Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2024, 20:03

General

  • Target

    b4d796d242795a82b43cf75739464693deac01158b2670291dd7dd6b9b6fcc9cN.exe

  • Size

    720KB

  • MD5

    e2783f37bb311472dc7fc9d08451b910

  • SHA1

    a3d7ccaed53c283ac34c9c63d0c864dec5aed623

  • SHA256

    b4d796d242795a82b43cf75739464693deac01158b2670291dd7dd6b9b6fcc9c

  • SHA512

    9c636bf0e11e07ef4d6307af82cb5cf06b04d6e9c402f39ec0d708feeb03be0744e3bda1875d499f2d1bf1209452809777f03b0403c2851bbeaa00981c8d8784

  • SSDEEP

    6144:MajdMJyFRe6azHqTG5WbWxF+WR4VyKh6gks2YdvcD9GVmA2BWPFjEN/h:x2JylsKTfW4VyPgPrzVhnFjENJ

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4d796d242795a82b43cf75739464693deac01158b2670291dd7dd6b9b6fcc9cN.exe
    "C:\Users\Admin\AppData\Local\Temp\b4d796d242795a82b43cf75739464693deac01158b2670291dd7dd6b9b6fcc9cN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Users\Admin\AppData\Local\Temp\b4d796d242795a82b43cf75739464693deac01158b2670291dd7dd6b9b6fcc9cN.sys
      C:\Users\Admin\AppData\Local\Temp\b4d796d242795a82b43cf75739464693deac01158b2670291dd7dd6b9b6fcc9cN.sys /zhj
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:412
    • C:\Windows\GOG.exe
      C:\Windows\GOG.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Windows\GOG.sys
        C:\Windows\GOG.sys /zhj
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    1.2MB

    MD5

    105f61b95c3c20e89cbc8f2179e0f081

    SHA1

    a5a4ea9162fd6cd3a8a368e42b25dad7b8a7c4a7

    SHA256

    21f6bb6032face8ee2a6fd45dc395dbc11633f6222675d570a14fa088124d39a

    SHA512

    2774434a85b6e6182c6c3f4557a3825e747186e3d54ca9814bb25dbf5aae26919290fad2e959462dbbebb39afa7cea6d180ff411a5a9aeaaa3fbe415eb4cc128

  • C:\Program Files\7-Zip\7zFM.exe

    Filesize

    1.6MB

    MD5

    60c24f2cfe16004706df89e6023564d1

    SHA1

    5b3917b21a2368c587d665cb7fc390a15cb749f6

    SHA256

    72a5a685173830015e919e260fb3bfa414415b095e9e545efd7f066ce983f444

    SHA512

    8cb108a279119cc02dcee2f0a18962e288547e733952107776c11163348e3e4bdf186a527208458de070230191c15f7dc58e7e7cee211db0e9353d4474fc167b

  • C:\Program Files\7-Zip\7zG.exe

    Filesize

    1.4MB

    MD5

    4c2d0e49ff858d6ef6607559d1fed3d0

    SHA1

    bf55828f0f811c032e5add7fccc6fd411c8a6a0d

    SHA256

    d8814ea3bc87d5b9d6760e419feb309c739b9a894e522587de162b2fd154bf40

    SHA512

    33ec1cd61fdeccad8c4d30fd2d888633aec5124ec7705c3364d9e64f206c9a5d8aa8bebcd1c465cb5aebc0281978236d7d15fc3a041e498e0fb919fc0ed991fb

  • C:\Program Files\7-Zip\Uninstall.exe

    Filesize

    734KB

    MD5

    91f07866d0a895b7056174d23cbe6578

    SHA1

    905f78837ba94fd9ab68c7dc79e8ccb4bb44acf3

    SHA256

    88ad3437c6ea57ebc24da7b9caf798d24069bcdcbc415d7db2b34eb48fad53d3

    SHA512

    7706d47e292615081ad316cf24afae56b7b30e7db45d41e53bfb52423666927e981f65dc1ec0450b1a5e7af0d2b1fc8e3ca2ebb5877de10a69eec984d59ca687

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

    Filesize

    1001KB

    MD5

    b4761d559d2d4bf74282a9e6bb7ba203

    SHA1

    945476f111984f911c20efc5b78baadb64b12649

    SHA256

    5f8b85fceefd14c5c7027a3e5476913ac145a3266264c5fa8e55a9e30d4cb2dc

    SHA512

    8b0bb5fd9a5975d4c8c03a8297ae6685c03acfcb9302ca1a7e727d5f18f73b8dabdb1a58d63222beba2a83f3cf83ad3984102f98142802b89138a6a67937f8d2

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe

    Filesize

    767KB

    MD5

    b2005c3000b5a155b69c50084b6099c5

    SHA1

    d6b3c0b8c9b717c588597055dd9d73cf25c5e91f

    SHA256

    dccb6dc984d692930edee5d379f1cf2f13376262849a6c6b1593f357b18fd853

    SHA512

    ecf5ed05c5b3d93cc665e9b6098f8b7be67d865eb85ce247642e139b52e4497e4e4481643c2b4dbcb8bfd13e85407ee89b989ee5cd8ac51bbd574a5b7d5d9d9d

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

    Filesize

    1.1MB

    MD5

    76afbbb8edd47208b5752d1411cca511

    SHA1

    4838f9f33204a41a275bc186359372029790350c

    SHA256

    5b7c572b32ce42b6ffbd8826dfc97843bc89f5cfab976a5a2e108f911058a923

    SHA512

    0e83468f032ee7d2058beccbe7db00805beb1596da3e771a39983ba3960ca447be7d72f7c9ec653ac6984a068f4e88813a46267f79aa3f2121ae7dc51ac87911

  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

    Filesize

    816KB

    MD5

    dd90c69d4fcf17f150713378ade19548

    SHA1

    6b892dac463ce5d76c102c952ced30c844608b4f

    SHA256

    26f9e8320decb60e73b47d090c0da450c5575c7341012c6dd08a7832f2860cce

    SHA512

    395288b7f5a46d3d801d9d73aff1b33e74ba0ca2de0b10a3686991a4ed5c2fed52d976c9dfd2bf120c92d2f663e98373674d11db7905b1c03ff0b88ebc2d825f

  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

    Filesize

    4.8MB

    MD5

    37240327cd9f1873b6cd6e90d0f45a0a

    SHA1

    eeddc4871f518c18895e95cf1a1e5034c6bd9eb6

    SHA256

    b312bafa08bfa11a0cd47e881b953f705e628d015476eb513e38fdba81601c46

    SHA512

    dbe6cd03bd6eb295697e32162ca4166b4ac69c0b68ad420abcbfe161c916dc7ec084eb960facee5c2acbf68246e482ef96791f197a4af1dbe7beb2b41e9974cb

  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

    Filesize

    2.0MB

    MD5

    d9e49d2c6a8cb87fa1104aba42dc7bb2

    SHA1

    2e39e48566fcab19718fc8102ce351bf676f24a8

    SHA256

    fb5b3cc125db08a978fbe6fc378077dffd12f9b73487fda4f93f8d05fdb86b9c

    SHA512

    d6275f49a3a4fe2cd6a2bb4695981c268615eab805dd215f77758aca2a84799b2a922efea3e748c0f0a3648465917fd9fb864ad5f419bed5ff7f6ea0f18974f2

  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

    Filesize

    2.3MB

    MD5

    45c369e944842f0c1e535486c4c0cb84

    SHA1

    1378c242d9849fddd4f613cfe099d9f4e7d1b66d

    SHA256

    a4f49dd4c6e02c38a528d5626cda1f1090b2d0df5b5e3f1e5ba7b195e2ea2dfa

    SHA512

    0b78e1b94200c46a94d39ad7cf857b842663cec882454391a7a39eccf6b3efa81a646719479b5247aeea41ba0d538cb17ac4400d9f4e929c9f77d214c1f8704c

  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

    Filesize

    2.0MB

    MD5

    ae5371833e8184b5aa3b5ef4230b0313

    SHA1

    affdce11d9c32deee431a71c41ccc6c557b16ee1

    SHA256

    d38d731452942d3b2b9f953ed1472e75afb37a7ce7eb702ff8a7fdd7cc01a238

    SHA512

    741d050283f949c3dfa54a5723171b2483055f46636c99be909f474325f721ee0c70ab5fd512e5c26b748d2f2d5d856b9e9fe341e4c33fd1878acbaafdc8035a

  • C:\Program Files\Google\Chrome\Application\chrome.exe

    Filesize

    3.3MB

    MD5

    7d3f56251725c3e4771e97843ae07a0d

    SHA1

    26225e721b54a3a46b51377d0d90faf87082336b

    SHA256

    492ac09fc0fb05e92b8cc5ae49db851add281dc650b89d1b2c3abb4cb4d4e35f

    SHA512

    d755e2644a0ba9bdad71b7bbca9412825ce81df0274d63392a1fc021edbfff647563e415fcfa33878020b63cd106c9deebc9fdf73740d9b187cea2004f6ed551

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

    Filesize

    1.7MB

    MD5

    cae17580edce23246170f61f1f7dbf8e

    SHA1

    8830280c614cbc775761a3e56ef64a8ed9b578b9

    SHA256

    044c52d0f53c211fe5f1953672a3f4be159af7701fb8ffb81a63929d19c0ef59

    SHA512

    23eeee00b08d827bc110bc719ca45579ba9f67599a28b2a45be7653aa45f0e96895a1ccbd711b9efdbadc3e40d50248f03ed57f812f7556d082972cee6de976b

  • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

    Filesize

    743KB

    MD5

    77cdeb61bac1966ca25aca01d056c1af

    SHA1

    667127b68e848a53062975b74cd8b88623522890

    SHA256

    9af1263dc59ebefc3f6a7b566ee431ffa4445279a8489374be72203ddd9b8591

    SHA512

    63b99e55d636fdaab7a987e41e3d93ad335cda07378c82eb1f477cb5804fdc1e4ecc28541f6780aeaa4db4a11107fe65e080d250541db0363d93dae7242e573f

  • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

    Filesize

    743KB

    MD5

    68ac69add4277c35b20e999c377b4f9e

    SHA1

    283d509756b2cf42ec62b3d3c6cdd8657c67cfef

    SHA256

    59e147245397bff00d5ecf509d79cfb913252b13217048361b5b8020fb3c2c43

    SHA512

    5c503f77861cb3e50dbbc6bed3213d305662985dead7775c425327b9c3b642a11f41dafb1e6363db5470b376e522541d8bf76493c1d6abcb1bd54f3af69fc6f1

  • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

    Filesize

    743KB

    MD5

    5af15554eb717ffa6da86a1fcb8ee129

    SHA1

    2c87cb17888ade34b2cbe2e6c92ea244210cf1cf

    SHA256

    23cb721246d963fa57e34ef2e846ef3a62dd3b037bcb98bf5839b0255eb2ac89

    SHA512

    7d2590af863b2c40189657605c8b362a0b075c861005388aae4b99847858da67a3260d602c867ed428e2181ac6ac6571168121a24b6edc178ac4e1a2ab7ff402

  • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

    Filesize

    764KB

    MD5

    ee9e5e887e70387d555166172058e827

    SHA1

    fa7543ed0c3af6b29052057fbd9efff58f8e2f92

    SHA256

    1166ea74b694483ce782092124691ccd72f95d7ac816e7a5e25a395f6ab23d2e

    SHA512

    5a143b1e17ea4bfa2bd3a6c62be44da99076544ffea75e408ffb3b2d99f9d03a23185b937710b2c626ee5ffe1a084aea0628ceeaf76869e566d550230702c606

  • C:\Program Files\Java\jdk-1.8\bin\jar.exe

    Filesize

    743KB

    MD5

    cd1fa4b73aa2dc028497e6a8daa756e7

    SHA1

    5352584b6d78efe3be1ba153a7d5e601a3d632fb

    SHA256

    cec8e4e93f8b0d88800972ddbb28a58ee5f31356b51cc4da8961a0662c372814

    SHA512

    3f7cc685316dd160c4600a7b47d2244b8bbb96d903370e8319c870df73b8ae077a86b92ef55285c13c531e16e82b5a0e92cf6b946b79f5d97a0ea00a8dbe1821

  • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

    Filesize

    743KB

    MD5

    c04d79cadaf65246b495abf35c1f6212

    SHA1

    45848c4d43d7e5129790cd4f90a393c030eeac5b

    SHA256

    30cc082d1091385a48c69fd9cfeae391437bbdeaa5c91fb822057ba49d4f8d96

    SHA512

    be8fa32d85c18cd588edd9c831ee70800c8b49ffd6eebb868034b3a027fde497c78d05ecf72f2fc74e144643ba01951a6a4b9fd0877b07037407feca1ebc08b8

  • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

    Filesize

    743KB

    MD5

    67d7ae0e312327386b14a92246a9cc9c

    SHA1

    684de9fabfb6454456dd4152460f5263f75913cb

    SHA256

    478088b891e8f2388acbf0d918c92695a1c4234945237f981bcb773000423b67

    SHA512

    4fbc5fcec26f8085e7d8dfb17fe0c829e7734b413211d8c787957dfdaa30c91464bbb8a6a9764b39eb470b3cda7b5210307d6adbc404d5196cdbfd240cead52a

  • C:\Program Files\Java\jdk-1.8\bin\javac.exe

    Filesize

    743KB

    MD5

    370aaef0667604558a9c29f4402545b4

    SHA1

    e3af0fdc1335436eff5b83ed3510739d226709f2

    SHA256

    7f9fc71d9a861668d6b76bbcbb6164cae9877661ec4f3ed1fb7ea6cc03110582

    SHA512

    cc1a0ca433936153ddc45778be6e9e221a9381660b9dff0b963bff4f73db181cad207e375904e6f43ea8b83b950263c6d1d1603468c60d618db6f8b0c68f6514

  • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

    Filesize

    743KB

    MD5

    c80118af02955ce30235d44147b65110

    SHA1

    2c4d562f017e78b37efe0c9865ba4850adabd53f

    SHA256

    2a799b873c1c49712ddcff48ca309a375e75f778f0701a4cc2edf696ee6927d6

    SHA512

    ad009ef0cb4218139010acad558dffa3bc901ff7d02fe927b8176ab53751a62f70613eec85504286c021675a308a1d65c5d8f0bf25fcb061e0248159391bc16a

  • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

    Filesize

    881KB

    MD5

    ad0ab0084133df07ee43456e7d4028d4

    SHA1

    8c8aa94b670dbe3130556807d5a60ada198438e8

    SHA256

    6a2ba48f70f1d64269d17dd174cadec64ca8e6d8a8ce9f5be38037001af31b4d

    SHA512

    18cd5e9df06951cc50d59e83546b5723e48f1bb7ad3400807b1fdad0f880505dd69534ec432f6e84b5885a4692c2768954d054c6b0118c8bf16568ef4c37dbc0

  • C:\Program Files\Java\jdk-1.8\bin\javah.exe

    Filesize

    743KB

    MD5

    529e7cf9b8a98ac31a238a52c185289b

    SHA1

    a8ee530cee3233b8b41b4d765af4864ed1b2ffec

    SHA256

    254849326ed9efafc5effb39b5ab1ebbbc27afb2fd2e07e11a72fac54dae9373

    SHA512

    61dfa3d18b1f5bd992c3866c3274004d7e30e6e3984718501368fa3316bc082eae6631f525bf8106fb4d01cf8266c89e54bd5410184eabd763c4960826e162d6

  • C:\Program Files\Java\jdk-1.8\bin\javap.exe

    Filesize

    743KB

    MD5

    d0724fd38af0afeeb129a5836f6d355e

    SHA1

    96f114dd62e98f84596498f770f41c5aaed275a7

    SHA256

    2c66ce11297129d8408cae4bb222fc22e3833e3a614ab5b12721140caaf911db

    SHA512

    3be73e143292e02bff2457323a0d7d2aaa5ffa8ab34fe5ff94d205d2cac55fae56899dfa6a72df28b11c19979e8e660ab802c36232b8c6549b6014f1a21e6e4e

  • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

    Filesize

    1005KB

    MD5

    4262cb4e4391e4f26609944f6b2edf23

    SHA1

    59d4126d2c5e8336ba04fa6b211a6a4023a0f57f

    SHA256

    3d993ffb545dc69484004293be452bd6a1c1b2a3c98df969417ffe13cc45fe5e

    SHA512

    8f07fd6979be5ddf892cbc5f20adb42fe46d0b1521ad072fc4a6ef7c018f09de2c2b00260f2564bfe94402a17160b58e75062b1185b22b5f689259e73de9e40f

  • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

    Filesize

    1.2MB

    MD5

    1fa4cab23194d08b22485c2caf552dff

    SHA1

    7535da63c73a68a5ccb19db86b71cd6116337e4b

    SHA256

    b240eb65c2f4d160279800cae64ec073ea80e2618acccbab425c9fd760504cd0

    SHA512

    b275845482aa8067b890ced4a6c8cb1c3759c340da59677563d7909bdc2efccd91f61b9ecf2fd7b0b92287c664ebfd99427b15cbedbd32f5324c3eaf72534523

  • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

    Filesize

    743KB

    MD5

    baf8eb96fc1b9e1de34c49fe7953e133

    SHA1

    ebe61298f805970cf079e6b342876708bf6440a3

    SHA256

    bb273eba49440b49fdc807039d5386a4132bd30be921872118fe7230fae535bf

    SHA512

    9c323992284aacf401c288deb167d4785e2d16f1788adc28619782688c3fa538bf97ac94a6d450f1b72990a41c006e37dd6bf39766e3fd7cc0602edc7ce501b4

  • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

    Filesize

    743KB

    MD5

    4408bd5abbc7da6877d3e37501242e35

    SHA1

    b71762e37915e3d693df3900ce1bdc54a28366e5

    SHA256

    8109995e9c7157a3820b1504368e9775343e560a2f9c8b26440f205ad427b8e7

    SHA512

    45d27327a2045072d5aaca7f41c8670ce5243d364f77f44571815697913d18be76ca7f21cb9d8c1da866d5183164141773c6baea6fec0bc47db22f4fe07272fb

  • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

    Filesize

    743KB

    MD5

    e6a7c0d581d5642cf42904c5c7657fbe

    SHA1

    8a15056baf5688daa88d5ff53bda9d4a1bcc6d63

    SHA256

    a2f96bbd916cbe0d800f0d56d87196d75cc013a1914f9ef04cebc34984723185

    SHA512

    e8bd12f2d1590d619c338ceb8aaadc178eed1e8701a9741d497adbc38527aced1ac98dcda4c75da6835d4ed811c59110fc5e5f052ff2cde51b3b84f67c6ee928

  • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

    Filesize

    743KB

    MD5

    b00a67dc0a8f77c0df98e64b7288b1f2

    SHA1

    d1862297eda963f6ac91214c71cc5f76f282669c

    SHA256

    1757d5a3361de7898f1c3118ad7927273070b184c961d43c0ca8c1f7032261a0

    SHA512

    de9e64337fbe0ccbc54a3ba1555cce7df35d1b6ecede11dc56745ff54a387f1a8c9d2d36ba014151be912fe3bafc88381444150e1cffd733961ca6183698bfb5

  • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

    Filesize

    743KB

    MD5

    7ca37a0e03b2f85b67dc86054cee09c3

    SHA1

    77407b1b02ae7cdcdc72417ffdbe83724012c729

    SHA256

    ce82001a9760c37579045332a305927d0b54ce2ed90413ca8b38d2f8a3f911a1

    SHA512

    b93af761e28c265201953aff4c39262ea742dd455acac8672040d2821098aff7dbd0744e50ff5b40368bdd52b21236a702ff33344c852086337b4ed4c4b90e3e

  • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

    Filesize

    743KB

    MD5

    126a8cc68a4a1f8840e064fa48675628

    SHA1

    20327bbf9771a62367f7578516a9d6cf37cacaae

    SHA256

    160e0ae8902080b18133e1250768d23f53c14e9b739cef5a673a5b060cd50695

    SHA512

    d90debf6ea7d83383440d1076d1ec0a63966a6a53518631e77d9e28055c32eabedc57ab580e0cecce36cf67dce8849317ddd92afab04c0a97f85bd338f11e295

  • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

    Filesize

    743KB

    MD5

    37f64edf8e086b5c03f01fca6962dffe

    SHA1

    6da23fd428b55c8596b8ff6193de37673fd46a2d

    SHA256

    b1f5003481367cbb1c2100a9a6ebc5bfe5c5e841c2be82516c5eda8b7133794e

    SHA512

    2d40244ccc370e414c3889dcd9df30aea53a950cbb88068038a02aebd4cc81a18d34a053262c245f76117a8339e9c7c11dd0154b1ed0ffdd2321feb3f8f122f0

  • C:\Program Files\Java\jdk-1.8\bin\jps.exe

    Filesize

    743KB

    MD5

    7d2d29ec596febb9dfa7a9cd31896f6d

    SHA1

    58cc578202035f67e578ebfcd4fbb764f2c404d4

    SHA256

    28b64fa225e8e4e54c9100fd2001a04b5e59a5eca2146187dbdb6992d1eca296

    SHA512

    8f9ed0bf62fef67b16eca991c1e35923c96966540a23b9e622e82e36dd3072e0bc899d3b1baa7e79c22e90d707b51f60e26fcc5954b6538119933564b1a16e40

  • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

    Filesize

    743KB

    MD5

    5740ba8f2f9053ee5761f90f159f091b

    SHA1

    7eb7bd095a74305bfbcb7473b4195d8971cd12ae

    SHA256

    e9ed5616a6f6352d8aa61f470cc96e6eda57036891698d8f987716586229391c

    SHA512

    6ad753d41c28bc682822ac0ce307af01b18dec3ddf5cfb3e1785da1e0d1e86ea2be5b32f2d3c0f0dbcf9522c75b74998d1dfc1a0c082acfb4a66a7b99acbb021

  • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

    Filesize

    743KB

    MD5

    de9f2b178aab647bdfae14b94e5ee15c

    SHA1

    ed46e4ef97012463a29e99403a44e58e5bf97233

    SHA256

    db58c02f28b46e5bcadd06bf5d49239c30c8c1780add7fc60f74879fa0f591c2

    SHA512

    641b907dc5886a974b9a898b1e91b3bdba9b3533bcad4df6ed533148b5d6033aeb841b2684f9521440d22d7edd1c5da52e7a9b4359b1aa411a8cc42d2538c72d

  • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

    Filesize

    743KB

    MD5

    235d10a354e36600496f8414d446e153

    SHA1

    540058e2405689772c4de57f882194f4e4e21819

    SHA256

    4faf789cbf0902f28a5713b70c39967d87c2a7d213794e3c9b7adc46f5742abd

    SHA512

    61524047f45f06adf50bb9819323ac5d86e617b3bbb594843316e02dca732f4aae8f3c863ad81d02e78d6945117dd3cb93d3325b97377b956398b4435d6e6871

  • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

    Filesize

    743KB

    MD5

    4dff4beb9995746ec92fd51b93b05809

    SHA1

    fde316de15d7323a66862038ff39c60b91a22ded

    SHA256

    16cf166fa31d686d99212f9c37e92e1d786ed1fa465d6c6c40116919b3d07c6f

    SHA512

    26efad9dad0edc2c0bed39de586b8a8b82cbce8676c5a8b0caeac5745d9e9dd706819d64fd9f923d7e5ba5c420bceee1bac60737549669e353698e15c9f49dc7

  • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

    Filesize

    743KB

    MD5

    4c1fb651887b63b246f76f2c8d3cc3be

    SHA1

    43a0863a64d5d974a61ac01003376b5aad37eb6c

    SHA256

    2ced3d46c920288ed8ff980b57fd8285ce9ea2c795ca6dac306d0bf8da747f17

    SHA512

    806881708040f1c650ea328842e2da489d45c5b0959334c1cde7d64bc34a72015769dea5722b01d079f078ca503662d712bac2b3187c26e43052c52210e6a57c

  • C:\Program Files\Java\jdk-1.8\bin\policytool.exe

    Filesize

    743KB

    MD5

    0beed429db998820a15346b99fbab028

    SHA1

    ddb3a72805a65a1203a343c884f0e9b4817f972f

    SHA256

    db6c68c29eac1a44467370fb8498e5dbc2694511a6d2ae44e9f462c035103379

    SHA512

    6b4fdfdd431ddafa23b92ea9a9bde75bd501a2e8dde8c5908a1c6eb077fffe474dc3d8d10bd637ac6af3b87a57d61782fffc22676da463df0a2ba73b0c2934ff

  • C:\Program Files\Java\jdk-1.8\bin\wsimport.exe

    Filesize

    743KB

    MD5

    583e59bc49d53ecfc0ccb33e8ada0672

    SHA1

    fe658b3432ce63e80db22e7d91099226ebafeaa5

    SHA256

    e8aff72121a748a5824f1a55aec7467e2cc1492808fbf0f590b470da2cb454df

    SHA512

    8513a12e4210e2e071633994b9112f8c6b790b27afecee5f3c042c28b78e54b8fa2499c2c1d0ef4df3a8e2603381f58a36516dfa3e93114dd3df1100ca503889

  • C:\Program Files\dotnet\dotnet.exe

    Filesize

    863KB

    MD5

    792b6b9631039b7c12a1b381546af62a

    SHA1

    8a80c71d3dfa65cb9b98f9751d16a15d2bb8ad35

    SHA256

    6a25b9b18f420886ecf7b5cc04c446722bdc73fa9d39963d785847943f59e6aa

    SHA512

    9acd2205504ca7fa259a6f3b3a630eac6e09e00998fe0b6ebf28fe196b024aac00f643dae26304aee3c439495f24bd4d83717e49a6f4c3b22ab8934486f95411

  • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe

    Filesize

    776KB

    MD5

    50b7be381bb3569063f2002615fbd6da

    SHA1

    37e2a7e2a7a05aacbc969b9e541db9e284570900

    SHA256

    aac3d601e44403010721fc0c708279c82e6c97d4a02ffac0f8fd9651eefbc03c

    SHA512

    b7d7f7ef9328283adb1172b6c35c457dcd4aa77b4487eae077a096633580fc01f07ab7bac4cbf37e9079edb2968f99b474369483ed779cfe1a6d1aa10696327d

  • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe

    Filesize

    784KB

    MD5

    c926f50b038b27f3c63d9045d5da661b

    SHA1

    8b0d2eadfefc4ec19e73474778eea5f96fe0f58a

    SHA256

    81ae48b23edf64ceaa4571b3446fafc85690c7d3bad718b86e9b45d2f4fcf252

    SHA512

    d4dac435f085174c068155a2c4e74f6f07c7a74f647f16fb1c88300fe7ac7e5d48196dfbe4f251ebf2e259d97d001104589e97e4fa874068878bb9c32633690f

  • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe

    Filesize

    784KB

    MD5

    1acf7af8b92e37cb2c5a0e60d0d97d76

    SHA1

    f6cdacebd00a35eb617ed9d8a5b19072531db0d6

    SHA256

    9e521fa6f041414f021ad168f2abf05d25124747438501336f7a0171d9063e49

    SHA512

    3169ce43021f19966dccc32275af4e874737b320f8ad5b37056a6fd5c61a286375a378bf068928ef5ab8b3175d5befa370cc2ec02679c8107e80133d655e9fb9

  • C:\Users\Admin\AppData\Local\Temp\b4d796d242795a82b43cf75739464693deac01158b2670291dd7dd6b9b6fcc9cN.sys

    Filesize

    1.4MB

    MD5

    251b180f65fd3ff62dd839c2be378de2

    SHA1

    645f6e87a114c652cde402f2cb1e19db5058fcc3

    SHA256

    701e5a43bc0c296b96952da6183cb409e5ce04e3046ae99d9ae5b6740ca08fa9

    SHA512

    56ecc4515d6c63ba0ca19432ea6a0dad98e79eda77b4bc9be3a97fed7ce4455742df88cabc2c295b6a1c3459790689d03c8a17b8750d485373895aa016499551

  • C:\Windows\GOG.exe

    Filesize

    720KB

    MD5

    e2783f37bb311472dc7fc9d08451b910

    SHA1

    a3d7ccaed53c283ac34c9c63d0c864dec5aed623

    SHA256

    b4d796d242795a82b43cf75739464693deac01158b2670291dd7dd6b9b6fcc9c

    SHA512

    9c636bf0e11e07ef4d6307af82cb5cf06b04d6e9c402f39ec0d708feeb03be0744e3bda1875d499f2d1bf1209452809777f03b0403c2851bbeaa00981c8d8784

  • memory/412-13-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/412-175-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/964-49-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/964-177-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/1672-55-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/1672-0-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/1892-176-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB