00000000006D0000-0x0000000000730000-memory.dmp
    Filesize

    384KB

  • memory/3104-31-0x0000000140000000-0x00000001400A9000-memory.dmp
    Filesize

    676KB

  • memory/3104-33-0x00000000006D0000-0x0000000000730000-memory.dmp
    Filesize

    384KB

  • memory/3140-75-0x0000000002250000-0x00000000022B0000-memory.dmp
    Filesize

    384KB

  • memory/3140-77-0x0000000140000000-0x00000001400CF000-memory.dmp
    Filesize

    828KB

  • memory/3140-64-0x0000000140000000-0x00000001400CF000-memory.dmp
    Filesize

    828KB

  • memory/3140-65-0x0000000002250000-0x00000000022B0000-memory.dmp
    Filesize

    384KB

  • memory/3140-71-0x0000000002250000-0x00000000022B0000-memory.dmp
    Filesize

    384KB

  • memory/4016-6-0x00000000021F0000-0x0000000002257000-memory.dmp
    Filesize

    412KB

  • memory/4016-38-0x0000000000400000-0x00000000004B0000-memory.dmp
    Filesize

    704KB

  • memory/4016-1-0x00000000021F0000-0x0000000002257000-memory.dmp
    Filesize

    412KB

  • memory/4016-0-0x0000000000400000-0x00000000004B0000-memory.dmp
    Filesize

    704KB

  • memory/4732-19-0x0000000140000000-0x00000001400AA000-memory.dmp
    Filesize

    680KB

  • memory/4732-20-0x0000000000720000-0x0000000000780000-memory.dmp
    Filesize

    384KB

  • memory/4732-246-0x0000000140000000-0x00000001400AA000-memory.dmp
    Filesize

    680KB

  • memory/4732-11-0x0000000000720000-0x0000000000780000-memory.dmp
    Filesize

    384KB

  • memory/4792-87-0x0000000140000000-0x00000001400CF000-memory.dmp
    Filesize

    828KB

  • memory/4792-79-0x00000000007C0000-0x0000000000820000-memory.dmp
    Filesize

    384KB

  • memory/4792-85-0x00000000007C0000-0x0000000000820000-memory.dmp
    Filesize

    384KB