Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-09-2024 21:29

General

  • Target

    20240929e9bb28ccdade265f09e2f11b5ff87dd6wannacry.exe

  • Size

    5.0MB

  • MD5

    e9bb28ccdade265f09e2f11b5ff87dd6

  • SHA1

    db430b47e9bb1430dbac0c8094fb01beead3a9bf

  • SHA256

    d5b042b4193d30668d48d1d6b38f8fb39889157636ff903d9fd4227b5c7fb8ce

  • SHA512

    e0058529f5e89a1282423cd9060c6ccdb175ceba5845204d9000db2f1f43338725752ebb0fc16b187d960b2c237dcdc271b3435b820b21aa740627d627f07d67

  • SSDEEP

    49152:/nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAACJE3jM2ce:PDqPoBhz1aRxcSUDk36SAHE3Xc

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3213) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20240929e9bb28ccdade265f09e2f11b5ff87dd6wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\20240929e9bb28ccdade265f09e2f11b5ff87dd6wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:1556
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:1100
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1148
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1472
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3732
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:752
    • C:\Users\Admin\AppData\Local\Temp\20240929e9bb28ccdade265f09e2f11b5ff87dd6wannacry.exe
      C:\Users\Admin\AppData\Local\Temp\20240929e9bb28ccdade265f09e2f11b5ff87dd6wannacry.exe -m security
      1⤵
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:468
    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4360
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2268
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4400

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

      Filesize

      2.1MB

      MD5

      31900656e4e53558ab74641920e24954

      SHA1

      c4a747bff93acc56007e2bef045a08c8dddae16b

      SHA256

      2edb4792890bdd2f31924625579e7cf41f659b84b0d4249e398e7d935ebfe7ea

      SHA512

      f377ca6972e8b7ce27e164bf9bc9b706b5dac187a2805da30450d51f319236beb1828b35b0920fde76cf46b386da04670e15b752057d87e39220fa6b4972c15d

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      1.6MB

      MD5

      bb473c9863a4c57e996ccfefe3d944f6

      SHA1

      fd722fefaf5620dcd9d94405e67460dbf148ee5e

      SHA256

      e66298af90b9b15dedfd9fa1f06c21df337a6e28f0027eb419cb3591d864c6a9

      SHA512

      1e85a49a99597013da6524b5d557f2bbfbb8cd98ea14d766e20aeaa88f4ef45015098194a99cf92c0881a1faf4dadac9c712debaad444e000cc99d61d3877d4d

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      1.9MB

      MD5

      66b5b1779009052426d493a39d11e415

      SHA1

      cded21d61406a6c7c562f305cb8537b472533d00

      SHA256

      24af3f32b23be32d681ab85408f2312636f555051ea8f750daf4371a817690ef

      SHA512

      e04782df6969064f7d347fac109044ff0d82eba6dc10874415b507a7aabe0d704f7d97d935931c8c011eabee30505e7a0a5782aee2b12cb2adf833a46cd75a7b

    • C:\Program Files\7-Zip\7zFM.exe

      Filesize

      1.5MB

      MD5

      3ed6bb788e6f4dde865df977308c952e

      SHA1

      326dfadf750fe1a0ff939cb458d4c860fc958f61

      SHA256

      f1a3f99ab9adc221c9c3aca6d2ff3de4778f4dc3609744d8b0fda26919e7b968

      SHA512

      ce619dcff3542056cf30f938b1fb5dd275216e82b40a7bcff70aa0cce31ed5e47d4e55536f902c4f09ad26b158c05f71f3122ee080943b91a4cb75fcb7497a08

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      1.2MB

      MD5

      b6a2f0309d2f514f9aa76aa92e785619

      SHA1

      0b2767c550ef51651a2076144fc65d066d9484c5

      SHA256

      f2a4e2f594ed9c50b5a242d06600f29c951b00891799d8051fa0795ca127a7b1

      SHA512

      c7c510df22d437e4d59a59a38d48a21fc15219a43933b3680dbb5cb46faf697b087f2575a8b250881837581aa10acdf42b9e400a4f9f3ce1bd48b25619703c45

    • C:\Program Files\7-Zip\Uninstall.exe

      Filesize

      1.4MB

      MD5

      a3d6417be1a07cb4e4747e252fb8f212

      SHA1

      a63dbf81e1ff020ea71c9eb7d2dc43d43c1abd89

      SHA256

      ac32291f0a5a77a95c069fe091ee2956b335969202cab18a95e029353cb528e0

      SHA512

      41fe29645a569382f647fd83bf1888c945f532bc626aaed3b117bd384122795daa5b16c8c412c96aaa172429eccc3b561b4602e14ccd8a199c256d6c142122d3

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

      Filesize

      1.6MB

      MD5

      dc07647ba17125ce98b9800f62ab6df0

      SHA1

      fdcd4e5aac36caac9b47c847724103868fdf11f9

      SHA256

      fcd3233abc1af88b30ee6a9ee71ff2b6b34aa4c981df6df18cb2cb76856788c2

      SHA512

      0617c04ef1a21c5d2fb4f94849b3e159f8c21bc2a2a5f26edfbc03073ab5ee359b0b32e2cd730f90d08b1694a0d123d2e742f76148fdcad2ee2b4acdc9c4a79c

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

      Filesize

      4.6MB

      MD5

      0e803609b8384ba74aa680ad5a279fc3

      SHA1

      040e89801359530c8752b862032d1d3b448a794d

      SHA256

      520bddafd867d6bfcb719963770760352b3b61ec8c11c3a0be8df7c4e0fcafd6

      SHA512

      24f23b25a038b7b0935029f31e81ff94c7e14ca4a3721deae27f2ba13c1c40d6d7ddd8839d9edebb1a694955b7b7092f8f974d79d21054274ca3ebd5e37fdb1b

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

      Filesize

      1.7MB

      MD5

      5422e478d6145a6dcbea278a50ede78f

      SHA1

      cac58687fc212da3ba9257cbcb8fb4774ad2ab27

      SHA256

      e52a7c895de3722059cad48a35478a824a84f471f86377756924fa1c253d3446

      SHA512

      c55723e4bb2319472deb853e9e94b9993f2c22489692dac322b41f7d5c8696caccb718f42e00b24b6e3a677bb7d22503260cbe160af144a4f3e695b558c487e3

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

      Filesize

      24.0MB

      MD5

      426e17b69c251ec53e03a72cc6a15812

      SHA1

      f7572add1bc98a836a87324ca70906d0e39bfb11

      SHA256

      696d5435f5fc0df9886cd46b0d2704afabb53b2251f887ba1acb8d2c6b82a3e4

      SHA512

      cf6d53cd0e2794ab7ac779fd576a24a9d7f47c87d97e3cb431344eb95b78336cf7df47cfa0caec4d3dcfd9152dedb177a67d044d0fd2d5fc57e6e25227abb3e7

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

      Filesize

      2.7MB

      MD5

      8b026536233d0b9df820c83a736fc0d2

      SHA1

      f91512a19329526e62e573eab917cc24ce2b39d6

      SHA256

      3f13fe16801d4ab63eb29ca2da85a45041415237d63ce8d70ed4b9a6a1edf06b

      SHA512

      61dbf36fc4696684d5e2d43eb6a792405677a85b365ca4dae674dc489b9e25d459e008ea12c580f94e4850fce7c27d701ce8c1bfc011bbc7053e9f9ff4165d3e

    • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

      Filesize

      1.1MB

      MD5

      ed11fee204d484c3b0935edfd5a5ddaf

      SHA1

      c49ce429af2cb06400909a9e8640f9415cd6daa0

      SHA256

      f71534a0fd3d54601706ee225176a63753da546e389e29b405a2875399752175

      SHA512

      df44c9ab1beb00ec1a1055420ef26c64e2744411f23c67c95445865cb31cf296e24ad4ed1ba3a8760d3a55ddf22626ae8ae6317e2b04a45daced5b3f650683cb

    • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      1.6MB

      MD5

      e6d01ea31cf58d9cd5e14be2a44b1983

      SHA1

      4bed60b41c8b0ad128e4abcb2f37478e1be3c032

      SHA256

      803231ee3ed205ebf283305c30ee3088b36a972e0c039c4f32835cd08249e9f8

      SHA512

      aefd6f75082130bf36ddefac8cc9d2d6dbb3f6fbb3c9fe7514f74aff8f849efff15e8dc22fb001ee9fca71fe7a21e041c6edb44931eafba453b71d923a210e6a

    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

      Filesize

      1.5MB

      MD5

      cb02dbf71e64af6b0c09ef8aa18e8060

      SHA1

      1137889ce4381178a24db504b1f7354ec7a63e09

      SHA256

      b86d557593b4fe653d01f05fe859f103168e7ff41deb570e4492ea92ebf2dc96

      SHA512

      7c9bae01a20166cbd296df2b2e542a6fe947e329474db3bfa450b73dbf6daf77b1bbc7dba4546b59961f5a875ba663b7bd9255813868c02ad1abb5c19da65e9f

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

      Filesize

      4.6MB

      MD5

      17d0721ff3a692a592b01b2ddbfe5468

      SHA1

      8b73a53247ee0e5fa5995cd149d62285a5ac7010

      SHA256

      8694d9aec09029555617255fe741f8aabdc164cf06731a51f78c132ac2a6d7c9

      SHA512

      df4cabb588545d710b4f99a457161442923a522de97e93813b6a4fea0c3849dfc099cbe98a580bea59b4aeee16fe0b21054f362cc3123d2210be94b71d614169

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

      Filesize

      4.6MB

      MD5

      24b667861dce4faf6b0d42ed5adcf43c

      SHA1

      1d2a09a17ea018b739c019f6c3ca2a987774450d

      SHA256

      12c7390151db2a5aa146595d09ef3f75aaf448e00954b456efecf0e815080972

      SHA512

      1cc4a48eaf71d648cff53ab382cb53f1b870fce3f67abdee620feb2c4d71856a6941ef138f81efd0dbb8a919f99f12772841760d61406eb4ed6ab28c4a488ce0

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

      Filesize

      1.9MB

      MD5

      08ccd22e8a18aa019860cdde468973b1

      SHA1

      cf60eb5450468a1107bfec1223f853ebaab6296e

      SHA256

      5ee0b132e0c223a610b0661ef3c87ae37881fce725d4a6aafd5b1ffabd0f0721

      SHA512

      37f4d4574edcf5ec19f3d83cee47de3f3df4956f9815a5567dc3c316f9369899ec6c12911de53bd15a367c6ea73cce1b1bdce903395b77253dca8033bcbdea7a

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

      Filesize

      2.1MB

      MD5

      399a8a66e188cf6222952ec4e677a7f7

      SHA1

      01586bc22675fb81667a664a1546b7e32bf3d585

      SHA256

      40046b3519cca3fb6b3a400416b9ff6d8c0837778109ef95d0076b7d83af99a6

      SHA512

      43085985a679e5fb6d5ed7d683dea324a4ce993b60aaaf4c1185f9363bf161479f22febaa0fec0b654cc170b9271b8e62e1f3faf2a3d3b5319e7f96a6e35daff

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

      Filesize

      1.8MB

      MD5

      3e43a98d1b4380dfb1b8269d99a97d28

      SHA1

      75d8e01368e577af997387405cdac4234a23118c

      SHA256

      78fa32cf1f097420a53f83a691802483fce53ea151831dc51daa1a59b33ee1f8

      SHA512

      c0e8711f4d5f2dce5209080af4e7e079a81ff766160bb7f0f9dddba6506a0395f4ea7c26b7d84b3def035589387e4ca45da2d0f9b520e0279e5a1614ac9083ba

    • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

      Filesize

      1.6MB

      MD5

      9cc1584f85e88a9132422787739fe2fa

      SHA1

      8559fb256cbfe22f318a2769e359faab232ee300

      SHA256

      764f16423225cacbc9f6da4cfac4e6a7eb614aa26c4fd09f3c8d5231abdd4932

      SHA512

      894565c4769d6bda76c1c8a5cec177a05cc2edfa4c28094f9be35ee9668b62e51c04d258c4ee3c2eea8fecdd34fb302eecbc546726eb2755637d3faa0e805114

    • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

      Filesize

      1.4MB

      MD5

      744cc593a523a2af71dc83f2ce69122b

      SHA1

      44f5fa36ac17c3746d2caa62b3595a78fb6f5651

      SHA256

      255068e8ae85cbd1e5e7023b92f93c4acf4b559fffbe7fd77e4c703df80df673

      SHA512

      19b602f1a75004f6eb5ce1c6413ef16d8160ce11dd75e3d539b0f8580d4e9f034d898e29ee197f966cf198820b7603e751aebe03b109a40d47b5b94cc0cf5d61

    • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

      Filesize

      1.4MB

      MD5

      18491814c5b57c096bbeeb6849b61435

      SHA1

      e1da501cc7034b17ac4eb1c5e3233f3a27a2a07c

      SHA256

      3857467865ee55e147fe19d3fc21785ffc11a572e9d7eee7e790efb46d9eeb6e

      SHA512

      10d516ac766f9ba19b22e5de5a15ccfcf62887aff2f3b4d9c6c41334279e842fc8a96c23665441ccbe953074a8dbe7053ad6ed6d87c346adaa6ad0d7f8c5abda

    • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

      Filesize

      1.4MB

      MD5

      49218fcec949fd004224ebdcd738e1c6

      SHA1

      52c30fd540b5be65f3b015733b2cfe19a9e9ade2

      SHA256

      8192613ed2e1ed44bfb5aa3b34e81c2b594b3c2539eb888a23d6585c5738f9ea

      SHA512

      ad8ae8ca2079cdd1b8243d1bc9bd7610297ff444cda09b285fecf33c49451a2280c23ddfd2667760f8405a98361fc7dfcd6976872443634fb8df5ccdbd2ab414

    • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

      Filesize

      1.4MB

      MD5

      b94a59c11070aa1ebef5b95ef63fe29b

      SHA1

      9a0e4302dab57c8a3afe01ef30b80bceabbafe0f

      SHA256

      ed90b690d96b5fd30c1e4b839e0acba5c5b3a4dcfd6d9c3bca3693b185948140

      SHA512

      1c48b76f5dc29e088bf1ce59f98bde057c7a80bad3b2fd788c0e3b3bc5bb014a015f2f99f3de10bf2ff6d84a08b0bf3820a8c388c8d254858e44e3a9258336f9

    • C:\Program Files\Java\jdk-1.8\bin\jar.exe

      Filesize

      1.4MB

      MD5

      9d0e907fdea967023c1cb14910b53572

      SHA1

      331a23142d38bf013e899d60d805f705c33a2606

      SHA256

      c3b9e5a7dd9da88c81a639f9c45d7fa63d59f104e312d3df3c750ae042a5b6ee

      SHA512

      8af535c8a71b3ab250452f9a344aa6273c90f0b553057ea29a265198d73b7fafd42769db01706ff051711d590bb8e13f435bc71be46feee2642f287e8a8fe59b

    • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

      Filesize

      1.4MB

      MD5

      cae5f4074ac9506ff14391f8d4a43a07

      SHA1

      c2ab7a575fbd5ff67dffec13be1e821bb85bd512

      SHA256

      5e9e5c363964c1fb66ecb41be25da870bf5b6cfe8f304ad43ffcb7503f8fc598

      SHA512

      a7311fcf0299113eaaf1b3433bd52bdcd722f388405f258842c60902e07ee7ac7fc32820e2e1f8acf0b1ca8741aa1ac007cdc43def2bffa8b4dcaa0ae984817c

    • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

      Filesize

      1.4MB

      MD5

      89b0a99915b08a7920324c6ec232716a

      SHA1

      47e6041955256c634e3581c85da045a3c82f5362

      SHA256

      8d7e5e4fb0517d4cf119455655488f531f660b27dca11d6b191eb1160ca5b461

      SHA512

      ddf012108e4b806507f0062d7ed48233639040a8cf91e90e7316b7cf20c395db678f117caa2e8cc326ceb7a8c2f41f15c625a1dd49abcae925cde071b412b363

    • C:\Program Files\Java\jdk-1.8\bin\java.exe

      Filesize

      1.6MB

      MD5

      a2352747a08aae0f129c907342fbb55e

      SHA1

      615b0ef719d25326eb0d7235711457a4263675d3

      SHA256

      6c0c0de2ab87fbb83326f24b2a4aa28bb34680c80e8b79fd55c28981b88eb2e3

      SHA512

      1a5d586ec204d2ae4bb28b68d0c8817e0e371fba8b987dc2419df8cf4b286669e357ee7b1fd85c7ca9ee94212193fcdee31a8be592f907626bd1f0b3e40e9ac4

    • C:\Program Files\Java\jdk-1.8\bin\javac.exe

      Filesize

      1.4MB

      MD5

      87e3c546397c461f5df25c8b69d4ec9b

      SHA1

      dd94d2f3d6073976d19b2a588605cea36c1a4c94

      SHA256

      e21c08246655999470a467931ab58cbd5f88eb65f00c890e8e662a4602d124ca

      SHA512

      5c4b0952888b6a69ccd7ca76da3a7ba86aadcdcb28712be768e0091aa8e3dd380e4e5f4bfab34de06081a9ee570206af5890d0aa17c98c8c9fe1159ab7b4f487

    • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

      Filesize

      1.4MB

      MD5

      266bb224799b5af7894b85fa87df96f2

      SHA1

      8aa4357b3b5e2dc3d0c4fdbe14ca731116e781e7

      SHA256

      a24adc817b68469a688a0af963f0b0dc3ef1e0676674026aa4061bfeeefece92

      SHA512

      911c3d491c43242e7cb6629a11ec020258de2483337b95324f8ba50585b44ea8a70ec63c5b2f5bd4be5cf50ac00603dcd93d2d0b8dc127a64df89d3c0c75687f

    • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

      Filesize

      1.5MB

      MD5

      aaa3b98cd13acf19a530579b1932c1ce

      SHA1

      8238cf0eaab037d062191f1fca83dcbeaf2b4898

      SHA256

      6cf1caef7adc8c767f01298a5719894591d024c9ca1aebb73633c535e8119662

      SHA512

      2bde8511da30753bb5ca60efd80c70b7fafd88da51912832c42f36396213d809f4468a928c50a58749a82d4a6bd9260966a98c337b85470ef2658a02b17231e7

    • C:\Program Files\Java\jdk-1.8\bin\javah.exe

      Filesize

      1.4MB

      MD5

      d214b46d7837a54f9027a001812f53c1

      SHA1

      ba2f8c876703ba2fe3959195b88736574aa0838c

      SHA256

      faeaba5f816a681ed90e0671dec8c118a93b337f3155bab24be5da84aaf9d132

      SHA512

      68cd9d62fe63b76cb0e277d150544c8032cf680c1fb8d8b54eef3a3d02a13e1de538b9db3dd963ace1158bd00af9e104469a11262fa0b93ed7c9c20c1da2629e

    • C:\Program Files\Java\jdk-1.8\bin\javap.exe

      Filesize

      1.4MB

      MD5

      0c3fa640f349e83d0c4dae5a90865843

      SHA1

      127a9ce40382f7e4a38c899129c99159bd197a63

      SHA256

      b9bf86f799f8df6d085fa0a955eaab284833773248ad90af4342ed5fe061ab8f

      SHA512

      bb521984aec2ba63f63c345e8358e314493228aa0a903bedecb86d7b3d90fa8336cde0a236f0677b1a10d5cf16a4fa7ef2fb71875112e3b4e438b13f7b6d38d9

    • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

      Filesize

      1.5MB

      MD5

      99f3e82fc1bdf99664d9c21066ff2df1

      SHA1

      fa7b74e73afb242fa2d2cde722425422ea8a7615

      SHA256

      c8b3ec2266e551685ad545341fb5a00c9147666420000c38fb1202817f038945

      SHA512

      015cb41cce0a87307008f0c9067c9fdd0900fb7f4c9fcbcbbd00c48663a5b624621f8a3fdd4687b2b6608dcc501272b84cd521471d0a07d1bce55b892ea1f9fc

    • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

      Filesize

      1.6MB

      MD5

      0d0da090bf7d55e7b9789d7b034d9fbf

      SHA1

      3b2295e8e08deb564beaf0b9fada5cd1e96eb9ce

      SHA256

      3d2ce80c93d51e39c5acbb20fba4b1d3cb4f02afaf51add0d229d4d1f4149c5c

      SHA512

      9becb3cb6e57b8d65c17ee91a5c81ac27055edb94c6ac974250b60dbb028aba3e64a0e407707e91370f3d06a129c7eb719cd94ee53db922ebe1f226ec979921b

    • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

      Filesize

      1.8MB

      MD5

      fdb4a4744df7c440aec19f07ffee1159

      SHA1

      eebdcc310bcf7277b687f1f041cd8da4ca3c77c5

      SHA256

      b2221fbb5847e0b80cfbe6ed4ff2c27b6f9c2de07396f4d742b8f5b2c018c68c

      SHA512

      39812501c83780fa79b2c8b1a7ef8573fc66c7da0bd504f36a8fa26639928949916cb65bcfea5e759cb5ea0eb89bc97e65a512b9861d892941fbe469973a1ae5

    • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

      Filesize

      1.4MB

      MD5

      b63c0027e22e9cb20540853474766d27

      SHA1

      35dfb95b00ae58c2f6155468aab40af0f8acfe87

      SHA256

      7afd9285cd4951b3e126e5ccd1747fa59cbc0b861a1dd5682822c5e450843f61

      SHA512

      943778ce6b4a5d3e0db3bc62f9eb560b9ec036ee262ab147ca03c6678350199eee52131a8731f32d1248ab7a3a5df8d3abe9710c9a278711ad2591fffc925a9e

    • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

      Filesize

      1.4MB

      MD5

      6684a27cda68af26ca14f661eea9c345

      SHA1

      0213e4153721df049a3441231e7682001ee32819

      SHA256

      0a92581ab82b2f1273761ceca1f8c4ac4630c672387ddbc44413a4f262dee7fb

      SHA512

      02d88187cbcd4a20d22a42a4398f478ba6580b2d9321d09f1b462f1de029dc8f45da6eadfc10e66593e4606468f97d57958fd6451a09894883ff56f5bb9e146e

    • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

      Filesize

      1.4MB

      MD5

      7efe1df1738515ac0dee8b7581e40b33

      SHA1

      b10294eca662604f5af0fffb1eb936e371ca3289

      SHA256

      f0485b8e721110080aa705540ddfdf96781cf2160d0055d2de6a26a4a5a90dc4

      SHA512

      d66ffe88f58e7d2ad7553f3ea5fe0736192444057caf59c3bf7eaeaaa721f3c6ca1b7acedbfd14e0e27be80c8ff550af7690b76546f9f03a36c842c9ef355304

    • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

      Filesize

      1.4MB

      MD5

      cd84cba39856d4538da8c9e2905fc6b1

      SHA1

      b62697a2159940e169c7aac7a81c15b8166a0cab

      SHA256

      65a0b9ef48fc44bd2af5adc7b43113a1224e4c542d5c9274e8a44e7e15ba1e11

      SHA512

      2be19f0355258af346f38197b761b68511ba8c1f72b05333d5ae08ba723ef0a2f190ae79391e30e3604775e3ac01e46b533dc81f342e25d242824e0e161850ec

    • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

      Filesize

      1.4MB

      MD5

      b932c0ce466a659cd697c3ff12613690

      SHA1

      5edb300df3ad8f0e837f1703becb2ba33c0c187a

      SHA256

      cf2aa72df2e8c1032ff97689c6ad0e1ebb930fb27126cf8ecbc15160a047527d

      SHA512

      14a88585cf035dbdb2671459cd78b78f70132972328c56d8321b63a37b1d4959aa6c7f81b9c4c8441c49a6e5c8ae8d4d9c5e6bcc20bdd32dd2b9ec62094f6601

    • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

      Filesize

      1.4MB

      MD5

      5b18af6db6a878815a8c38a7f8707869

      SHA1

      f0f921df28e88b95a42a05b780c47fd9ce6fc875

      SHA256

      71c7e44501bde083df5599ad4f44ad3229bfdb8b2f1f5196dcd7ab3fa5bc1e6d

      SHA512

      a99f5c5597580e4147c7bb9f75a3a1955232ec22209b2fdb89a293d94546a9ea3daa2d64ce2c962e2c8ff0ac92b71564cc549f7c668d7cd04382d1130fde6554

    • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

      Filesize

      1.4MB

      MD5

      c9662b55a9fd51d3997558d098496755

      SHA1

      2071872e547e32afb8501d3ae8552e3e75246569

      SHA256

      498cd6f4c1fa2751d38ba8e49e76064d8679e171d81605b0334a11d39d3386b0

      SHA512

      53eb2d81146447608069d3d26a66d5e59464aa30a007b760dd107b1c00e5ce0ad76d307df646ba01dd7787323a96839a8fe9d322398d5c98eabda59800400376

    • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

      Filesize

      1.4MB

      MD5

      40000ca4be57cd5fa9a7192967810fe1

      SHA1

      3ed68baa315fe1d71dc3aa174e6b446e3dada107

      SHA256

      397fc41fdc210a3fc9906b4b32343d725525b44833b15d8f90fbe71b28a913d0

      SHA512

      ce3d2704489e1e3822b43559f570d23ccf51a7085b23b25471a47aed1b532970733d27a4a32a625d86c432e25aa1545a717081cd6f64fb679401745d1c1175a2

    • C:\Program Files\Java\jdk-1.8\bin\jps.exe

      Filesize

      1.4MB

      MD5

      9c8d459dc150c02013e74a79ce286ac6

      SHA1

      f654cffcaee52cdee5b9db026d9dc5b78c3f9651

      SHA256

      9cc7998fc1ea6e939e275123a8fc3d5f8046622c3c3b09f15f55388534f48f6d

      SHA512

      dfc485e23c2f4e23d935f544204abdc279d3160d68376e2491902fe28d82dd5b1dd9da922739fd3da64d2f09f6ed3b8c97645c1e8f703253bc825805c39d3bc6

    • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

      Filesize

      1.4MB

      MD5

      36acdd1bc3d2d29ebe84fc7528c1cb82

      SHA1

      22989cde9925cb4c27979b92a9b059ce2808264e

      SHA256

      c2eb78295a754469f68391e7535e048fb47f45b66e776c86850f9ee98a67dc75

      SHA512

      9c78c6ccb537702873eb015ab5e104883c0610d0a7a80ec43b6ef12733c1e60b0db18237b260d279a9c07572d9e4292622ddb8aef60570a6965c24ba8fc47107

    • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

      Filesize

      1.4MB

      MD5

      ba12334d888270349940030b1ff6f66f

      SHA1

      b91eac12875a3670e03cee718dfccd1cadb04313

      SHA256

      ae719eb4e7575ec0bd09485bddbc0bee47eb9e6c1ae695a0f3d2fb5e1af724c0

      SHA512

      8cd5010e07e17ac031a217a99ffe2937671cc70112903c8afe1800e1b8f211d934a6f6560da2bb21406eeb25e7ad1ec9f39308bd6f668ffe4f2f3a7c89da797b

    • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

      Filesize

      1.4MB

      MD5

      fc7fec9bb95a848f01306c87292a0024

      SHA1

      4b2ef1142a7b85183d81a195c15db967a2e61019

      SHA256

      52f4975b7681637fce83cc9a9f98e82df4ebedaca3b055d06c046752b17fc557

      SHA512

      4ae04ed00cffb5e69d880ff76b19ea59bb3d3987c6be93ad8f5e7c27b32e22b3cca2d5af31463a6e578c32abe4c455d94d93d5ecaf8dc4609b218123f507365b

    • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

      Filesize

      1.4MB

      MD5

      5cc029b6b6d61f97c4d46b57945f7b07

      SHA1

      00514d4b0a163a1e73331a99e7ec1f9486a48214

      SHA256

      2301e412bb3a76a53be7706071def994f27a8dd21512f7f4dec42718819f4587

      SHA512

      dffcdd6f21723afbb2f3ae5689ba060a43b06d40194415b2c391b5b10b83983204ac7d91569412f09f9c3bdddd6343d65e38ac20de2da087694c374d42e281f1

    • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

      Filesize

      1.4MB

      MD5

      656180790327ccb39d4ed96efaf9af77

      SHA1

      f0fb6d06803ce30c1c03af87117c00907d8058be

      SHA256

      0d351a7fffc07b8807be19f7bd2b172e7e08a33fabd519423fffca6d5ff8ddf7

      SHA512

      301cbd227f4165ef6fbdbc5cfb12f60ce96b16f86af9c411224828f86facd5e06d8abb99dd93b4c444ed3c8a4285fee9a97830e7a79f92f14accd11064f20139

    • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

      Filesize

      1.4MB

      MD5

      f5278419f9d12626799a119f0a34fa4f

      SHA1

      97084ad832505f87067e3331886d097b57ada62d

      SHA256

      be7271867019fe6be628527fa4bf7bcd209c1a7c016211ea4d024c3891c90de4

      SHA512

      d2b7c40fad781d96e7e0bf0eea0c933296b203ab8ced0e1361716fba04cfb715a6f39b63888153e1a3c2c5c8d10a2ed3cc5e8bbcd26d1ff867bc30262e7703e5

    • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

      Filesize

      1.4MB

      MD5

      693e61bab72238be5670cf158629f103

      SHA1

      95c8e1250958d601932c61e7a644b90dcacc6cab

      SHA256

      0af37414e46647c9d6ce320bc941d600057ee24cdb74b00f9ec6fba3ea5aa126

      SHA512

      c7b468717ebaa19a8c61e5551a7e71f83c617242424dc0e6500a7915faaa998ed00b349fe1be95481465f4c870eea08a42a7e7cd72bb10f29b843c67459aece7

    • C:\Program Files\Java\jdk-1.8\bin\klist.exe

      Filesize

      1.4MB

      MD5

      9f57d4cc8c540dbd480313214bcc88d0

      SHA1

      f289f21248593ae4ef9026116241f16f1f7ad673

      SHA256

      412795a3c42e2593eb64a37f5c6bb15809df61fa6182a9165ac6d19fd6c086c8

      SHA512

      940c7213b65c6ef300faa7af7fbaa6f0be97d7611987d746f38578f18cb5d039afd65796071543440cd303cf02ab8f32b50bbdc89440726032cad997b5bf8910

    • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

      Filesize

      1.4MB

      MD5

      612bd7a5a9a8e6389d32e96203998a0f

      SHA1

      4d840a3e6c76f407fd2aca636dc49c73a7f72639

      SHA256

      a93ea83c7c03d57e78672f855eb455d93bc64c5984f3129fcd64a2e153a0345d

      SHA512

      6934fa663e9be2d3ddcef999c7c7f5840e867c31b4d04d5049c2ec4f6dfbcec0f0e67a0b3aab2ca70266cf116c916ae4411e238563954857e9846a35c0d31045

    • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

      Filesize

      1.4MB

      MD5

      d28910e9a17903b7623da1eb283d4ac2

      SHA1

      cda1a94467f61f4b94674e15b28814319999db5d

      SHA256

      e8077309bf580d07cbeda099a20b9b056845ae936a9fdbf0631d723dd0f5406e

      SHA512

      3da01d10972edf517ede759558fdbff5f4642f97ced313a162c2e3a4537cf460ea683c0ee3c05bec79aab27e7b8faacb30d86f5a53da955f854dd11b78440007

    • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

      Filesize

      1.4MB

      MD5

      b20ee0ac745d7e9f0f9aec9de4327abe

      SHA1

      6b08590ec57444b453147e4f78ac6191bb61f418

      SHA256

      659e29b8c3c93abc01bf0eaa55eab4bb962339ab47c33c5ef31823676a21cb67

      SHA512

      c244d2aaa396990ed1bc8d5ea377c96495539844ee618a7371c429e650da327cf54c4e3c25db5443e9d389d9fc1c2fa053e1f22a5d3e1cdc358084fc6a9a5e0a

    • C:\Program Files\Java\jdk-1.8\bin\pack200.exe

      Filesize

      1.4MB

      MD5

      a02379a9a108eba1544e500db2649218

      SHA1

      eb5bb291f3ebefe8acffc81631272da49deac3ca

      SHA256

      9c1e072b52eb5b54188f939a4d27fb34baaa4054d8a1117a6b09a6f78e9ee191

      SHA512

      cef5be0889bd6a63f1d3ea78e2133aa316f75f960eabc703bf863cf62232ffb5b10a2ac5063bd5cb1a6d1dbeebeef6a82634f0ab02c4f2821c12dd6e87642745

    • C:\Program Files\dotnet\dotnet.exe

      Filesize

      1.5MB

      MD5

      f8a9c604eec22fe2a7381c36ceab2236

      SHA1

      0721b74f35bc22110617dc42cf1c302e2fab1dc8

      SHA256

      91c9a3429369a135b52f6de505ab0be67f776d01d8f13d59c46c713157f257df

      SHA512

      15cf64f15f7ac6211542c3113b131e780187556f6bd02a0847e15d1ff682c4913eaaa6f7c093d0a06bd93259ace11610d3cafc21ef88d7343c9dc03e953d500a

    • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

      Filesize

      1.5MB

      MD5

      7a2981329279abcbe52bdb87241e7af0

      SHA1

      008c4144de3d5a6024653958cd13cb624c8789f0

      SHA256

      ac68f55bbf20b254ef41941e0b34af99f80587a2661e29fdaf3dfd3d753acd32

      SHA512

      579f3838bdb4929739943bdf76b81e1e1e0d7067aeddb735dba4f499e2f8e3dcdd4bc492c83f4b0d66277ea4cfcf127690465d5124194726f4ce88e0368dc26a

    • C:\Windows\System32\FXSSVC.exe

      Filesize

      1.2MB

      MD5

      89bb44cac5b3dc91165cdd5c5bc216dd

      SHA1

      cb10a08d70ade7aeb3f1803cab5fe58b8ad5e9b3

      SHA256

      d7e2717118168f4e18694b301a44becd1940d9f8da2a96600e8d43e537f19bb1

      SHA512

      bc155085c15a7dcbb182fcb065cf2c35b3ec7d57a6e516afeaf55b05f2c2c2f4d5a670d70ff77c983458857b41241e0e0e0b3d13205cc09b3554cfbc5242029f

    • C:\Windows\System32\alg.exe

      Filesize

      1.5MB

      MD5

      203a4ef76b021fae84aff643afb9b327

      SHA1

      e8bf26efe90322f0e6989c168b6e551451875f16

      SHA256

      dbd4d85722f799cb15fde4d58bce59267b7ed1012b1c4e712d8042751dae4fa2

      SHA512

      1002e06a82ddb3c2658cd4e7c803f0502918ed1213c55c6731c970bc2dd847f359fbb5a7d93f956b87934a8006906b8bb4c595629be436bd0035ebfe141e9e04

    • C:\Windows\system32\AppVClient.exe

      Filesize

      1.3MB

      MD5

      b7243d7c26246b7e4514cb13494d5b9c

      SHA1

      3d74dabf654b817d99b98171d23099ef0d582520

      SHA256

      5b5566a755fcf9d7f550ac9685db56421bf251dfdd0a033fd541de2fdb63bc89

      SHA512

      c0d1893df9c1c5cb8bee07293282d01997313b40d4d7792077dc2abd3e8ce5e9aa7f95140ccff85b285a6fcc88bb47f87f6022548222e399a009837eebb856f0

    • C:\Windows\tasksche.exe

      Filesize

      3.4MB

      MD5

      3233aced9279ef54267c479bba665b90

      SHA1

      0b2cc142386641901511269503cdf6f641fad305

      SHA256

      f60f8a6bcaf1384a0d6a76d3e88007a8604560b263d2b8aeee06fd74c9ee5b3b

      SHA512

      55f25c51ffb89d46f2a7d2ed9b67701e178bd68e74b71d757d5fa14bd9530a427104fc36116633033ead762ecf7960ab96429f5b0a085a701001c6832ba4555e

    • memory/468-51-0x0000000000EF0000-0x0000000000F57000-memory.dmp

      Filesize

      412KB

    • memory/468-46-0x0000000000EF0000-0x0000000000F57000-memory.dmp

      Filesize

      412KB

    • memory/468-53-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/468-256-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/752-66-0x0000000000E70000-0x0000000000ED0000-memory.dmp

      Filesize

      384KB

    • memory/752-68-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/752-37-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/752-44-0x0000000000E70000-0x0000000000ED0000-memory.dmp

      Filesize

      384KB

    • memory/752-38-0x0000000000E70000-0x0000000000ED0000-memory.dmp

      Filesize

      384KB

    • memory/1148-18-0x0000000000720000-0x0000000000780000-memory.dmp

      Filesize

      384KB

    • memory/1148-99-0x0000000140000000-0x0000000140249000-memory.dmp

      Filesize

      2.3MB

    • memory/1148-17-0x0000000140000000-0x0000000140249000-memory.dmp

      Filesize

      2.3MB

    • memory/1148-11-0x0000000000720000-0x0000000000780000-memory.dmp

      Filesize

      384KB

    • memory/1148-19-0x0000000000720000-0x0000000000780000-memory.dmp

      Filesize

      384KB

    • memory/1472-25-0x0000000140000000-0x0000000140248000-memory.dmp

      Filesize

      2.3MB

    • memory/1472-210-0x0000000140000000-0x0000000140248000-memory.dmp

      Filesize

      2.3MB

    • memory/1472-34-0x00000000006C0000-0x0000000000720000-memory.dmp

      Filesize

      384KB

    • memory/1472-26-0x00000000006C0000-0x0000000000720000-memory.dmp

      Filesize

      384KB

    • memory/1556-6-0x00000000011E0000-0x0000000001247000-memory.dmp

      Filesize

      412KB

    • memory/1556-1-0x00000000011E0000-0x0000000001247000-memory.dmp

      Filesize

      412KB

    • memory/1556-108-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/1556-79-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/1556-0-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2268-70-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/2268-80-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/2268-258-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/2268-76-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/4360-56-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/4360-63-0x0000000000510000-0x0000000000570000-memory.dmp

      Filesize

      384KB

    • memory/4360-57-0x0000000000510000-0x0000000000570000-memory.dmp

      Filesize

      384KB

    • memory/4360-257-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/4400-259-0x0000000140000000-0x000000014026E000-memory.dmp

      Filesize

      2.4MB

    • memory/4400-90-0x0000000140000000-0x000000014026E000-memory.dmp

      Filesize

      2.4MB

    • memory/4400-91-0x00000000007F0000-0x0000000000850000-memory.dmp

      Filesize

      384KB