Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 19:50

General

  • Target

    2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe

  • Size

    677KB

  • MD5

    c8cf250299e89432013d3065ccb12d13

  • SHA1

    590d6042c7b46eafc324925d90fa9b749da2aabd

  • SHA256

    451dc6a02840e28fcac9a8bec43e557a35c25668c173b98b3cb6b766f1535ad5

  • SHA512

    a634b4f5d647b5efff42e3a6304f614da12e306f59152b065b5ef4bcf447e203be64cb9b3f28350bbecd9e1b4fb093ceb2162cf80bc17d084447ceaf7d5391a6

  • SSDEEP

    12288:DvXk1tp/SInr8vv2BDeT+bVYHTb3FRk/rMNxaXqqlPbJKTGv5DYFXOBnXREHa:Tk1b/i328ab4F+rM/aXq6bJfBUam6

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 11 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:5092
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4764
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5048
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1716
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4900
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2032
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:4100
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2008

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

      Filesize

      2.1MB

      MD5

      61b6296489dc4498111574e2a28bda3f

      SHA1

      8150a1a399b1bb22625892053113e1ae633827be

      SHA256

      4d874fa78312c093bc9e4eef9605e0a7c6105dfe67e1e2b339e68e10b0ac1df5

      SHA512

      296c7cbd2572ca29b7efc1382894343b97925cd45c14d15951aec5352e1f86c71006bf6095738280d74bf3980f7087d9c578dda79a9828072ea5ec610933060e

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      797KB

      MD5

      40b1e6e47045a782c4237f584b70716a

      SHA1

      28623e9b8a603faac842bb7c8f6faebede7a24e4

      SHA256

      ec403d1cf3723bdcd8e64d5e70a0ac68f078cc3cc28887a7190b20ce3a3b40db

      SHA512

      33bd44483a62dfd8bcd2056c2675d7b4b60cf15e3662b6cad79d363396f81b707422405cc446247ccd9c84190b7c61154b1d043a4d12ecb942bafd32ae0903d7

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      1.1MB

      MD5

      42d121155e3eb3779c69baf568bce231

      SHA1

      f781dac0af9af1d0977ba9cc6b2c75252fd6741b

      SHA256

      6c0b7e230f08867f291499afa2163ba431d2ea2cdfe3538e2833759463b42fb9

      SHA512

      a4b7c28e5e3b8ad94a8855f0bffe5d55c2a1cf4f4113846193a758d1ebdd3695e7f18432c282fce30f31870961ea6ed2205566058cb483f1a58aaab39a5133a5

    • C:\Program Files\7-Zip\7zFM.exe

      Filesize

      1.5MB

      MD5

      7b5a10f2b63104f0a51758b6efde3463

      SHA1

      5b0c6bf57742bbaca6d64c15612e5e8262c29a74

      SHA256

      85d5a08f473646be905bce6bb028929a82998ac140e2fd4f69b55362c4d0098c

      SHA512

      babc94b4e1be5fd277a69964f2dd9aeea0222709b9520dda696f98fd8775cf17443e4ac635142c87688a7eaaa03adaba6e942db3e4ab20165af6de6f3a89d258

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      1.2MB

      MD5

      0bdc4d6f10cd9a62bf0820d0dff484fc

      SHA1

      7214cd45a448a50d515286aec1be1b58f18cf009

      SHA256

      60b1534115d2b40a8695aeed0b7c1a806428b80d567d0221588152bbc1b2fe38

      SHA512

      fece86011d8893c60db0eff3f0bfe556a043141e88b005baaed5c818735a4c7296e1e956cccaa74c4334d977a123c581eb7c8df263a113d4d129dea157cad0b1

    • C:\Program Files\7-Zip\Uninstall.exe

      Filesize

      582KB

      MD5

      81a736df30e2a96284f8f02485cf39fc

      SHA1

      115096036137c53f1d96297cd053c968f62db62f

      SHA256

      1cfa5d7ca853731dc636904518bfdfb7b2875a6c3b5e243c2388562a61df0d59

      SHA512

      44f974da5862cdaaa5a627713ac8c94fe0424b41d58fac84feaa9231dd6c3b38d2568240f288e0767abf35bb9b70ef4622b14b5719237de84704c541d7daaf96

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

      Filesize

      840KB

      MD5

      72005c527d0c0206613d2c3e45fa4d45

      SHA1

      e5a1a721edbddebfc12a588663c10f11234cf2b8

      SHA256

      3309bcb72b7cefbf846f2ae0aa3105852510c60c71b2f11042c6941d989d2453

      SHA512

      b65e24ee8c2cea7cf9de053900b107a5c41f67cb48512062f557abfc2a6cfced5bfa6ef7dc41feac8b045412aa27b16cb7f89737ffbd4207838662fbc6f5c5d7

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

      Filesize

      4.6MB

      MD5

      0cddf0afff75637354fb2fe8d3d3f0d6

      SHA1

      ed5da8f0481d7f2f45883c685d314d59c27c0a73

      SHA256

      5fffb7baa02d7e1d9e7ef1a6049eff7cb591180b41c28846f27b54cfb18a8378

      SHA512

      a936896da261200f060d71db765723c9e34405824394fb712c640fbfd7c8e0dfa5441514fec2ae956585c65d824b757f6f2a27ca95978e03676d616b2d0d5153

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

      Filesize

      910KB

      MD5

      4dc669e3e1bd300926dca15e9bb9aab6

      SHA1

      7fbf11917f1d34bc8969c5c7c607c173e72ae0e8

      SHA256

      447187ac661f880b63e2612c3788f9062ab0bba3d05878109228bcaa981b8f51

      SHA512

      ac6407e0c82c87202ad480809f920bcbe433204725562d45e33f711bdb2a288c29751ba2cd485465c55add907f9bf33fdd641ecbd0937dbec1f19ef201c266d0

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

      Filesize

      24.0MB

      MD5

      15c6f4797b263b1819f1ad05a74b7b69

      SHA1

      75dd80a625b1c724c2ebab6a782dc1a24dddecf1

      SHA256

      44d5ae16a4ccade57300ab98bf8598fcff4fae0f2b70703c4d5ca172b0d717a8

      SHA512

      0ad3d1020ab68635debd26ee8e6b0b4c9a9f39c37b5365e908444fbf69517be37657bd7654041a4dfd4cf3bda94622e6ea5eacaaa7e013d4ec5f31d063dd3e37

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

      Filesize

      2.7MB

      MD5

      a44cff61cd74a96401902ed65436277c

      SHA1

      1d95f9a416c4526ac91ba11dae9ea7918be50fd9

      SHA256

      e67055f2a649b46426c65cb31313ec803c523029d5a63b83e7c43d56fd66f72b

      SHA512

      cad91114be083131b0a85766f4c50ffd68da2ad82eb78433e2198aa03e0c163a9ddd5f40e8c34565581ecd249364702764a7e76fc8db9ef437ac165022afe8fd

    • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

      Filesize

      1.1MB

      MD5

      5acd00cea1f18d692b9f6a0a6ba0c8da

      SHA1

      624b9b7e011be833d3a224406d5a27067a29daf6

      SHA256

      6fda151ee9670f79b68afe4eb66a46232e8962c356e1608a8f6e4dfc9e6cf491

      SHA512

      14f3a507046adf3a46f4cc77d3131c5cdff7f6ea4175ff5a7777a756f10a13736f5813ede9fa932c93896142c04c36d8d4839cd74ba78b481f01159c3c45600e

    • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      805KB

      MD5

      54a77cd060e81526854167015d9ff22a

      SHA1

      0efb1e3082cfbe6791754e7bff42a6c88c310e37

      SHA256

      a3dc28578a40013ce810713c125d7a4fac59dd7a6be64b559a933ff021bf2e9a

      SHA512

      3759c993bc6c2d63518d2d920a3bf3c4da70e839acf7624be2318834c84a3e13c910b605299246cdac57f1e5fe9b7cadefb40f2b44971e4b1f3b88276c4a39cd

    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

      Filesize

      656KB

      MD5

      d58e3d7ea91fec6ec92a7203f50971b2

      SHA1

      a7ecec4144861f17ea59e837e2f1d40900e6f8f6

      SHA256

      dc90163d9c9d73878eb470c2095f848673913dc232160e8360229aada6be6df5

      SHA512

      3c6dd4dda42a675f173624d7c8624f3cec05cdd4df5b1dde8b199341671f1172a99a0149037d4531ce3b644e3b378b5e1547e98b33dc3759092a2f85eccf25e9

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

      Filesize

      5.4MB

      MD5

      efd202cdbedfcd116cb97d3156c10761

      SHA1

      cbe2bc2868aea9c549b215a264c59cc47f39e0a2

      SHA256

      70c8ca673d7bd94c77e0dd1336688a1a02bb6f23dbe45d0d7ed8f3c487a96d6d

      SHA512

      7dcbf09d27f97cf303c1d54caf3efc09945f2451b09f2abdca49ca34fe699b3de9a08fc5002ac176f9f62c3382b781d567f7dcb0ef097a9aa896e6056d9b02fe

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

      Filesize

      5.4MB

      MD5

      9f3041c400b9abe0f57b50ca2deccb97

      SHA1

      32819931f11932ddfcb687a273dd4d85169653df

      SHA256

      e99b9738bba2d0efe0e4e4593221ae982a727b75ad32af2920ef635d2a910294

      SHA512

      79807dd7aca164c202aff150115d70fff1c37a38b2ff3cc6a292d2f9de4d2335947765d1567b27ed73e29666e1e9f1fd6fbecc261ea23dfe774f728d026bef61

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

      Filesize

      2.0MB

      MD5

      36586f429e8b742891a2f08c93728e97

      SHA1

      8b11a8753150e97d30ea8de4f2d24fb13c11cf86

      SHA256

      780cf1a0588d910904b3956139145a27276df68de14df148f7228db1b81a2687

      SHA512

      7024b5e2dd130766d4d7204a91291d2c19a9880a30ac38a76e7017022482e9f576ba1f1f11ac0936b9e3eda1c867f96eb936c6b8845cab388508d1a4341d3c18

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

      Filesize

      2.2MB

      MD5

      ffad2dfe9b467b43c00b8481910f775f

      SHA1

      ceea3cf971d5d7d1a5c82512c520e20d7ef478f9

      SHA256

      6683eb7cfd3dfbafa2ee408535b867857d40a3e22e9c31d2727d353b88f55267

      SHA512

      01e46b17dfa1fb99b7617186ae4fb4a52b8080d5bbfcdb6637eacc431d3971ec57ebc1e5b94c409924cbd17c5367cc87297ffe532f90989ab86a8d87f67cfcc8

    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

      Filesize

      1.8MB

      MD5

      942a1783e9fbb32c4bec0eaae1bf088f

      SHA1

      ac7234c23746700f36a0e34865546010ec42d3ce

      SHA256

      53945edae1f89068ea6fc71a553a268adececc4cb77e2daea96cd61f7748a1d4

      SHA512

      e68a132278ff21c4f9067d87a3319fc5484f3611838ef1b7a41cbdc46253ebbe3c14499666fec581f1c400c9f27b45a932ea72a727fee8c30baabcca72c5e154

    • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

      Filesize

      1.7MB

      MD5

      af7751cb016180ff9955f11946e8b814

      SHA1

      bdcf3b305224f2006c0bb71d1d4e73b7e7842b93

      SHA256

      3fc9e0f5d7f129f7c862c6ba1b848b35892ef034c0e08a236483af2ba75dacef

      SHA512

      32a0c4c7a39ff7281a9db8cb6d2516c7643914e9bd11ac4d73ee1a07678fd9cd499a21acc117f8b1b224476934a2f740c8ff3d6262e72df3eaaadc9d49dc86e8

    • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

      Filesize

      581KB

      MD5

      18359b4ebfb4d010307df70f33ed89ef

      SHA1

      f39147fc968cd9be9c290328feb9bf0e316f3929

      SHA256

      9d38de21301dc1d6ddd74b25b2b1c18961e1e0c6b175a3b209eab680e7bfe531

      SHA512

      fa6a60a300211fe9961480a1f7baf488aed4a3fb4437f025dbd3f8d857019f2aa37231ac9766dfc668a3e72fb47daa162490a373fb24947e1ff74d49d99e5075

    • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

      Filesize

      581KB

      MD5

      826fba0bc346b7029450a2fc6e8894cd

      SHA1

      880eef616557142f3b151e2adbc1292aceaf005e

      SHA256

      b39a6de074ac8ea3e2d1d174cc78374f9c3d55655a7ba839b5cbbb431f2e3a01

      SHA512

      0a174d20874722cad9e8c4d1791873fa57dd6bb0e905f94b3b61b819b69efb5e8e94e50bd7668a0f60931b2e249c229e92108cd51406d17375c7f18756bb7d52

    • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

      Filesize

      581KB

      MD5

      f1f83c9e026bed096f20b38ef1255b2a

      SHA1

      1f8337d85e1112ede780fe402c93b542a04847f9

      SHA256

      d11b98617a7f9f0f3713727fa33f10b4698b00cb619d9b70c6039fb44f239762

      SHA512

      61f651f347d889560a28c68f83cf2244c633adf67e4dc09470bf1dc1fdc45eb4789c98766546e5b939c42d8489bd92d2b49cef74237abe7f07aec55f48d4b9a2

    • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

      Filesize

      601KB

      MD5

      be7a6d38fdd5d4c46b2fe563e11270ad

      SHA1

      8e3d258d71939e04701ac009a4928f9eec9964a5

      SHA256

      4cff9eabeab373bde2d24f2086dab6560253057c09168c92f8c4ccb1683b7ca3

      SHA512

      942efb57375778dc68434404e16d82400b16cd38197caadfe6c25f68ffaabc122f018b52280a18dcb397ebcad1cdef1b98177b526a24c5082ca56662abfd26f2

    • C:\Program Files\Java\jdk-1.8\bin\jar.exe

      Filesize

      581KB

      MD5

      9c2e1836e882e307bcb4a550bb35bcbb

      SHA1

      0451026e82ef0f070567c4be9be095be4e844090

      SHA256

      7eee4237308d0564ce67c7d76bfbec2b8605c5165624e6682fc77321580a1be9

      SHA512

      9d81df2f2be713a1ae54ab3524c43a2f989fa9ed1054a75a2e4b6efa3297b3a2f2e3ec21e801b2ea29ff374c982f19ba7b8a780a2b0e7721baa5654064c8539a

    • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

      Filesize

      581KB

      MD5

      f516a331f01e0d5546586f15afc48710

      SHA1

      bde8c96d71e99663c40c773fdac1cf64a6f08137

      SHA256

      2b03d0a2b729e9c19ac0ca2065dac239f4c4dba0d5d41597ee438fe71aa82fd0

      SHA512

      f9a2efa96cad1fd00c83f44b16f1bb1d5f87e1e385003951daa642c6cf2cec8ed67e15ee0b67d0f114ef2941714ca9ada700918e9e9e0bd914cb2e8c91952b32

    • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

      Filesize

      581KB

      MD5

      f1e21cc515f1726d252421e9206c63a9

      SHA1

      d7c7a49e906e478a92677d1b34ff172447d9b7db

      SHA256

      3f2836762fe4def00a9f7f8a37c7e00d83de078605dd1476989880ddafa2f4f8

      SHA512

      55061c189bca66b44ceca2eb87b71181c57f213534e829366681e34cd5bb2efd4e221273dfe93066bc1c55d49ed4c0ea037b4c17020cd6dc5e19cf290d9b74d7

    • C:\Program Files\Java\jdk-1.8\bin\java.exe

      Filesize

      841KB

      MD5

      c9c2cf3e7779b10d76231ea45c07778e

      SHA1

      bb4b3fa1c799fa9c5b603ee677e8df2b6e1067c8

      SHA256

      88fc308130ef109faa53b8ff10860d173589b426b744752ec27d8cc74c585199

      SHA512

      f05068381f0ad1152ed9117bcb75428611c7b79727f15976ea40a1dfaf3a25a95efcd2f1f4348a086f9563134c48ae49d0fd37546f3105c889e206a27d2c07f4

    • C:\Program Files\Java\jdk-1.8\bin\javac.exe

      Filesize

      581KB

      MD5

      84d2aca7c1e2100e1b40452b06b7d17f

      SHA1

      9caa09d1ec955eb8d1007f66ed71df854b8f32a9

      SHA256

      e1c2f54c2d43e72b9e4bab4b62bef62e1671115a8ee0be4272badd4a097bed72

      SHA512

      4799d47edf4d635e0c6177da4a9ec8f620c58944ff6a3c1714c32e01ce6468812f391cea098c06b1fadd5c0d86cdd57f986e5ea8ca62f7f39d1bb60714008524

    • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

      Filesize

      581KB

      MD5

      f14906c651c2d3b6b08df8b95b7ba755

      SHA1

      fd46c71621bd14b4e9754b5514e3dfcd584c4bd1

      SHA256

      d90c3dcacda241af3736778d1fb117caa2fa23b1e9ae821b5ee12257f549f85a

      SHA512

      5f428adf29eb71a62ffe3cae6452405f1ccec634a9a57ca3ef2b0ffb6b3acac0edd606c2713aa0c61a740971b586950232bf81265b41cafdf6d1920b7c2b6601

    • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

      Filesize

      717KB

      MD5

      8cae7577c1092f55b5b876153ff8c049

      SHA1

      5ea4040a229c6fd2374c7dc35fda04e201daf1cb

      SHA256

      1c0e6fde61584817f7d49f712f5f41cd2f461fa079b522e81743dac21dc79601

      SHA512

      6d2fa9963b1a294429b9cdb25eead07e1a383c7f55f27fc4a6599968c6bdc057e3109ac23426c564f75ae7ae6704f3f380d99247eaffd53b6958a196c53fc0e5

    • C:\Program Files\Java\jdk-1.8\bin\javah.exe

      Filesize

      581KB

      MD5

      46900c68cc99f293ad4307004c39b136

      SHA1

      39604b1893aa6d3e755fb92faad2c57f0c36b94e

      SHA256

      49ce16944fd85a75d582d63c3c15dd9cd872d0835653017654e5d725329becbd

      SHA512

      c7168d2af91dba0235c04f3b560bfb5f582c19a03bd508ecada90c89f6a9ad165f687e2b6c2663ce00884fab404ec3078af5f2c3da8aa732532211d71de5183d

    • C:\Program Files\Java\jdk-1.8\bin\javap.exe

      Filesize

      581KB

      MD5

      c23402cdae1137ddd5d96aec0e690210

      SHA1

      9cb973b1fd18c820d45fc0882b24c5906e719b1d

      SHA256

      f566de3bf8aab13644e2ce9c8e1b3652e5261af920a68f2b9121118fe4c5669e

      SHA512

      41d7f7fcb7a47c015f73291779275ddcaaedc7c61ecfe7f386bba815d0e2d94cfda01b36130f831f22cf372daf2898ba07f441527a3e6ea0d344a020368f3918

    • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

      Filesize

      717KB

      MD5

      90f5eb95ab841af306141225fd68b7be

      SHA1

      b75eee71e329b87ee8228f55284e0e44060e3266

      SHA256

      30767451e62cd2ddd807132707f678551a8d76ba9e7789eda3c8e9d0ed843325

      SHA512

      1a03578990bfc1dc5cb4bcce56f9cd2d05d450818cfe136fb387490145fb656716d3d6e9d9a174400e00d70b738be8c3ffe9d7d5a6ba347d5da232d5fe426572

    • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

      Filesize

      841KB

      MD5

      784ea7160094aadcd2640f08824a5183

      SHA1

      beb64239421095c931d9b96c5a219df8355e024e

      SHA256

      29854102946b9e4a41fc7c80ece8152e97a4dd46b91f9c3284066f3a10e2b88a

      SHA512

      b9a384871531f436d8b89852e13c36c7f5b2a18ffa01ccb768cdfff1101cc6457f7465549f9f5fb3a8962f4098d8a5b27c3759e25e15535d4c4c12107647bb87

    • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

      Filesize

      1020KB

      MD5

      bcf6ed992b452cd88e93fc247bad02a4

      SHA1

      f537a3b3fe0ecda88dfea84e2c6e2bf17207c7bc

      SHA256

      566ddc016f13d5d3441b4f90da8c9db7d26f60cf408e2b508e645f30434d7c23

      SHA512

      c170803fdd175e75c263fb28f14cb5539b7aa38afba9dd4958f32d69766f4461bcea055ce915e1304bcd66722dbc90d2dc27971cea93e633baeee3a850421fd8

    • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

      Filesize

      581KB

      MD5

      1852df6eb988142a7782a95747d1d9a5

      SHA1

      27e28275dfa2821378bddf13bd23bd52b647f300

      SHA256

      545a18aaa3807643f92153f3b4eef0794378840e9d294288ac23b400c2dcc99b

      SHA512

      25c60c4330cecaa2a3c3f8ae0af38799c50e91f476782a09d9214f61604b3594580d8d75b73de7bd3389a297ab2a06ee046c7a4683d5cd4a9b27f10e48f8ac80

    • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

      Filesize

      581KB

      MD5

      945db26f26fd1a0781fe545b90cd0ccb

      SHA1

      b37fc608d4954993f94635d21bf77834c57101b7

      SHA256

      a4a1081091e41204128b988601ddd66e4bdffb4bf3ef2aa3a10c5b221ef8253c

      SHA512

      fcf92c462c7b8c60d7fcf189637fef0018b5b5f5b692ca5893019d6a68dfe76aa3094107fcdc3ba9e202f2e2cf605ac10cb9bb724328e394d8075011bdda417e

    • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

      Filesize

      581KB

      MD5

      f9abbdfd5e0bff2bc93079f3144f7091

      SHA1

      22908c35bca55c077acf2d4daae9381fef59b211

      SHA256

      061ffa6f48c0e990a9cee46b54018fd1524cb1f15c1c8414fb4b9f09e82585d3

      SHA512

      ec450c66ef897f65eefb3c343f6709ab0013d0bce45519f0a0f13764b27e8200a0e5e53d7d713096c0d1370cab6cfbd504be2d96e8be397fb40805d08953f303

    • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

      Filesize

      581KB

      MD5

      be3628c134c60f7bc61ce1d45d2a8f95

      SHA1

      a7f4e29a3a95d088c77b795d7f49bee58e17f396

      SHA256

      33cce4d8bfe32d791fdd91b4e11fed34634ac68e0c1732c2f382ffc7646bc550

      SHA512

      9b8af8b656abf95d9ce4f8bfdd3205486d2323669d360f31f3582182df105da09bac27f5303015b21e4ce69e2382be9515ec3c50fb35cd0c5119e0fde1ac7643

    • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

      Filesize

      581KB

      MD5

      e71ed1f658c614e5858fdc02983985b2

      SHA1

      c1ce1e065c53e205c89e0edbc05edb1516df2768

      SHA256

      42857a5f64bcbb0b88ac25c6e033efecd63f2b0249b85f78dee77dd7614dec4f

      SHA512

      c5e85e79aeb123913297cdc320c5a2cb30b6c91e76dfcbea96042c5737582a507593ea5e17d27f5ea6b7de7fab3285992f1e450a84bd6a778364f5f262697ac5

    • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

      Filesize

      581KB

      MD5

      9ce60f7306e5f9b9f3127b897bb8c7a0

      SHA1

      ac6d8a376834b48b80974ef675e35081af0f34e1

      SHA256

      a376e91700285f21202113aab5158f1fa8a9b024878534fcd2f62ee9b601783a

      SHA512

      ec81cfac747d93b2d4713fa7f94bb46e8fb0148633795a7831f44a5b984fa7625c17dfaa5c80d170f556aae64fff0aa34872a7c47e39b753f26a982512ca6a81

    • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

      Filesize

      581KB

      MD5

      69ea1e57eff73068ec7eadcf60ce233b

      SHA1

      e8c864a0967d1aad3c45dddef5ae8c1fe2ab8ef0

      SHA256

      b2eca41028a889aeca0c304a4a75cabf7e6bcba788cf6e377112d4764c187c3b

      SHA512

      d5ba942949066717ed8fc2ef9ec293e3e995bdb84be446cf1285248eb8183fa528c593a1ac28a57e817dcbfb962297d94fff647b487498fa2e9a84cd0a6cb759

    • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

      Filesize

      581KB

      MD5

      936040d74cbeffa9f2195022fa0cfcdb

      SHA1

      5b5cdc2591a39d53dd3760bb2f8b7bc45a579c45

      SHA256

      a22e8c303a5ac54e9b2076d100b17f033b07793a59745640bd023cf2a19f7a06

      SHA512

      5b4c033048525726d6219ca92e029f43dc01b79d23e93c306502c4c1b6155076d714be543e6db7f25184224d3b0e67d96221a9e04387707e0aee2853f4399993

    • C:\Program Files\Java\jdk-1.8\bin\jps.exe

      Filesize

      581KB

      MD5

      f9d93cae680bb4d75d8a65a7d821bbf4

      SHA1

      6a4197d2c0ef04904e17536709f5955a040c8470

      SHA256

      4339358b2a03abbef0561b18e479ec6526a1bbd24cf7d75b58e6918a50012d30

      SHA512

      45a2128c2c09756c6736edecc6a8edb3b288f48a002be972e6bbf2aa12892d9c26b79a2cc85337ec2d40620efd35ad8a6d097eb8c1ed207bec6263366f4b4c9a

    • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

      Filesize

      581KB

      MD5

      bbc3a08f8b60967939e3ef1f2800dd84

      SHA1

      09d40580019f2933b92f8c1f5fa4c3830017182a

      SHA256

      77aa2a00dcbee782342fad8f20eb1fc3a57bfd38bd39816fdc82a56840fdab7e

      SHA512

      dbbbbfc7430ac838fd0ddb4aab6c5abe6c4445d86989678b3870f8a04f69962941a3d9952dafad9dd0b6ecbc307ff461e96c65940ca86d6f025a41a8f07b9383

    • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

      Filesize

      581KB

      MD5

      41d135068a2e2e8888daa5d44ded34e3

      SHA1

      9bd42188b1e1e903031498c6fdf3b2aa2dbcf9fc

      SHA256

      a2a1b0c749671d9d08138a98283fe2ed95de9ba93aeef077569533971532fff7

      SHA512

      3892b787c52d8496fbb891369fdf0938d348a8d5039ad01423b3cc68d84360f3bbac5ee1a58047b41e299d9a6d724770139304e56efc70ae186a9bcc727af4e4

    • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

      Filesize

      581KB

      MD5

      f15f1335fa01b20027d861d060d13bb2

      SHA1

      fab93e2d671b292739436475a57f262dd9775d70

      SHA256

      c1aa6343d424dd8d18d8044342285ee9f5239c88525d88bc0d6955d5092fd1ba

      SHA512

      c84510518184d665a2070725021a58181afa7d6baf371d9dd7295a3cd038b9ca8f90167941c15f20a9a64d43aeb1841f51b1cb5da38939dfd6d0577d2c35cda5

    • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

      Filesize

      581KB

      MD5

      3c265ff54137ffcc569342510dba0ca3

      SHA1

      12a8aa9dce0ba2cd3b12702820d8e4a6ff803e14

      SHA256

      7d2fefe49dd8d2307a90849351c028e3cdfef381438b6e1759c0f8dba793d2df

      SHA512

      5b5378bfe1e85f4b40fec79dc04a5f312cb05a4000cbe734683ad43d80fc4771ef3757bfe90d12c1467de233f43e46f728f918721f16b0778da56fe2ed2581aa

    • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

      Filesize

      581KB

      MD5

      0cfac70398162289008d37701da93bad

      SHA1

      3a63e179a8c1392bd2f0b227d2240e95cd813136

      SHA256

      ad4ad977479376f0f96cf5b47bc30e80200299bcba38d1dfb35a4c02e868eb68

      SHA512

      2d9f8470157163f124afff97f86d77ad80e8f3d96d91e94bd79406d34bf09ccc0091f433cf3789e2240f36cd6bf3478e054164d39ac3b72be640073d2b5dd68e

    • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

      Filesize

      581KB

      MD5

      905f5ac41189424bdde34949a040cb77

      SHA1

      293be0a80e137096b9b80e306212de3100f0156c

      SHA256

      ce7174f96471c158a25a0f37e60a846fe69fa9916064f64d747745052a4540c5

      SHA512

      7bece98f5b726ad9229f2fd7b1847cc0ed9c93af3111ad2ffce5877aa88646392a97cd8f50bc9421dc121ac1d6129d1041e8524a56fb7b97fe777c1e1e68ebe9

    • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

      Filesize

      581KB

      MD5

      36b521201b0e6c520bcd71e462f2c898

      SHA1

      302d2b275fe633046f1519526a24957127f791e6

      SHA256

      10db37868a67bc1ac34b9f855c72d158dde08c69168a6461c8575f3d5d99743d

      SHA512

      e1552eb4ed247d6b1286d7995e7e00aa54690e80dae7041d92580ef715e9fef77504ad4a5319365f85ff60b7c7d7c5179101acc1a31f2cc1dd4523f7ee837440

    • C:\Program Files\Java\jdk-1.8\bin\klist.exe

      Filesize

      581KB

      MD5

      07d4b16b655d8812f9dad9947ef6c2d3

      SHA1

      4f6579bad5eda91cb06560a39b9a05122435f142

      SHA256

      df225eaa88dfadea011306ac5c111e444e72a48e8cebdcb909447de33078ab06

      SHA512

      cc83c94450af786c248807ba0d725cc4e282112af8ec609adfcf9bf93ea4a3ee8e810971aa20f6fb7206a9f17b417f74fdc3f1b11b9c815924efe81fe48c348a

    • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

      Filesize

      581KB

      MD5

      2e4f90a3fbc1a8fd07a271dc0d2f0023

      SHA1

      d8949dea05ae0a22c67836ce2b6611f5e97be0aa

      SHA256

      c6835229508186abf4a55e3f1cc95ed968b080586e398372088f34ce5081b8df

      SHA512

      2d2bc7379c3b2add300be0cf4d8e2bebb37857b15574fc382a55191184a3d00ef88f342ba17b9cd221b7691955b1950e802b872921570148b1b7e239e3f62494

    • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

      Filesize

      581KB

      MD5

      6ede16e4ee9c61c5bbd50d3069bdfc94

      SHA1

      7c8df9bcdb15202a3b408ee429d2cc4e447ef097

      SHA256

      2fbf0f8134d36741d2e807386080a58184d0a53b571e53ccd309c5ecb72c4903

      SHA512

      e3a838eb7fb8a18197c8f80843c19ed646206c852a5839f4e94c2846f634b63a5c0a6489bbb6cbfd4668ce908a9e28d36df3a2d76131870ea194dc97b79e3c9d

    • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

      Filesize

      581KB

      MD5

      8f27450259cd7bac8f20219432e9d2b2

      SHA1

      6c66ac51ac55b9e075411505baf27bbbd4429047

      SHA256

      2b5bdd9002605eec898bdba8911415a6c9e5123b39cee453f05b4477d847ed6d

      SHA512

      a0a6def19f1d46ee5808e94c5923c6a278f93f7f080fc3bafc81f373c169473ac04cb6f550c582b73d201201b27e3c9cbcda4a5c1e46cdb20fb97de6440c4489

    • C:\Program Files\Java\jdk-1.8\bin\pack200.exe

      Filesize

      581KB

      MD5

      fc85c0a117c3a1ba34e2a02b3400e64e

      SHA1

      05193ee50de570e9da67e9e2cbf1c46faab55821

      SHA256

      014e73e564e2ed273f4c1ff3f51996ec5bcc68ce1560be1e282981b4be7a6400

      SHA512

      510c5be735dd13fe96a0d954269c9eed2b5e40d9b4a3ddb6d573beb10b1a04a8e4da03b8897a1a770f9bad17f1815998b566e03811a6978cd8fbb410e1a523ac

    • C:\Program Files\dotnet\dotnet.exe

      Filesize

      701KB

      MD5

      4035b4a255ff6998f41c08f6a9377877

      SHA1

      cdbf87e6ee4410807a0a0fd58dfe4748c745f2cc

      SHA256

      0b995aee70e6ffb3bbcebe183306d671c92909479edc301d2c1bfc9dd6fa9f65

      SHA512

      4b2e80b978d14d8f3858ba06097f1ee48aed96b0c04a12dfe60a295aa622e1ac84d56245fc5327aab8e0b1d99593c6524b86af5b96a44718887bfd1aaeace903

    • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

      Filesize

      659KB

      MD5

      fcd5e60ec82b3be3d582052a286feb97

      SHA1

      8ac8fd658bc547d56dd5ae7b600f20ceb9664175

      SHA256

      821aea94f2bae8804646af97fdf08331ba707d75ff62ba54f8f5272a78a02221

      SHA512

      6dd9528513f4099ff048f3acc389d84cdbbf85722b3f08bb31feab22dcdae2a24fc658ccea651fb7d873082868cb33f52400bc00bdca5a43dd2b79686ee74a21

    • C:\Windows\System32\FXSSVC.exe

      Filesize

      1.2MB

      MD5

      487f40f3d3f21a2512a0e4d23611bc68

      SHA1

      11867fd52fe491fdfb8c43a23819e2a3a994f209

      SHA256

      49d26060d2ab7ed7222cbc8113762d8400b2dc46d56fe309d77c5368c4251184

      SHA512

      1d6ce4da19b5e414e9e555339a629099361417af5f293832bb2346d2d3ab760b6879b9820919065209bf4891f8cf3865b9ae4d611fcefdec2a36ede50c48021f

    • C:\Windows\System32\alg.exe

      Filesize

      661KB

      MD5

      1c548ca9f01aeb53662ad34aea6935bb

      SHA1

      95e914887f3721b730f94bb33a5b894478c6c527

      SHA256

      383f588bf32c45587c3370d2071d97089b85e159007540d43a69e0f7115e6050

      SHA512

      1d452e3aebee046f13e5080702a8bdd3f01e1b389aa233629adb35faaab2517f2619972973e5e84bdf6d1ca9c8bc8c1ebe3ebce9d790eb60423a685d5e546d40

    • C:\Windows\system32\AppVClient.exe

      Filesize

      1.3MB

      MD5

      02466bb9668758d45f07a9867660eb67

      SHA1

      baf3a091996eb65d7e82f6aa5a82e0fef8d86f9a

      SHA256

      2c8cd113ff1974f18813e2debc43db6e90d12b70b0c27fbe14dbe38f2840c48c

      SHA512

      7bad78c24a3bc5ef4eef525e04b9fdeb8207ba05e1839ea5d51153e4d33579972adcf70fdbd4b6613d0e8f6a07916152810ad2b1fa62342c6ad55413635fa09b

    • memory/2008-252-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/2008-82-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/2008-73-0x0000000000440000-0x00000000004A0000-memory.dmp

      Filesize

      384KB

    • memory/2008-79-0x0000000000440000-0x00000000004A0000-memory.dmp

      Filesize

      384KB

    • memory/2032-59-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/2032-51-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/2032-251-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/2032-57-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/4100-62-0x0000000000CE0000-0x0000000000D40000-memory.dmp

      Filesize

      384KB

    • memory/4100-68-0x0000000000CE0000-0x0000000000D40000-memory.dmp

      Filesize

      384KB

    • memory/4100-81-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/4100-85-0x0000000000CE0000-0x0000000000D40000-memory.dmp

      Filesize

      384KB

    • memory/4764-21-0x00000000006F0000-0x0000000000750000-memory.dmp

      Filesize

      384KB

    • memory/4764-247-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/4764-11-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/4764-12-0x00000000006F0000-0x0000000000750000-memory.dmp

      Filesize

      384KB

    • memory/4900-83-0x0000000000900000-0x0000000000960000-memory.dmp

      Filesize

      384KB

    • memory/4900-36-0x0000000000900000-0x0000000000960000-memory.dmp

      Filesize

      384KB

    • memory/4900-87-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/4900-45-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/4900-42-0x0000000000900000-0x0000000000960000-memory.dmp

      Filesize

      384KB

    • memory/5048-25-0x00000000006B0000-0x0000000000710000-memory.dmp

      Filesize

      384KB

    • memory/5048-248-0x0000000140000000-0x00000001400A9000-memory.dmp

      Filesize

      676KB

    • memory/5048-31-0x00000000006B0000-0x0000000000710000-memory.dmp

      Filesize

      384KB

    • memory/5048-33-0x0000000140000000-0x00000001400A9000-memory.dmp

      Filesize

      676KB

    • memory/5092-0-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/5092-48-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/5092-1-0x0000000002250000-0x00000000022B7000-memory.dmp

      Filesize

      412KB

    • memory/5092-6-0x0000000002250000-0x00000000022B7000-memory.dmp

      Filesize

      412KB