Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 15:48

General

  • Target

    2024-05-26_7f59992a1790b01a828973fb8bad8a96_bkransomware_karagany.exe

  • Size

    1.5MB

  • MD5

    7f59992a1790b01a828973fb8bad8a96

  • SHA1

    358bac7f4e989f9cd1e4ced797202ab720e8ce20

  • SHA256

    9e240c620d6b86dc76b4828f36959c159b70faf2746cb7dc8c93ec59c4c7e473

  • SHA512

    a23dc2579fc298a62f14f8b9dff5766bc92fd9d66baa6f1d2b8c8b67b3198bc1d314d2fc1ba9f939836fc50e0a92d70477275cd3c0401de9eb5b12f90c74ff4d

  • SSDEEP

    12288:BvXk1AwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:Zk1VsRjhm0Ijr/eax8JXO02q3A

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_7f59992a1790b01a828973fb8bad8a96_bkransomware_karagany.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_7f59992a1790b01a828973fb8bad8a96_bkransomware_karagany.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:5072
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2572
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2752
  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1332
  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:3824
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:4728
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:4536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

    Filesize

    2.1MB

    MD5

    a37334c596cddd7197ffaff4e2b04487

    SHA1

    8a8341a0013780498861519398412da0b0c18c75

    SHA256

    058bc8ac59e80922cd10fae4fb8f6eb3e59af935f3d4deb9a1e810203e9cafdd

    SHA512

    e24df67ca7acbbb23d36e803832318f2cd90252ebf2caf94868c7c7a37dcb7e492dd804baf57834254beaeba0a686cc5f513d76cd63df3dda22d64c12382bccd

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

    Filesize

    1.7MB

    MD5

    b16c57021b67bff65eb659a144c4f02b

    SHA1

    7c87a057dea1a6e2f5eab2dfc7ecf97a5875a490

    SHA256

    262365a542ad65a0e8ac4b621da6f792a378b43b95fe28c87258813059ba3ce8

    SHA512

    2c6f9f2b0883a7ea58ad882d257e0f785e49b2a02f97376e459ea70287d83c03c726ea623c2c782f81733a2f558b3ad60a796c7ac46b5cf14540b65a71cb8d14

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    2.0MB

    MD5

    5ef91d2c4f69e59e9da62f2399685ba1

    SHA1

    dda49ff559bfd75a120dc7747381f34e616a6be1

    SHA256

    6e7a0a142cfc8b8475f839928fa074d582039d785c9f72c6ee2175fe02742677

    SHA512

    27903310a253eda3d22763ebe5e668ca1ddde5bb400abfada0c950dcca412f7ffc3bdf6b7de1c2d0c468a4e6d1eeab80649693527737cbf2ccab40d9faee1373

  • C:\Program Files\7-Zip\7zFM.exe

    Filesize

    1.5MB

    MD5

    7022ce8ac560b7763cae5236afae10cd

    SHA1

    073997e7abc6fd592065f33804ee9c6639c1f96a

    SHA256

    fc9847f51deb86ee0bb7f5997937e4a59d79cdf67375fa1ff9698a0370fe567d

    SHA512

    e6af9aa876a65250fce8b54fe70c4cf6094abb27fa84299258ae0c55a5b7529813796511cf03d0afcf912eed2fb4441820c93d3956ffa0f147d29285d5737458

  • C:\Program Files\7-Zip\7zG.exe

    Filesize

    1.2MB

    MD5

    6c8e92bdc8897d46a4bbf0542d02e68e

    SHA1

    5b4ea4a53d44c3c4ad5e64204934e3ef6570ef53

    SHA256

    116122a74c815490f278e12bc9020c8b0873b547f000f5ff331b299eeafe0513

    SHA512

    a05f55fc211c59d4c0920879e22a6a4eedf63b061748a2e73f5718cc2a6e8805932521693d5b81345b6d8fce83e8d76f75ebd04161e22fea3bc42583eefbb42b

  • C:\Program Files\7-Zip\Uninstall.exe

    Filesize

    1.4MB

    MD5

    253a23c8d9d189a05e4413e0c016f66d

    SHA1

    67e9f9d4200195bb47506c0790d00dc1d7894dde

    SHA256

    92814c59d5370cb2d4a917858e33c8389e51d1dd2932230f35da275b378b9cc8

    SHA512

    e19380b2ae786aee38ee9bebfa6409c1d42eb8f6a38101bcd83ac6fdc68a05214c0b8edcd4526ee77392f91b2254e08fe594cb8fc3b3c31cb550aab741f344d1

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

    Filesize

    1.7MB

    MD5

    6adb2169fe1b220f70e33b30dcb6bf68

    SHA1

    f5e4679e75635c1ed6b368430920930e3285b0a0

    SHA256

    211169c84d4794dbcea86b391c919e964e0d9ee4cab7242379214acf70a8d9d2

    SHA512

    a612a524c616a7ee6a6a84ae0ec829dac2789ee9828c143b22ac1de9e21e614d8b76eb79a5763e3c1e940e50fb6994621357f71163acf5604af444508b89ba8e

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

    Filesize

    4.6MB

    MD5

    05c40540dd5d63a37336e2eb73f0e740

    SHA1

    93ea18b28812940a76f4d839360705f3b2af8014

    SHA256

    729e05f0d3469817eb17ea485db8034120090c0571676ef9a9b75ae609278513

    SHA512

    5145752ebbb8dd40e81d578c0ee8af32552b0de53c3af9e7cee26fdaee7498f21c16bd902d5a6955b2831ac04f478ce8e467c6beb604b275b2d3c5e52e163598

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

    Filesize

    1.8MB

    MD5

    8340d9bf25942281aaa0100fd60a6310

    SHA1

    7590bda8f14da81c556ed6520cdf22de3bcd2867

    SHA256

    d4e0734aa9f1abeeadb64693d1e6bc3d254d6b5e61edc0637b453c9cccc5f788

    SHA512

    6aca11b9b3fb96cfa55c459ca54cc6563ea206dcafb9f7e5e11254ea6e845a263a712232dcd98a8cfe1dac0656a9ea9a229dbe477159defbca2e07b3fa9d8e0d

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

    Filesize

    24.0MB

    MD5

    53f42cb8892d6c859dc4696f29b991ac

    SHA1

    c5fdf8825b5aa898c6319d0d1c7cfe7cd7b75c03

    SHA256

    8881e484afd801716bf91d20f8f68e5e82a67c67a532686e21fb1419971312f9

    SHA512

    8d439a1882a85336cd42d8c6d67378f0d128e7fc6bd719d3b21ed50ba7584b9db14e60522fd3e0e5c12964623d90b0039c15ad08ed53bd6a872a47d963f273c9

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

    Filesize

    2.7MB

    MD5

    a263ceeedbb1afa0a78a9b373cf56f74

    SHA1

    b97a0129016e8afb9b5ed54595e6ba7051b34376

    SHA256

    db9ab1f82579441416b2eebf7be1b8ec22ac5bd292979b9775fbcc0609a30010

    SHA512

    412fa9314b1adca0b0d952e4a6f57ee91050ee76da678273265ada4c2b9474f06cf0bb64f4d681b4a1934df4117ce1a06948af66d0e2c115d8355e25d15cb3a6

  • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

    Filesize

    1.1MB

    MD5

    00b5740adc43d396da9ebeec1429b452

    SHA1

    982c5d045084f7af4e7935039a2c53339372f85a

    SHA256

    81b460c1ffd83257f68d06cd90073c3a2ffd2a1ce37ac465153fc29f60b359cb

    SHA512

    99134afb37dcba01dfe1d9b83ccb8fc3881b4634703eab277d69200289f51178c7c826b703ad79a89f107b147f491c2477707b91f3743e84bb482c77468e20a3

  • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

    Filesize

    1.7MB

    MD5

    6fba18fea4630b2920aa4c9c61650f6c

    SHA1

    5423f63c0224be529c3217c783ff962fe56eaf6d

    SHA256

    abd3aafc47edbd2316fabd5cd7a2366d229b2dfee93742851eb32a16a8d249ad

    SHA512

    123221e3a4f8d5a53c1a1f9f20596580605918556f2eead018d2ac3ce6ad79ac7e6409f9a3ef3affe9457d3d57c164fffe9ed9d1fbb4f8f734d99ca99aae311b

  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

    Filesize

    1.5MB

    MD5

    fe9d579e355714d2a514b59e30cd935f

    SHA1

    affd4db168742c50cf1af94b43e94b8f8b5ad683

    SHA256

    81f0c7ee27fdf11c55ab520da8990b8a3b62442676c5413f9d82966a229aa41b

    SHA512

    e760ff89bfa65f22c45dcab488a4a9536a1bb094949249199db79ce7990d87b2d39f0a9e45b0b647f935b21f172652df35bfd2c2c8c9c3f11713058d185cac0c

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

    Filesize

    5.4MB

    MD5

    47b7ffa53fca9649f567f3711a111aa5

    SHA1

    8c7a8bf45691935c9801858614370ca4a93467fb

    SHA256

    6448b5998d869044c5afe423adb99476026969f4216abf49f845b4333d6d063b

    SHA512

    22144c22daff86197f1c481bd0e155c79c0c0ef9290e0d682006b54c6bf7d68d031cafe994e7387a938bd444774104a80762d3fd326043d7cbcb554a9fd1d39a

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

    Filesize

    5.4MB

    MD5

    e7f1f0de9ad243473f0e90681dccca0e

    SHA1

    5838c0627aba239feb113105b3fc7152ebea7245

    SHA256

    49a4faae6e75b8d2c302fa55359a0272e1670f17877814ed6c941c657c9f671a

    SHA512

    a406bc85348da404663d3000ba88741eb8bfd76470511046154704e63895a0e459537d13d886a7961395bf05575bcb898ad6eb98623c462054643a893630e108

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

    Filesize

    2.0MB

    MD5

    f975552f6cadfa11980e9f40eba05d62

    SHA1

    0e5dd0503a3eddc02fa6c654de0cc9c42d3827ab

    SHA256

    86057f16aad95f2100f1c15ae54ed9500ef4025c14122355e464fb66d0025565

    SHA512

    6abbe11a8caf2ad49d20f45751d721c3f07dafb0a2a7f76ce5882c505120f3a4acc3ba42c92a1931448d7b02298c58759514e1bb7132b76997bac182463b4060

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

    Filesize

    2.2MB

    MD5

    321998b1447560a804acee60321611b7

    SHA1

    b7587c612043f7072713fb1eacb23448b887b77f

    SHA256

    db8a65f465122e8a3b4e52f6dec4ca1aefa7d24b2f8bfab0839c7cccd61c985b

    SHA512

    2ffeb313fb653a83465de5d20eee0d08b1824e908b912cce072e4a0b2fdea8ccacb55087937e5869c3715b89b30e5c9ddc42950ff9c68b92f28d25bffa423cbc

  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

    Filesize

    1.8MB

    MD5

    943f4f14d42920e9a6a916fa5368a7d0

    SHA1

    070d868c03390d4c5f71b1b6d5767d431045ffac

    SHA256

    42261f1f9df7bd3a26d6459041e30e844e3a818dc96ef8d01466d276075ef439

    SHA512

    6d2cf12eac7892b1f4f27b527c82a0a7f3db314c17288a0fead8c8d6ddb5bb3384c672e85d3069687e12752d7e67c87b749d78f46aa280de9af19386212b13db

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

    Filesize

    1.7MB

    MD5

    3ce6ceada6dc64a404ff38e2ddafbe03

    SHA1

    d26448f80b0fa5da1f0754445f8c9d946d0c2bff

    SHA256

    638a8b74c09b3cb88c73440173e1729be08f00e0baa5f0854b28487d8087e8a0

    SHA512

    3a042c861b8722100186b7fbb6a1ce433f45932b3f6607d9df6a802d0c094217cd5077a67ebc9229cab4321e83432dca3889e0787f235cb5fe9afba1a6bad585

  • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

    Filesize

    1.4MB

    MD5

    561cc1b01e5f6fc81db87751afcf4c6f

    SHA1

    1863ca85fd896e97b3f48cf1a2af47413406cf0e

    SHA256

    a7def4a1d7d3744c923b4461a08992e7c4547e45ecb9a36723649ab2c511688a

    SHA512

    445684c388a0c286126863f46887c0e257e723feb7cbdd1833a6fd774cfe0937d1f9a477f96af7062bfc63ea7d766de1fa79b7a7e7bcd065fd06d97e10827d31

  • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

    Filesize

    1.4MB

    MD5

    48022505a83f4b77824af9ed49ed153d

    SHA1

    028c8d325e3233479e80aed09a9692c5141c1ffa

    SHA256

    7d8dad6b5945fc187e110e74f5dc5e103db0ea8413ef04db06489206b65d2274

    SHA512

    44b8665600f80448bb72aebf045ce3a1650110da7a0939947788f28f317017984b81c226256b183d849b94febb61ac92cdd26fda84d7f238af9d9ad3b635d754

  • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

    Filesize

    1.4MB

    MD5

    c12b2344764684bdc79de144241bc563

    SHA1

    b9a348e05a2f4a9f25ac6d98462e5b4bb39d96da

    SHA256

    b5e399fc232c3d0e29d1cfeab7a502496f7f164b8ad62c331a3c12ff7a1e09c5

    SHA512

    f1080cd804c770c4944e2a06cb10eb9d47910d93243e6919382b2c5ba57d7a020274423fced569ba4d13e244380b782b6259b716fe675127f7a4d5ca87ee2a37

  • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

    Filesize

    1.5MB

    MD5

    b1cdeab43c3c48c989fd74290ec9fa7b

    SHA1

    c0c1cb0aefbe5cca90c0d0859097f21eea8538e9

    SHA256

    644dda7d9046effde49e9a4fd4d9ce2cf9efc8474809b091b9e7881a890400f3

    SHA512

    0e5d5794fc7dc4a14ae4064172a18c6c4a67cb603cb103547cd1c667237ff2d6eec515342369dccd1fafaec80b796b70ec73f28b70404dd584b74dcb59667491

  • C:\Program Files\Java\jdk-1.8\bin\jar.exe

    Filesize

    1.4MB

    MD5

    0ae1459bf8975ad07efb7b02e17ef127

    SHA1

    896f6003afaa57e7753a8b48cb489545b13e365e

    SHA256

    98bfcf32b59f70760e7d7cc00dcbb2fc0f19d29bdf804d0604cc84e2ab085775

    SHA512

    eebabba463df9b876fc0e72fa6e0208a34d5e478db64f28b4410fa5dbe23fb63b13dba45b77d9a013ac586a7706bcae43daa1fd116e5a60f3bfe033dcc555caa

  • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

    Filesize

    1.4MB

    MD5

    78193e3625614ff28377005284ea2f63

    SHA1

    e461188935d6f8b198ff4c2e0354652c3f695f5e

    SHA256

    7854b010a360ae328e4b84a00191d62e87e0943fe5f88c95a7bb296adaf794a9

    SHA512

    e470e0b640dde6591c9cd4d40d68ab351b8a4b113846381a2c148b1c15ea583816b09c097b577a73a14147b7df7b510b3f1eedba4424ff83017db8647097cf48

  • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

    Filesize

    1.4MB

    MD5

    7f98784398bf0441b7cdc67ec43e4666

    SHA1

    a676fc1d6aac8da348b0c63c20d9aa80fb25c3c8

    SHA256

    860ed64c865428291a02b0d1f37a5553567bb69e2d22f7d5587972d4fa24a797

    SHA512

    6a74cf1b50e82e539dbfed652c8741dae5f0e043fc5746711d664ee4dee7f5b3e3892eee20031e0fa6cf1a28cbc7dab2b847585c69f190184beaf4f9f0192816

  • C:\Program Files\Java\jdk-1.8\bin\java.exe

    Filesize

    1.7MB

    MD5

    79a0d7c61a427dd1d09addf8772a4bd3

    SHA1

    3a025da8275f5e4212b347143bae612184b09bdb

    SHA256

    df70dae10ba75606ab4a9c556b027f1d7e515d67875e993d402a4ba6888c3cc4

    SHA512

    98716bb9ac0190406bc41035459af145021b44e2a1c151d5d2ee945536c8bdd8a2e1f36b6da1069d31349b35cc253109b20dd1d62da6b40e95140b427fe5db98

  • C:\Program Files\Java\jdk-1.8\bin\javac.exe

    Filesize

    1.4MB

    MD5

    eabef4580ba988940dc06995c05d4d08

    SHA1

    15b995a6b86c0df22a4282a78418aced923bdd48

    SHA256

    00e6779c5222850c6974757e896e2be4e6ea1099d72eb0a6a493670a0fb5e320

    SHA512

    cd6a0f622575a78468766573e5ba304d9b5f3591f966fb8dc4dea1a30b6b285c0e3db43121504a6b79655e756d4341ea3e48f0d0ab752978f376e6b201135c68

  • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

    Filesize

    1.4MB

    MD5

    b8d7ff10f7c0c0efd8da8a110f82024d

    SHA1

    6747c60d22683901d0f991cfdfba96edd74e698a

    SHA256

    6b58159a114829adfd159c6b9331d8e23a8b660fce7805e0f3d9df005579ed30

    SHA512

    d7808d7950a65bbbe3a649fbdc4c01658d237547db6b520522c242379693a2d18cdb2672a4a395cf013c364815b965ac8d2f071a2ee98544f7318b1a9654c9fe

  • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

    Filesize

    1.6MB

    MD5

    762ab34236b9ee617e807aa293928aa5

    SHA1

    a95de555f7a42ef69155d7e1e1cc658a62322bd5

    SHA256

    ca69739835e05060c8c1bf622314562208ebe3576fa67287564733b3df07fe36

    SHA512

    69a567f7d2fc729c073e420e0d3bb77f0ffe4e007a4438e1a03bbe9d26c6c3c01a4f5b64d1cf9ea18d2d337adc68e1220dd29a85cb6b82b5c728d426214e4ff8

  • C:\Program Files\Java\jdk-1.8\bin\javah.exe

    Filesize

    1.4MB

    MD5

    170eb8b1e105747390e01dacc7e72649

    SHA1

    9b513fd9709469bd61430db40c233ed7ec203cc8

    SHA256

    42a0febc4095ed6e652cfb138bc9ba2cb26a5929830625e3d9ddb0de3a13f7e8

    SHA512

    fb0286beeb71a6e494e60d1e99986957f8f8c0ef8149aa95c5b2baa5721784c0933cdf5b36d07c3e8e8d1e4d3528a4019a2482ed9df4431b238b64fdea945ab2

  • C:\Program Files\Java\jdk-1.8\bin\javap.exe

    Filesize

    1.4MB

    MD5

    f384dbccc78f0c22c29ae87b6753109d

    SHA1

    610fe409e86c81bf25eebbf87bd7758b9c4cd9ec

    SHA256

    0e83b0a70798e407134c64f667843f966874ae2c163be0dc8cb847fed05cea28

    SHA512

    e5523dca506ebf9bae657fa854cd83403f6a8720b2338fe21d18e1116bea4eceef4d0e843504d58e77124829e28c36e3656dd914abeaa978f414e5df92bbdd25

  • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

    Filesize

    1.6MB

    MD5

    92c7a4eaf7be190acb4a010cdeb48f26

    SHA1

    0cf218872812abab42ef3f34dcec5ff99cb61fa5

    SHA256

    c5588868aef3f185780401869ed37e44d79740327c19c1d7f5ffe9c7367bed1b

    SHA512

    7406811c097d9146b7ee2313e4f651b8293dee274c942f0bd846787161dabbef7092522bb5f6d046ed903b8831b7c37d7e573e946600357f47aca9f9d3d230a5

  • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

    Filesize

    1.7MB

    MD5

    b99bd45726f214ce82c4dbc31d0dce34

    SHA1

    07569f4aa192e173b8c1283f6bfc9ee2b4264e70

    SHA256

    5fa7b5a099163faf67e9334bb6d6e1c1aed2165ac8b429196fb48b3ecef98d45

    SHA512

    5ec35b37c13c7228306d8188d6aef3baa49cccd47c4dec45afada871a277ae2db1f1028b086e44ad355863b24ba71cad89bb6c7b8c569065d8569603a49abef0

  • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

    Filesize

    1.9MB

    MD5

    cf0e2c31c0b26767e3057db810bba40d

    SHA1

    153b1745456ff5142df4a6dbc1915538ef0edb88

    SHA256

    5bf3ccff67c88f8ae28353552b7c51ebab7591005c83e569bdfb363cd575beee

    SHA512

    5242797bd53ec08061a1d87359d03af95b22574c78f90d2c5a0bad1f98fd6ad87c884b8f7fb3e499d09b9e76ab008cd5239727ea98f91a7dd6093c9cea3bbbba

  • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

    Filesize

    1.4MB

    MD5

    458d03d9b3c23720eff2578649d61527

    SHA1

    4d5a26c7371f4b2099bc5302f4fd134737c106c7

    SHA256

    673c5d01a7a1209744acc72e973eea1ff47583f0745caf51d0f635883f28f150

    SHA512

    669f1542a9ddc2a184d9c99832e34d02ff7df13f8e4c1ab9882b247ff7606705eff1c1581fd227933e46201f888441cef518e75a020396c1345f38c24c8e9ef6

  • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

    Filesize

    1.4MB

    MD5

    e89aca114284be182b9ce0968b2f116e

    SHA1

    d914b1516904027f3e4e2990382cdf77c72e02b8

    SHA256

    8f7e22232c4c138dddf2cc07fc67792698497c7c3db5a2318e3cf4bfa98d202b

    SHA512

    c45a41f9c0e2c0604c346a8b2533c17bd5ed9b659cee453f81e3218d8d2c31e4dedd540c265d2809398aa42125a813205ca34d5e0977d1e9b06cd46070f0d9a1

  • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

    Filesize

    1.4MB

    MD5

    4e6fc6e2f0c2055ac9fcf01ad5fef7ae

    SHA1

    3042dd3b3c3800ea6c7968a6f9d689a413dda1a3

    SHA256

    7fdd2f178e59c13a44ae1b7233b07ae949cb8543893dbd1948a3d53256b68071

    SHA512

    67f43021f5f34a7fd5e730e8d5fb89e4999aa4fc48feba92f006e1480e74ac69f8e722db093b3b148787a241a018e732d70bcece3d913d674664e7de367556da

  • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

    Filesize

    1.4MB

    MD5

    beecdb259386ce28479ab7eb750138d8

    SHA1

    59bd6b59f37e0cdc440decdcbfd19810ce6a847c

    SHA256

    81b94889b68564e26d5e64fe81cd0e6f5b42345a9145ec0c12fba0f784a01940

    SHA512

    04b2b3742faf7db3caf9503ac835ee42253397592ed952eada881d10bee2fc3215f0d3fa93e113d2a9eec7b28326fb9356464a8a1029157efd99eea4026900d6

  • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

    Filesize

    1.4MB

    MD5

    61a6d7045d4601b0468e31accad0f65d

    SHA1

    e5434c99a693f51f6a65ed7bf0d73d84665d1c4a

    SHA256

    50a42ca672f633fab438f22e555b3d6bafac8c8811e1914a49baecd20efa8d41

    SHA512

    ccf8519dfb07984a2d324c1fa4e9883c0c6c02400da2cbcdb6dbe5a4169cc5c2d92161056d1de43eddfc3075b0baa1eb4cbd0c994c0935df9ba7bb07575205f6

  • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

    Filesize

    1.4MB

    MD5

    e36474eb7a72fc877830682c8d0ff5a3

    SHA1

    23d3e9fe2d656ddbbd14348734a3846ddfe0e822

    SHA256

    eb7c7a14238d48d49e7ef6790cfe948428b54b55399d4ca5df374e8eff905cb5

    SHA512

    1fe3b0207cd1412c33a5451257ca9da6f7f51d4877aee51ef4a9030e6161514230918c6c3899ca7226031f212db616a73eb70be67dc837de70132108c4c9cb18

  • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

    Filesize

    1.4MB

    MD5

    92b1348db2633e4144e20d85e3c5a69b

    SHA1

    363725050b81c887971b180c02ae4fba0a51609f

    SHA256

    6315598886f9f9e87d9a5928491e38a5409535fc83b36752c7339cbc8ddae2f9

    SHA512

    a46cd1afac45f640e66ca3557e35eb54a89d44bd7be3a0e99dc6c90199fce853c976b2fd2ed4cf23f61f29d17f7d3260e65ca8371cd9f2f00c6528a5eca3085c

  • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

    Filesize

    1.4MB

    MD5

    aaff11117083c25ea5c646f518cce549

    SHA1

    d7c44e8c827b320bd8910ebe48a15f2027d331a7

    SHA256

    54cfd6910d89f64e2aeadd5288b861fc4a68fcf48045cce842923d3d428668fc

    SHA512

    34cd15fa92020d94ae37dfddfc654eef1997a3f6795324026dadf6123af2afbdbbc72304cf6a8de60e4c8a50c5a8bc10cbe799658c7c6f70ec19635c2ea939b7

  • C:\Program Files\Java\jdk-1.8\bin\jps.exe

    Filesize

    1.4MB

    MD5

    14be5c799df5b4c2b8ba24e0dc05b5d3

    SHA1

    e19fab5f0826cc151bffdcd933e47f0aa83ce816

    SHA256

    764c51fd61a8b716ecc68e42c06c013bb54925283367cf4d303d751b22b5fb6c

    SHA512

    5b25fe3146a700b8f4aa7e1a9e2f9c7ecb8ec9532245325b5d181a08a9135f5481c772722cd797fc7629d92837ca69e61d74c854a7067cc3fce8d9afa83f427b

  • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

    Filesize

    1.4MB

    MD5

    40c012d440bf1313c98dd7244ae7f614

    SHA1

    4f465bab12525fd5a1fa57eda2c12b604d59569c

    SHA256

    ddd5c7a1e81aecff25a177481457bd5f90b387e502d7999ac0206b26de6ee11e

    SHA512

    2cdbce0686e77e34b081a85bf6d4b8607eb49bf0512e98e4fd333cd767cd8c49f1972a9a06db70327b4a00168c20892b8182440cd6ee048eddf62fd2c1729df7

  • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

    Filesize

    1.4MB

    MD5

    88385ed2e37221707bb22b87a0c795ed

    SHA1

    da0307da7bf4828bb42b89a17c2ff7771790f45f

    SHA256

    231d3684c1e7f89d2bffcf5449c2e8f0aa2a2903b76b03fbcdb465671c8c4fce

    SHA512

    9a36411eef5604d1fd7e0f35d84df8c46cb15cd21ee322706af742a41ce3bed1abaa352a073ab1b96618cb867afe4c841162ef68a210b195d9d656ba07430bd2

  • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

    Filesize

    1.4MB

    MD5

    fdd3973ff8ab5b18e13658b3b559da2d

    SHA1

    e10a7cebb3522bda128bee35049aeed722638f52

    SHA256

    c936dcd5311c53f217bbc0857a317f83b93fc53198ddcb36ab2e89a546b7e0f4

    SHA512

    356eff105ff5d9eac461846007650166105a6140e2bc713a7ab81e6d0c7be9cc59d2d807f9325ca1af4fd8f0f2a906d7b8f3a226d2a2a3bc51fefc26d4d481f6

  • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

    Filesize

    1.4MB

    MD5

    fb1c9245a0d1458c18b07f66c83ab0ec

    SHA1

    d15dda1db323bdcfd2d2332346eea59c21b08790

    SHA256

    2d131575593b6151ffb62384fd338b691a33568e99015418a6a620422ed5e443

    SHA512

    dcc1f489440a5d3b716de7a5f8e927e516e881f102a7b51ce47f396b517203123e9fcbc5c369a59706c7dab7b1c9c7358dee7bc5a7784c4965dc5e48c70fe416

  • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

    Filesize

    1.4MB

    MD5

    10e17023632d688a4e8dd349a684fa11

    SHA1

    704a2b616636675f4032b36396d4c9e127075d7b

    SHA256

    e16a6a69d8786389f529b37371113186a42dfe3e48ed25dd58c061218badc77e

    SHA512

    9427812a6bea7c1a5a676f50abb840b772ca7d585c9f8ea032ded79ee0733c2a677d566b2333147c3d6b544532437b28bf381a3ad335782deecd96bf7fa3e1b5

  • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

    Filesize

    1.4MB

    MD5

    60fb16d2bfedf7a95cf7ad79c1453574

    SHA1

    dad4dfe0a7d4e6ace07e18250d10464d6658cc36

    SHA256

    976d3363b764b9fb0ddd45846f0884c642e8b2d13fbdace66e0f056a5cbb410e

    SHA512

    5aff2f3742833ceb7627ee8f5dabe4afb3e7e73bc976ccdfc6fa469c15e6d7b5fc037da747bcd9ee93be138a897d5df3f13df75a50b5a4ec2b3037da23e1aeab

  • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

    Filesize

    1.4MB

    MD5

    39883fdca7e2a356c1fce01838c8c597

    SHA1

    9087561ac18c776d50f75a7b8a5d48dc9780dd41

    SHA256

    d00857dcd03ed6673f87db357cd0e7f0594c2cdabb07ed02bfe9bfbad36904d1

    SHA512

    d6d5751ee16b85f3c5d6016793d95ea52ed6dae691bafd5099aebbae0fb126b9d2361e7767503ca17e56a1f0dc93e42337cdddd24465ef7f15d9b635ae58b1fa

  • C:\Program Files\Java\jdk-1.8\bin\klist.exe

    Filesize

    1.4MB

    MD5

    1b6c27a340a0ad225e2dc119f0b3edca

    SHA1

    93a4f31bb9cc574e82d9fa9ea3523fac7785358d

    SHA256

    6e60b3b37d3c3c588e12f659caa2a02aa1c35e3a4911080ee29047ab615991de

    SHA512

    1a90a41eebf5a9981862002ff12fc4a0a7d79529211aa84ab423cdc1e7225c8855ffc0605bb4294c60f6de2ae1dc5f0157001152ee1cfe48594b7d51d65769dc

  • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

    Filesize

    1.4MB

    MD5

    9faba66787220ee78fa64480ffef8ae6

    SHA1

    15cecd90e93eb51763344dd0e3e9395e8148a217

    SHA256

    0280057a0d2f73ba81f5ce1de6c25efee6421bfaafa0f53b23b98a883726dcef

    SHA512

    eb17e11f2f9a6c847285dba0a8c5665cbe28b4ed58b9bead9d1fe5eff54bd0da919eef7206f72fec2746a6fbdb55a3839a748afa3761bf6402ce6de3a87431be

  • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

    Filesize

    1.4MB

    MD5

    1ecffd9c65a3c8f1e0026a615b90b712

    SHA1

    df85ca320a7afdad6c07337c5e8ed0ae0a8aedaa

    SHA256

    5ca4bd88416acca72e896e647d81c1e5700a0db251cfda621eac114b797aeb94

    SHA512

    44305e0b138e9e26b69adb42f52c0a01874c15e11d81c3496ff1e636cd7cf26c883d0d7bd11b42222923e82e664d762d47aaff4228bb2f57d11838d7a8fad583

  • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

    Filesize

    1.4MB

    MD5

    d68291692872931664256b8f6f342c54

    SHA1

    3e553ae2d4c44775b71c8362b5d47cd1136efc01

    SHA256

    ddac91c662778abb39f4af7c8a01136092db7bde43bc0e89adf4b69a10bdaa13

    SHA512

    45eb6ad1bf5350ddcb43cbf4eb5f20e5c19bcd03170ce41c98668d210a4dc8191bd9e37cf7ca4bb1e951921eb989aeca45c0eaff25a01ffa00a61160e57515b8

  • C:\Program Files\Java\jdk-1.8\bin\pack200.exe

    Filesize

    1.4MB

    MD5

    815feeaa85b81200643d22688d7503a2

    SHA1

    417491b51e0c40dfc3f0e477d01ab6fb3813f022

    SHA256

    1e2497208a93da46faf320b0b44a600db375539beddfe45a1570c6e0124bdc89

    SHA512

    9f004ef3dc075bf765660db3d6b3111acdea4f1efaa6dc9073214a5c20c883b82263823fcc5b7fd8e28382742bc33242e86dc275f6e09646ede90f8facd983bf

  • C:\Program Files\Java\jdk-1.8\bin\policytool.exe

    Filesize

    1.4MB

    MD5

    ce87c82837812a989b6eb58906d7ba4c

    SHA1

    1c543a0556ae4af634be4050a376b4fb847dba3d

    SHA256

    87ae73ca644dd56d10ddef6c9c6cc56410397ed207895cd99d74a75fba81a3ed

    SHA512

    e2bde8205b52936722aa7f658dc07992d40e559649649334eeca968c61661ac29264b68033aa59b7760c9f7a92dd53d21c7584691b16e1fb676b42a27b616ff0

  • C:\Program Files\Java\jdk-1.8\bin\rmic.exe

    Filesize

    1.4MB

    MD5

    399c0df9b16fbc501f25af9028fdb48a

    SHA1

    d0fc7f37cbdb8b4bfc94302a69327f0bd63a6b31

    SHA256

    6644fed703c7ff6fc0e75f8cf5303f667d13283c11be04a899440730562f7436

    SHA512

    fcf5d7f21891242365022966fd5df510c509029a9bb1562bfc9a33e4d8c575cd5086d6493206864c425a5ceef3ab1e9115186980d5a3792fdb26f7b27675de17

  • C:\Program Files\dotnet\dotnet.exe

    Filesize

    1.6MB

    MD5

    ff430c886eaf6907ac04a85be57c73f1

    SHA1

    8bfa5031a5173e6a6d6a62da8bc7e74b5a29e04c

    SHA256

    1ae45e140b63f017977c1f1889bbd0213b2bd16600d41a4729e3f3fd9eb732de

    SHA512

    156c25358c51e1b34540c4cc534a04828b0e135f21589b87e749376b61956e0d58a39a329efa2450ce6aaa21110c6a3ada4f3f17710757b18e85e4666d0e4fba

  • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

    Filesize

    1.5MB

    MD5

    8624a30b1013fd47c22c36e9441260ac

    SHA1

    bae0d3f4300847cfffb55d46163ef44bbcf18169

    SHA256

    ac1ac4f5e8f6558c541ebd796102e54e17d768eeaf32e9e97bbae3ff8c952105

    SHA512

    9c47cc58aa0781fdc3ffe3a95b5bd29615e9ca08fe169b544eb167d9cd782861e08321c11941fed90f1be2ca03e673604f01ae9674c8a12ce7e4768b1fe3374c

  • C:\Windows\System32\alg.exe

    Filesize

    1.5MB

    MD5

    26ea0d68822665447a4d0466116ec524

    SHA1

    eaad13d6179b823b78b1bd4b243366ae4a1a49ef

    SHA256

    3dae1aa0baf9229ab5e91ce6b6d87a1d1216808ef8b87374fb253103128234a2

    SHA512

    edee6e2ed32268584546ab1741259021c731d6cc474a7c32d7b2c1c482a296667b40732702d4c7348e66758c38fe02ce084ffa2155e5bb6d6bf6b8d68d38f551

  • C:\Windows\system32\AppVClient.exe

    Filesize

    1.3MB

    MD5

    5b8bb097bd9bf4b3157f2e5ecd66cfea

    SHA1

    73b2cf165e5adbde6e45a87b28dba41133f90a8f

    SHA256

    cba0841fc484a3d257888b6ef0fd4cf7ba9006c4a0030350902d352755bbc857

    SHA512

    b09db1297b479df0836f2b3e0b1f6ac681efcabe4500d1af53d3ecc08a10c2d80d7704470cc79a2025e1e8f78b36da2a0a8d18bc18e93ac88421861ee77aa732

  • memory/1332-248-0x0000000140000000-0x000000014024B000-memory.dmp

    Filesize

    2.3MB

  • memory/1332-49-0x0000000140000000-0x000000014024B000-memory.dmp

    Filesize

    2.3MB

  • memory/1332-41-0x0000000000D90000-0x0000000000DF0000-memory.dmp

    Filesize

    384KB

  • memory/1332-50-0x0000000000D90000-0x0000000000DF0000-memory.dmp

    Filesize

    384KB

  • memory/2572-21-0x00000000006F0000-0x0000000000750000-memory.dmp

    Filesize

    384KB

  • memory/2572-19-0x00000000006F0000-0x0000000000750000-memory.dmp

    Filesize

    384KB

  • memory/2572-87-0x0000000140000000-0x000000014018A000-memory.dmp

    Filesize

    1.5MB

  • memory/2572-18-0x0000000140000000-0x000000014018A000-memory.dmp

    Filesize

    1.5MB

  • memory/2572-13-0x00000000006F0000-0x0000000000750000-memory.dmp

    Filesize

    384KB

  • memory/2752-27-0x0000000000580000-0x00000000005E0000-memory.dmp

    Filesize

    384KB

  • memory/2752-26-0x0000000140000000-0x0000000140189000-memory.dmp

    Filesize

    1.5MB

  • memory/2752-247-0x0000000140000000-0x0000000140189000-memory.dmp

    Filesize

    1.5MB

  • memory/2752-33-0x0000000000580000-0x00000000005E0000-memory.dmp

    Filesize

    384KB

  • memory/3824-59-0x00000000001A0000-0x0000000000200000-memory.dmp

    Filesize

    384KB

  • memory/3824-53-0x00000000001A0000-0x0000000000200000-memory.dmp

    Filesize

    384KB

  • memory/3824-249-0x0000000140000000-0x000000014022B000-memory.dmp

    Filesize

    2.2MB

  • memory/3824-61-0x0000000140000000-0x000000014022B000-memory.dmp

    Filesize

    2.2MB

  • memory/4536-85-0x00000000004F0000-0x0000000000550000-memory.dmp

    Filesize

    384KB

  • memory/4536-88-0x0000000140000000-0x00000001401AF000-memory.dmp

    Filesize

    1.7MB

  • memory/4536-79-0x00000000004F0000-0x0000000000550000-memory.dmp

    Filesize

    384KB

  • memory/4728-74-0x0000000001D10000-0x0000000001D70000-memory.dmp

    Filesize

    384KB

  • memory/4728-76-0x0000000140000000-0x00000001401AF000-memory.dmp

    Filesize

    1.7MB

  • memory/4728-71-0x0000000001D10000-0x0000000001D70000-memory.dmp

    Filesize

    384KB

  • memory/4728-64-0x0000000001D10000-0x0000000001D70000-memory.dmp

    Filesize

    384KB

  • memory/4728-70-0x0000000140000000-0x00000001401AF000-memory.dmp

    Filesize

    1.7MB

  • memory/5072-38-0x0000000000400000-0x0000000000590000-memory.dmp

    Filesize

    1.6MB

  • memory/5072-0-0x0000000000400000-0x0000000000590000-memory.dmp

    Filesize

    1.6MB

  • memory/5072-8-0x00000000007C0000-0x0000000000827000-memory.dmp

    Filesize

    412KB

  • memory/5072-1-0x00000000007C0000-0x0000000000827000-memory.dmp

    Filesize

    412KB