Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 17:38

General

  • Target

    2024-05-24_e07370a8c77f48ece0fc86d987d53319_bkransomware_karagany.exe

  • Size

    677KB

  • MD5

    e07370a8c77f48ece0fc86d987d53319

  • SHA1

    a3b42cd83e55b2196931b3bdae5358cf20052107

  • SHA256

    4f41c95b11bbee85fd6a64fd5e80b8d4ba1cfe868d5207fba7c23c3896ebb2f0

  • SHA512

    0f724422c9efed842d20c363753a0d6b04c295569d7bac4dbbb0bb4f13bebea20c33374442a3b2880f4a2e4d2c2b51e60fa691c7432e2a293582c5fbb60df780

  • SSDEEP

    12288:UvXk1+fFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:gk1+f8NDFKYmKOF0zr31JwAlcR3QC0O3

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-24_e07370a8c77f48ece0fc86d987d53319_bkransomware_karagany.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-24_e07370a8c77f48ece0fc86d987d53319_bkransomware_karagany.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1396
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1900
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5032
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:392
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2592
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4272
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:772
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:1940
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:5024

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      Filesize

      2.1MB

      MD5

      edd54f5256268d5b68a67e8294dab254

      SHA1

      e6a02e4e8ceebe2512ee30acf1e3f78921433053

      SHA256

      4c55d51c48c74019e0009402679914445ecd27d5f03d1e78d06bed749ff6916a

      SHA512

      20f059c647df9c55c71d93dbbdb16a0577cc95af6793f38a896d43fba39ae3844c36dd5c91f8e6b3d9aa9505183b6456406241621d5a317734d285cef9981ddc

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      Filesize

      797KB

      MD5

      06d81b17490492db84bd3013354cecba

      SHA1

      10a8ff59dc00859f465affcc0f693c9cd59a78f4

      SHA256

      052a5f17e85799600c4646087227d290867e1f51bbbc3c3596840944e1c09692

      SHA512

      4c0b729950fd3b87a101439202ae885aca3ae4b5f3b15183d9bb4551a6ec20624eb9dbc3d91e5d882aaaea2291063d63bcbeca1175d68f251659252f85166307

    • C:\Program Files\7-Zip\7z.exe
      Filesize

      1.1MB

      MD5

      ac5b656cf3fd11768449519f1a98f87f

      SHA1

      8c59f6b48fba2c582d41e3ecd5254d311e7378d1

      SHA256

      96dbce4fd6e86c856b6a389cf4d53c006819df083bc8e8f3960d485c5e7b6c73

      SHA512

      9f5bae605b7fea13617305e0ae1c07af730ed8e216306dfac940207853f4512ab2557b11fe328c3bcf9ad3080011562a410530e722b4515d1c96ef90d197304f

    • C:\Program Files\7-Zip\7zFM.exe
      Filesize

      1.5MB

      MD5

      1039d05f30df5298aa3eb72a67cf2da8

      SHA1

      0c1688c0518357ead17cc12396d909778a1e711c

      SHA256

      538d5a06ef6ab03c03b59971a53c58598b35df6cdbeb9acab3c23fe08c8feee0

      SHA512

      289db5ec552af25286bbefe8e5f2105d6d8846d237594bfd0e78cc71f7cd01c1861797089816eef5cf694587ebe4c32c7f45d6979b9eca7efc5eb8a34438cd83

    • C:\Program Files\7-Zip\7zG.exe
      Filesize

      1.2MB

      MD5

      c3d84e39119145ed90ed1f8933181a8e

      SHA1

      975345f5d6323ef821a4b9edcb520f0eb9e036b6

      SHA256

      67a31e65f2340cab6fb039c1bb2a47733a8df3f99a05c987038323302ac5d1d8

      SHA512

      584333881dfec8564d5a69ce13ed757d5fd4386d3b3876314f714cd3103e4e3b7c6dab9e90d8f71331630308e0ec7cce3f946b6db2cb845799cf8956263758df

    • C:\Program Files\7-Zip\Uninstall.exe
      Filesize

      582KB

      MD5

      56b6101711353cfe3b78b9ab6d6c83fa

      SHA1

      4121095b239b6c34dd636e1dfd1f0d8bbedf3ef1

      SHA256

      7e4207be3269798a3cb0b92eb0ae83841ada7c2d85a91e80f971efcde99fb86e

      SHA512

      3862c5dcda8776c2701cf957aa6e97720146e12a7ebccc975e3e56aa807ca68faa9d2016ab73bcc8ac03817133e52233e937e4c591dc7b77dec3d7828053c356

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
      Filesize

      840KB

      MD5

      64f2945faf455b13a25f87e57a1b46d3

      SHA1

      8b4de23f30be9920538aa69f5422714800a3945d

      SHA256

      af8ec7473cbe486a6999b180e0845c9396e8a504c54a9c331ab80bce7e98dca3

      SHA512

      cde33dd3f5dd6fe64188a96a0d7900bd4cb41bbe02caf31f6bc0c0e79d160f9c230c51764f7f2cf73b16fb6938c75504be29e8dea608458bcccbf51e8c303eb2

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
      Filesize

      4.6MB

      MD5

      4aac6705e6cdc2de30de5064451fe20d

      SHA1

      feebd9e7075e36655be1297731c4bcb27840d6a2

      SHA256

      c6c1a76a8e6eb2bd702ca4c4e5343303e7fb48f2abed1ac3051e3c6d7defe305

      SHA512

      66453188a8327823380b2f6e191220567239a5268a22a8d1206a61435167e79443453845667a0bc7a98a5177b4681f9080cacda5b2efb11a2fdf5ed0ed688079

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
      Filesize

      910KB

      MD5

      a10d32748af1a2d07b0eb73fd3693bfe

      SHA1

      aa43b7ee779764b388fb55a376d8edc6483a9b8a

      SHA256

      b5097821fd00dc51d8ce28aacc6fa90d630cb4c0252766f268229cc2e75328ce

      SHA512

      35d25592368e524208a66b0956ae9bf4ad423f9d1d81d3c15167b0434b80c64c01c2fa174e8dbd0d1b305df9e6e021b060091c61760d345fb01e408e8e40aab8

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
      Filesize

      24.0MB

      MD5

      1638d012fbaa72afa7a5fa1d3ff67092

      SHA1

      29de3b9e9c457ca1d1ddc0516e2008e2f14586f6

      SHA256

      3058331c0c512b70c466c6d9c0f3257a916d51be853f0dbd8cbbc17a1b4d6264

      SHA512

      0edf77bdbf12af68598769a2dd9c72f00bbeb36265e954dada5fbb4f3f2d3ce4407fef78503373ed8a5a7c5a45cc277658c0290d54e1779189c7f77cb9c11be7

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
      Filesize

      2.7MB

      MD5

      1adcc77c56e9d2410d86aa5598d33141

      SHA1

      cb5bad99cc1fccc2f73ccb94b602ba2f68bcefa2

      SHA256

      3f370c956b95c4f7ef4acccd1545b75ef194bf85a0b2bb344493fa72e6721a56

      SHA512

      e93568aa5c07ebe1a25fe0d571db7da63dbaa645acefed81464a41ecacb3162eb90bea80bb647b2190a477d8980be092b225e0c5d333f5168fd8fc77c4a0a651

    • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
      Filesize

      1.1MB

      MD5

      1943a9128e9c053018655c1a9b1dbe7d

      SHA1

      b2c0eed57e7ac1038ce38e5499ff096f46b47075

      SHA256

      27732cee2b0559db55fd603852137021d667a931fbab83963c7ea36207d928eb

      SHA512

      b6a299cc067fc7edce98328bb0376061c609473fe88b3301a5685f1f1029ae7ea92cd96e665243a848ae1d23d661cb9123e4d784e04b8e2d1ebfb72a497be2f3

    • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
      Filesize

      805KB

      MD5

      db5a966c57c5dac43bb02fc5aae095e3

      SHA1

      64b1ade44dfe1ee6b56acd7651e260ea0f0bf14c

      SHA256

      aa4679f938dabd18134b8a8886ee793042ca8f393a91353ef4d6453d7acd89bd

      SHA512

      3d52f0e21c3c596558c0a15040642a00058f1dbfbd17bf89e410efb2ed82799e8143c8935ba8172df72959233a937deb0ff6eebb60fe6371cb8d12ae359b92d6

    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
      Filesize

      656KB

      MD5

      53f58894d1def209e38ed7cdf80e4533

      SHA1

      a6dde0a0bdec896a3b3d1955ed5865a73b85a101

      SHA256

      ba365a29a0faaf0bed9c0512cdf20ac325fb2f1ba0e356f10fb66e129ce7afd6

      SHA512

      92d3c937c08bec99c8022f495bd364b52e02a3c5d2d4eac9338807ac097c55c97e9c0360dcb91a5a6dff5234aa2b0896f1836a6b7e0dbd0b6df8c67a8dcefff4

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      Filesize

      5.4MB

      MD5

      bb6edd75cde7abde223237b3afd86fce

      SHA1

      507e90da1db6db79c68c6fde3ba3400ed1be6a79

      SHA256

      920b16f6cb14e5ba6862d29366b73462047aa12ec1afb5a5fa65a43f6a4d6d43

      SHA512

      b95875e1a0205269352bd829dc78adb928cd99280a4a2d1bab68c11a149b8a8878dc8f28cb127517b9513924bcb54447a83099e7b12d684162ab5d5f785ffdc8

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
      Filesize

      5.4MB

      MD5

      c306e25b51e6f676a4689e7d1cc36682

      SHA1

      8395810eb4511faa443de6a35756974ea290ec25

      SHA256

      f2d379adb965d9fb8827f944daf171ac30673b7da6ff803f6db3388732c61694

      SHA512

      8b41928b5782730a9f5febaba55acd3f0e96eff717c0819a0e9f84a6a4d1067fb1ee0640dcf053721d2ba9bdbf26bac01c301af0a49e3a27408b81964504149c

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
      Filesize

      2.0MB

      MD5

      58f64fe2816bbbae880deab91625f1f4

      SHA1

      ffaa6f4721a85d8dd331c62686e6df17b851c93a

      SHA256

      27ddfc1338b101198afd05babd86a37871e7904ecfdb29dacbcebb4e66b10c37

      SHA512

      d6a9ea411279d7e346acb2e5eb0f1b6dde5e4bdcc9e88e9d53bc8c1af812dee741e49171bbbbabc6d205360c52dd63c6c708d9ec49c64f848587f28ad62b0d22

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      Filesize

      2.2MB

      MD5

      9ec83b19e34dc763930adff568e2bf31

      SHA1

      d487b2b5b8b4992abf93db714f815f11ffbb22ec

      SHA256

      c72f4d2e5946d5bc246aefd0c65103dbfd2b2deb0079d616fca224652255174b

      SHA512

      868e43b0c30020ec4841754b63bdab091db66650ed1b34f263b311db172244d9aa2d8394ec2600c93cb1d7d2a951e9fcdf86ad9a2806163864e850aee564b3ff

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
      Filesize

      1.8MB

      MD5

      981664391a9b0e58b2604a19afa75526

      SHA1

      cda9ae3b58cfbca65369181881afcd6544ea6fea

      SHA256

      cda2f6155b7ad970162fae62b577aa37a70a5c46c8bf43f8b98b244c7673faf2

      SHA512

      82476aea2b770b94c991adb7a5afd2cbf312e2cbc13be550617c48d10c76a1e6b73faa6509b5e784c981fbfb86a46054b8357552d89313f52955ec955c31cec3

    • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
      Filesize

      1.7MB

      MD5

      015f9cfc699db06b996c202764638674

      SHA1

      43ca86d1f0f6248ea4d5888adba3f4fe189aa6ff

      SHA256

      dc6372cc16a561a87561bf51f067199b0bc9cd3cf059614a09cf501613db7b90

      SHA512

      a5087490ba6b588cbe31b919ec0014a1025c21178c248007f0788abcb64a1f9699c7b08c9bcfb6900c7dd19fa068288bb757852ccb172339366e5d522f4e8b96

    • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
      Filesize

      581KB

      MD5

      35522760f24c7134242e707738a7c558

      SHA1

      8c13c4cd43d31120fb74fc6d566b06f0dd9854c2

      SHA256

      f03a39b2b56e07f37651d396187af81afd8c7cc5742b4cc6f6db41b2c185796c

      SHA512

      e51221ac63568e4bdcfd8d78b329de8ee7c8afc64f26d3d1bf75bb963c2efdc65ca1345afd62bcc8cd1cbe054c2aedf5459fff9916a37aa02404007a76198c4c

    • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
      Filesize

      581KB

      MD5

      bcc78cbb21680e2cdf69e1fb7ff12807

      SHA1

      aecfa55030c269416cbbb54947c7ce4316c587bd

      SHA256

      30ca2a532c8d2cf68fa9503abc9ee8aac1e4a3e9c483907e98d3ae4c06ad7c2f

      SHA512

      d7a3ddb7b2114ad5244b2b1535719014ff31ac9cf8ca3a69263166c8fd086ff25a999f2b5764bae635e875c4ce1b1d53e7f269337af9210a8f60c10caf529635

    • C:\Program Files\Java\jdk-1.8\bin\idlj.exe
      Filesize

      581KB

      MD5

      8cb842be5c022b4badaa01bfcaf14911

      SHA1

      a749f1953d728fddca7cdcffb13f0a137d11e565

      SHA256

      d588c6aab42dcffd0f291b59c09a8d03e6496123aefda1d2470e9bc6b4bbb2d7

      SHA512

      3d7de8b777b43234c0a6e4782f63f481790dd5ea71d269f3686235f5bc44e5fcbf68d4f47e6f4dbdba27939e75f9a2a4768d958472c100ce238beb16ec0e7c0e

    • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
      Filesize

      601KB

      MD5

      789ffa3a5467ef41f2c6d40c45cbac14

      SHA1

      1540e46fad948fa89bc207c8c343bd20635b953b

      SHA256

      680c3884648c552f4ac8a214aea2a3dac41900b09fd3fcbece7bfa305b6d01da

      SHA512

      2a0ddccf74428de6c012e7ca9894dc44c874fb229655418c388d401f342826c4158dbd01d837afa54316b267abcf18d6be1ae0dc3397d12b6e9c29a602d456e5

    • C:\Program Files\Java\jdk-1.8\bin\jar.exe
      Filesize

      581KB

      MD5

      865ab87b85f00d1e75127224ad46415b

      SHA1

      77d6e92b8857f4e63bad4bf2d9f1660e25168108

      SHA256

      53f473f45a8fb6d7a52d206c4f300dec1b1e01a5375e493a8b66e64a69d50398

      SHA512

      eb96dfe02c0bfd3ec18dda2f8679ea239b0096b2614ca1b8c341316d9b978948abf4090bd89d44b24e104d9f7b5d8fb9850b38865d264389bcf9c72dbcc88324

    • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
      Filesize

      581KB

      MD5

      cc7181647982251b31569f2b100f5028

      SHA1

      33f3e19e97062bfdeee962f68d92628b39b83d4c

      SHA256

      9ccaee873c96c033374abba0bfa5e1a6ec52550e6d76d16f5dc64c9c3f8cb2f4

      SHA512

      939605c89da4973cc86fee191b19fcce5c552cfc7745456c730ffcff2ca222306c610e001000c8284165c8e848d0e67daadcb4a53d77fce5f5eecdba766776a6

    • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
      Filesize

      581KB

      MD5

      cb36c9fa061a7ce38900f9151fad0b75

      SHA1

      361985ca877c9a8f9d5f3426d3079e29cc23f1b9

      SHA256

      93eebfd57e57d6638737f5f3ebc30bbed08d25d2e4c87c9399aa53ec90c08ede

      SHA512

      0ba190528b22d227c6d371f19611c531c749d21661aa0cf2445edab62637f531f80a57b3ea4a72d3ae531c067cad2f22a593508f8551843e552b19266dd5ab71

    • C:\Program Files\Java\jdk-1.8\bin\java.exe
      Filesize

      841KB

      MD5

      8cd5d1f5491fa593f2a2a73f55e4b281

      SHA1

      c6b297dad21b6adf9f2988ebe11ba5466250ddbd

      SHA256

      92af7ca4b2f94bb8f2ff179cf937cd444b90e0a048e75e8b83f0eee37742f4b5

      SHA512

      f2c51064fe13b8a2bcba19145328862f7f4af1f164828c2483aa1cb0fe473cba5c0a0f57cea0f8675950cc595b6b7f793844f41809f77da3a353ae6ff142c767

    • C:\Program Files\Java\jdk-1.8\bin\javac.exe
      Filesize

      581KB

      MD5

      4e4854a93199658b166611abf3cdb210

      SHA1

      857e10967e8d6bc369b76407e5fb31c0d9bf141b

      SHA256

      1daf59ac75e51d83129b3b290e103444e7d4a9392aed76b29e0c68abc7316379

      SHA512

      7554f539b109357cb729f28f8893a57c179efd61a4834062f8b20f0218be095d5cdc931d2abb0f07d73fba8e452ba71e9d99d9d9795a3db3b4051e2faf38873d

    • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
      Filesize

      581KB

      MD5

      e3fa8a2a081b9c8366a6ed0172110c62

      SHA1

      65fee410fddb20831de187b142bb33e292582319

      SHA256

      344f5c06d3ad0968013a1ba79ae8f437451d7d53bb8ff4029ea00e3be6902f5f

      SHA512

      9025c25c28532e254521ba7024a25b20fd1f39a9b0abc10f559762ddb15cd21a003cafe74d6a407f68fd743b275ddf15d8a777a9cf9dedd4bb79c84e1c515483

    • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
      Filesize

      717KB

      MD5

      8203bf5632f533d686d4317010c8b98a

      SHA1

      abf4d5b1b376b177c82a7f2fd0230ce1a73c2e18

      SHA256

      68d68f77fe31a609b7dbedfd76fa68fbb486d0c53b1592f154acbcc6692dd05c

      SHA512

      88a3304f54e7f291b97c8c52b796e259aeeef084661c254fc9d447dc1445aa5a0d4bcebaaca2e8241a2dbdcff791b59cf1dd7896dc9d78166f41a7e7b8095202

    • C:\Program Files\Java\jdk-1.8\bin\javah.exe
      Filesize

      581KB

      MD5

      cacec63908ae15d3dd6b4cfa527b4fda

      SHA1

      595cba439b06102a11e9a4808442e381181043bb

      SHA256

      fc2b18ee80afe2220c58e98ec0d6c00b154eda64b85e7789f7b816844374b4e3

      SHA512

      2f4044af29ab9140d144a94b9883be2d21ccaeabbd1ce4b81f15fcd13786e3b54202e2be5046398d74321292f4fcc740bc7489523d02c21b28246cd765bdc560

    • C:\Program Files\Java\jdk-1.8\bin\javap.exe
      Filesize

      581KB

      MD5

      8056cd870d2a55391506d816070d9c0d

      SHA1

      3b8bd19ff341a2fd02420c9242b3524684d12857

      SHA256

      152604caefb6f8ef0d7604dce79d9712607da6218c035c73137b00caa3e12f89

      SHA512

      cacb520d5794e16aa74cc12d78d0a16c87c5c9729cd2ceeb8e30754ee833f423483aaccecebbcaa977affb0274e58d2c53bd50db5c2ecbc69d16418aa2f15bfa

    • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
      Filesize

      717KB

      MD5

      a5f67602defc79b90809d5026d35bdf1

      SHA1

      ac19778c603806dc17d852e306586f7e63d10803

      SHA256

      a8e8ef1988abe0fe1592d34ad80ee70d215d3052bfe51e59b1a4f5c1855fd7ec

      SHA512

      0ad6959977759d1631e4c7f67aaa49a97b6943e18dc9c7ec0693bba98475adab0925a286674050e8eb7e490d96cf4d97db075953de40fa412e6d75d0f4e6ca01

    • C:\Program Files\Java\jdk-1.8\bin\javaw.exe
      Filesize

      841KB

      MD5

      e1d60ea732ab74eb0a16da0cb3a2368b

      SHA1

      cb99192a08a3ff6fe5c754b75eba02c25317894b

      SHA256

      c0e1e4819db796fa1d44c0d30cfc4792fac6171a2f582cf62552fd0e38976091

      SHA512

      201bb56eaec81a3a3c7febef14c5c34e098975643e6710077a9db3730fc8e13feabff29014e40cd8ee0b607dff7169527bdc0d044aa3576401285b40c4a206ec

    • C:\Program Files\Java\jdk-1.8\bin\javaws.exe
      Filesize

      1020KB

      MD5

      eb269df366a987240bc9b30f7d378f05

      SHA1

      1608fabe60aab32f22d9f7d8d079beaaf2abe08b

      SHA256

      0e8ef6eab8552ce260f4a68bbef7a59b790dff105b4fefc5662059b91bbceb25

      SHA512

      cb503d4a7db129584859718955a461951abff07cd491a1b6933c7ad028188730e31073cbca5f88a38d0e6c2225ca4fb3754538997bc0e1b6be56432163b20ef6

    • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
      Filesize

      581KB

      MD5

      4eb57f58eb8a771f84bb7b67fddc3fce

      SHA1

      ef260d1bb659ad598d38155dc93232daf508f579

      SHA256

      4046ade5812d93e742ed7d8cb902c6a8d57b016789522cc4acb7180fb0d3ac3c

      SHA512

      24ba0e37b5b0a579ea4542056e290fb011098b6669d578d0698c436499e204b625564e718a96b331e1bcf21097da134f119669d339e5dc73422ef199ad69b221

    • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
      Filesize

      581KB

      MD5

      8aa49b5a679265817d3b90e3eeec72bb

      SHA1

      86ca91b290a41861282465f7554c8640d4f455b3

      SHA256

      b09e0d4593362f9ca8e77de34fbee3e08e87288adf4f29a6e0f810d4f8d977a1

      SHA512

      f2dedd24d299c2024e417dc9ca84e864f98a6e5a023541b6fe3dd9c6a8afbb81d87c6c33327cb786add86f687f9c06e26ec296aa08651ec50c9c25bc9b62bbe3

    • C:\Program Files\Java\jdk-1.8\bin\jdb.exe
      Filesize

      581KB

      MD5

      2089073c3b9e48b1580152240e6fe694

      SHA1

      6595ea57cd5f3b253005e547625483041d8e2d3e

      SHA256

      7b75506878fccd6aa9672cc835aea89bbcba8ab2253ec4704313684c4aa35d22

      SHA512

      eee97dd4b450050e885c18631578bfef3dba8648b868cf9570b908456f2d23f66197d00141a1ae66770619d594f9938c156a8543d5e1f3cc1b229b38dcf4f90e

    • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
      Filesize

      581KB

      MD5

      6c6f3107b1f4d6b0d59460f42869412a

      SHA1

      a5f1952a0f01cd264bcc68897fafcdb377dc296f

      SHA256

      9daa80aa754cc771655eb62015091ad1c215f14394ea25b3b0ed441e2e174030

      SHA512

      f52a22c7b43795188f86c237895212283d40b779a409f0a0fb268d066d5a93767b0ed634e6c496ef5aa36d1295ca95bdf9396fc12decb7c062c92470cc2c9496

    • C:\Program Files\Java\jdk-1.8\bin\jhat.exe
      Filesize

      581KB

      MD5

      a75fc800dfd2a73cf5ae050a4c06e5d8

      SHA1

      f7ea4ed5585576653e61af9d83d36b9f7380a575

      SHA256

      7d02bdcf1343ae4d0e617131b6aae87870e8842b32a8430d90b45fe0ff92d27c

      SHA512

      8313128b781ff80aa432b14f9e6288df28cdd8db5de810f6f85a7c6e038af48e2505dd5c19c2cdfccdc5153ee730b292d270967961716b838e25f43351fbf420

    • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
      Filesize

      581KB

      MD5

      09082506dc4a913b2633bacb0d291d4a

      SHA1

      fcc99209a51cf87a8f9befd7563d2b219f43ab93

      SHA256

      9e6dcf7c00136ce551fa8eb55c4a55376f5cfce2d520906c34c421443da6132b

      SHA512

      340fc116de2bf9234c496eaaf3230761e584b286bc547845cc39b62fd8fa9017db0ea78735e7e0a1354427396ae84e9a879d2275127fa58b001f2c22ddac8e0d

    • C:\Program Files\Java\jdk-1.8\bin\jjs.exe
      Filesize

      581KB

      MD5

      fef97b1398d284fb7baa2dc3c13d120b

      SHA1

      0a07930deea3ee7eb2331556d0b2f5aad30a028e

      SHA256

      de7ec11729bde86127e79861ad98a0c683e1a399475666eaec72cca14cc2a387

      SHA512

      b1e228d915cc9933ca227c8cc7010241d06517f0a982cf2d0c2eb99b10f1a93dbedcec914227645a023483830396cc142ca62c676d342dff2f4e1ae47d03ea5c

    • C:\Program Files\Java\jdk-1.8\bin\jmap.exe
      Filesize

      581KB

      MD5

      76140a439079dca3475863b3c84fe984

      SHA1

      7bb7d975b63e0995ee76ebbb4145716eaa9d56d6

      SHA256

      8dd76ae8fd0332f7f63300148e00e40751efe4f1281d83f8ea9f6c5b802f99f9

      SHA512

      363edbe5df4bf488e07e18b45793e1e828380d0a38790b7f0e59f389e397157e1a504f65a2c38687c3f9728cc4709da8ffe481fb036a08211dee82795cf49875

    • C:\Program Files\Java\jdk-1.8\bin\jps.exe
      Filesize

      581KB

      MD5

      c3acc94cc82e3edc82877deae125d0d1

      SHA1

      124c73563f3b317f0c3459f2d1d2e15a43f3a278

      SHA256

      49a3a37f674045b9140f0cab129a0b9289057b69726bbc5481c8a41eadff7bcf

      SHA512

      3227d0542119fbb656dd7cb047968768bc960276f881da4cd20291b2b7074c82e3d90e5235e9ba1023b57c71acaa0f78602d0323e1bf497cabe37804ccada1ad

    • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
      Filesize

      581KB

      MD5

      243533c20ea4fdeed8750f0db0399a56

      SHA1

      01a2e9062aaa88eeae883cc4306fca220e065079

      SHA256

      e6d15f9f865d38a55436f0e56879af5ebd7f2b740ccf5fced250d614b21900e4

      SHA512

      13109bc168cd274204e0b9a8199282de78fd04c1fae981c39bf51b8212c68c450f285ffabeada8d8df8ea12d5083f6e18731027c6b1b420604ea403370c921af

    • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
      Filesize

      581KB

      MD5

      3fcf1f9e093d39ea58b8cc56ecc37175

      SHA1

      aacadd7bb24a346907a7ff4edeb2256d4682d424

      SHA256

      036c650dc4a361cabe19a0d119e0f6d756c759cd3971124b66917810398e94e1

      SHA512

      cee05631fa93dcd1a762219f275273e07f3a9d3548de1ea47f22b4ec3433facf6ecd2ad74cc704a0a166e9973efe2a789d99b6fb0a553cc5f45e5fc18f218a30

    • C:\Program Files\Java\jdk-1.8\bin\jstack.exe
      Filesize

      581KB

      MD5

      35f8d84fc0713c3d98a51284ef7dd88a

      SHA1

      7a42b1283af9559508a058104488ad41e1189390

      SHA256

      7b7d16761b7158299d37feb73143dcd3bd22b4df3f2713038f9b79d8f025b9ab

      SHA512

      09f03bbf948ec220e6c376f8016bbae8cb11011452452d29518809a04612d3149f4e83e3c36aad1613d648fee958aaae0a8cc9e9ba1919c39b690c38d595fa36

    • C:\Program Files\Java\jdk-1.8\bin\jstat.exe
      Filesize

      581KB

      MD5

      52bf14d4435f8b5b62abe14e89deb397

      SHA1

      bcebd96d4d7e62c2bcb5bc98990d3be43061b92f

      SHA256

      4c0dff6969bd24cf6efef8f25eb82e4fe83c1aeebf3d0ec9d29084b15aed442a

      SHA512

      b9e4cde0b82b704217f1f7ec6163edab1df73e9182617e886c68db70afa6a8027dd54cebaa160891044477048a2eb7343bcac1a22d987575ba4973815559d259

    • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
      Filesize

      581KB

      MD5

      dda6528fcdd4dfa13873ac06bfd0b619

      SHA1

      50131d2d476e6c886c92fb36dbd66e2540479984

      SHA256

      962abd45526458b88f06fbc454dd3411a81fa7bfd356df88a9c2409f6ed617e3

      SHA512

      bc0b0b9a39856eaef0e68a6e1a0369cb8d66bd87662168c4268e32f809b17f3a58a64ed54dd95d835c696a07478b4e25d15e116252a4b258d2f8f540ae72ef0f

    • C:\Program Files\Java\jdk-1.8\bin\keytool.exe
      Filesize

      581KB

      MD5

      d08a1557c51b5be25f2a1cc7bd63ff3d

      SHA1

      eb4fb5b7e1ed5a384ea50d151b6c790e93977713

      SHA256

      188442b47b2a0159532e7b8b2e88ab6ef55e28ec31c08e368f55c3c3deee475f

      SHA512

      52b48bf8bf76421588b030e209aa3e1b6759640e8cba3cac7404cab9ae5c3f3ba1606e53f0be88b32e66b73f22983fec366fccc5aac8c07138f230482b8fa151

    • C:\Program Files\Java\jdk-1.8\bin\kinit.exe
      Filesize

      581KB

      MD5

      714363c4fd621f3c88801065761c0440

      SHA1

      47bc4a8692158715353b656cf0dacddc47f2f9f8

      SHA256

      e0256e3dbcfb6ba055fd5b0d99323b73e375b3308419e37e1ba758d3929f09ab

      SHA512

      b17bcb82234650b98941843d22a49469165c70833b5e21ae9e2a7122f1164bc5051c6565294081545d7ba8da128410bfa5d82c18dfde09557b25bb9ffeec4f6a

    • C:\Program Files\Java\jdk-1.8\bin\klist.exe
      Filesize

      581KB

      MD5

      4c2f85abd7c42094ef3e4ccdc985f8ca

      SHA1

      afe65d0913a4098df620ccdde84fd221d42b1444

      SHA256

      1d7cc4de642076fbbdba770fb9c72d3671ac8f6ccba983080c7d0e6b92ebe25c

      SHA512

      37428bf4235163091a03f5497a507ebfdd66cee9a1fe65580783cea07ea400842c8d311e0cfe3fa4e047819f92dde425539a3462c4703941adda838f78f08b6b

    • C:\Program Files\Java\jdk-1.8\bin\ktab.exe
      Filesize

      581KB

      MD5

      86cda00416737a73feb249e7f1257dbc

      SHA1

      0eefe8985d1926a4d63c0808138f3062ac340e6a

      SHA256

      b21772d7ab0d9378827438ae9b12d01eb0623c4d781b4a3d17005aabced73ff4

      SHA512

      057c10a068db97471d26d9a066e1815f145f5883fb3ba67111136ca28869b9dd018ff2b48a0e9371093d4e422ba86d1dbcbd2f445468c960efae0cae0dfeeee1

    • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
      Filesize

      581KB

      MD5

      c88a53e5448f61cd719cdc342cd9dcf7

      SHA1

      d8f7f9c00455ff2785db7d4a7141fffe252fe1f0

      SHA256

      1ba7a358580d1f820c59bfff5baebad599ff7ec2420e902e1e2b69c7d5096cc1

      SHA512

      f02a5d7e1c090d876d8dd09ed293b8e7029d6e6c06309f3f9c5a628b6091605563b0d757189e20b11a386640446389d587d66843811d1c38d5ad7c0fce4b364f

    • C:\Program Files\Java\jdk-1.8\bin\orbd.exe
      Filesize

      581KB

      MD5

      02651406b0f81d281b60f291c26b0e09

      SHA1

      d01374ad735737c0bba79fb3a52567f01b215ff3

      SHA256

      4c974951a7df228941135c3fe04920e58e91538ef3c9fad53ed11247cd859333

      SHA512

      e81ef1de2f43c2c262fbaccfa5e97cb4bc08bdd9a2d0efa438a6dbe027ebe5691a9bbd1feb6cfb6a848688a0c3734ddf93a62539fadcd6995f4f9b5edc084dae

    • C:\Program Files\Java\jdk-1.8\bin\pack200.exe
      Filesize

      581KB

      MD5

      64562a7ecbbf344d033fd336c356ac0c

      SHA1

      6fcb606d52a0dc04cf56a88813cdcf9488ae404b

      SHA256

      14a6a2196ea792b277ee7933d1137babd9563b38a9b863998457fe5a19e195b9

      SHA512

      34ce523323d18d3116bb1465a6f194aa1acded1861061e69db81c73004d31faae77ec05caa65bcab023ac790a912c19cc6a65f550df996a511ad7f710b5453f7

    • C:\Program Files\dotnet\dotnet.exe
      Filesize

      701KB

      MD5

      9003f1dcdca49b1d928a93b3283c4466

      SHA1

      d3fc6742710c2bf213440860887b2a7638f75e80

      SHA256

      b72a8d6a34778e1054b5815d5927130c02084a0239d9b51c376b4a6ba67e3b79

      SHA512

      681ad4d873820cf87d9ecef1c18f036d6204045ed8d38c8892ec587e22d0ecab192f8946cbd99bada287b5f6d9a4eb0aa2a67f3bf77aaa240cafae0638b7241e

    • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      Filesize

      659KB

      MD5

      ed8621e6c8e7133e520b0623c28c3a10

      SHA1

      bb8aaf953ef849d7d7671ad3de6cf2dfbc08b748

      SHA256

      28b0f59425312433a3e82dd7f37318a444b5fc307946b01178f87a7800504df8

      SHA512

      41c02d3d9610906c849f598692688b6d9fcc434762a1cc0a69452d298c42a1a63c54e8abd40fc0f8e0cd4c818526ca9c036c08842c086bf0bf59b05d920772af

    • C:\Windows\System32\alg.exe
      Filesize

      661KB

      MD5

      5563848ac900ece7c0fd4f2f31fc7f93

      SHA1

      56ed79b54cb7a1e36411fce92ce39d395f57ce9e

      SHA256

      36360fb3e2ecf9f110a170272a1f8dd8106eca28edb4b2f54248cb18a1755e25

      SHA512

      63a4b1608f156dff9a58ee46921d0dff514cccc974a5f6077c57adc2764ed3ee93dddfecc493d0d321523cff7494fdcb4e9bb5b817d7939fcefb97374c9dd865

    • C:\Windows\system32\AppVClient.exe
      Filesize

      1.3MB

      MD5

      ace1029423417998ed9af59457896667

      SHA1

      f00d31d3db8b723a32450d610a010f1c7c4a7f3e

      SHA256

      22dcf0a2ec8d52b3da0db44e7c83a30eaf361170cb177e3d50499661511f16b5

      SHA512

      ce3c6d7618cba581ba1b8b44227e69c1557dd3931a89562fae22d146e7e91a3d65de68e59f79115acacd8868265a93016a03c3b28a74c59b62e7faf420f5e2c7

    • C:\Windows\system32\fxssvc.exe
      Filesize

      1.2MB

      MD5

      4034846eb179cf0eec7c6c421458eefd

      SHA1

      d62fd4280c5acd5504b7525abec008d24c0a783c

      SHA256

      695201fe7a6e5906506647695079458822667d90922c8fea1a1f6d1dc7f10c91

      SHA512

      89edcbad63e182ee18eb496e4e9107dd452de83909ecaea307151c7ae3c66a559bc8ffab508394ba9e9e05762934070ccb9ebefe7ed117bfb09f0acd46a8e185

    • memory/772-74-0x0000000140000000-0x000000014022B000-memory.dmp
      Filesize

      2.2MB

    • memory/772-66-0x00000000001A0000-0x0000000000200000-memory.dmp
      Filesize

      384KB

    • memory/772-266-0x0000000140000000-0x000000014022B000-memory.dmp
      Filesize

      2.2MB

    • memory/772-72-0x00000000001A0000-0x0000000000200000-memory.dmp
      Filesize

      384KB

    • memory/1396-8-0x00000000005D0000-0x0000000000637000-memory.dmp
      Filesize

      412KB

    • memory/1396-41-0x0000000000400000-0x00000000004B0000-memory.dmp
      Filesize

      704KB

    • memory/1396-1-0x00000000005D0000-0x0000000000637000-memory.dmp
      Filesize

      412KB

    • memory/1396-0-0x0000000000400000-0x00000000004B0000-memory.dmp
      Filesize

      704KB

    • memory/1900-20-0x0000000000500000-0x0000000000560000-memory.dmp
      Filesize

      384KB

    • memory/1900-19-0x0000000000500000-0x0000000000560000-memory.dmp
      Filesize

      384KB

    • memory/1900-18-0x0000000140000000-0x00000001400AA000-memory.dmp
      Filesize

      680KB

    • memory/1900-12-0x0000000000500000-0x0000000000560000-memory.dmp
      Filesize

      384KB

    • memory/1900-255-0x0000000140000000-0x00000001400AA000-memory.dmp
      Filesize

      680KB

    • memory/1940-102-0x0000000140000000-0x00000001400CF000-memory.dmp
      Filesize

      828KB

    • memory/1940-83-0x00000000016E0000-0x0000000001740000-memory.dmp
      Filesize

      384KB

    • memory/1940-77-0x00000000016E0000-0x0000000001740000-memory.dmp
      Filesize

      384KB

    • memory/2592-44-0x0000000000510000-0x0000000000570000-memory.dmp
      Filesize

      384KB

    • memory/2592-53-0x0000000000510000-0x0000000000570000-memory.dmp
      Filesize

      384KB

    • memory/2592-47-0x0000000140000000-0x000000014024B000-memory.dmp
      Filesize

      2.3MB

    • memory/2592-263-0x0000000140000000-0x000000014024B000-memory.dmp
      Filesize

      2.3MB

    • memory/4272-57-0x0000000000750000-0x00000000007B0000-memory.dmp
      Filesize

      384KB

    • memory/4272-63-0x0000000000750000-0x00000000007B0000-memory.dmp
      Filesize

      384KB

    • memory/4272-108-0x0000000140000000-0x0000000140135000-memory.dmp
      Filesize

      1.2MB

    • memory/4272-56-0x0000000140000000-0x0000000140135000-memory.dmp
      Filesize

      1.2MB

    • memory/5024-94-0x00000000004F0000-0x0000000000550000-memory.dmp
      Filesize

      384KB

    • memory/5024-110-0x0000000140000000-0x00000001400CF000-memory.dmp
      Filesize

      828KB

    • memory/5024-88-0x00000000004F0000-0x0000000000550000-memory.dmp
      Filesize

      384KB

    • memory/5032-27-0x0000000140000000-0x00000001400A9000-memory.dmp
      Filesize

      676KB

    • memory/5032-35-0x0000000000710000-0x0000000000770000-memory.dmp
      Filesize

      384KB

    • memory/5032-26-0x0000000000710000-0x0000000000770000-memory.dmp
      Filesize

      384KB

    • memory/5032-262-0x0000000140000000-0x00000001400A9000-memory.dmp
      Filesize

      676KB