Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2024 20:25

General

  • Target

    2024-10-11_a859f6bf1bbb4df6c23bbdc0d4cae460_wannacry.exe

  • Size

    4.1MB

  • MD5

    a859f6bf1bbb4df6c23bbdc0d4cae460

  • SHA1

    992d843bbbf6cfcc9ecd33f978554955b4044554

  • SHA256

    087853446f05cfe03410073ab6370f1de2106e50970a0d37e1f220e592e17e38

  • SHA512

    03be0abbc579b48507aa7441b3946e7a6a8dd23a008006510dcc79a99e347fae4c429a00422c673a92f2d7f5036a68cc0359b1464e3642233838735c175ef6e3

  • SSDEEP

    98304:IDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HFbx4uR:IDqPe1Cxcxk3ZAEUadzR8yc4HF2

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3168) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-11_a859f6bf1bbb4df6c23bbdc0d4cae460_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-11_a859f6bf1bbb4df6c23bbdc0d4cae460_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:3704
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:2144
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1928
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3844
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2092
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3228
    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:632
    • C:\Users\Admin\AppData\Local\Temp\2024-10-11_a859f6bf1bbb4df6c23bbdc0d4cae460_wannacry.exe
      C:\Users\Admin\AppData\Local\Temp\2024-10-11_a859f6bf1bbb4df6c23bbdc0d4cae460_wannacry.exe -m security
      1⤵
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:1524
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3380
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3952
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4480

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

      Filesize

      2.1MB

      MD5

      5273ae2d84ffba68962ace6631a06de7

      SHA1

      28ed0b3e41853faaf19997563ee157cc9a9d4181

      SHA256

      8c7a2a429ffe2021df93d3164a2cc6fbcce4b51ac0824ea34e0a44e8cbdc8ec8

      SHA512

      f65d912b16597922620705417ce2d5d4827fb9955ced8eeb1bd9526b0a33bc6cf01e95bb90509e0d27870df7a23c158dad9538864e0ced8f332349eb4141dfb8

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      789KB

      MD5

      3c03f32cfeae2697c0aca590b6322376

      SHA1

      e24edd06903f20f4f3a58a3c76a732aa095758d6

      SHA256

      89adc7b5b9e1cbb9c411486e2ac0afb5a69ff2bfdb2acc8108b342306e7d531f

      SHA512

      147d6193a991c92e09178f476bba59e815c4d3524eca0a96a5af7d9af8e02b647ba5620b3d5b2432ba5f6435e2773c767db4a7817ae1870d32497828f1f45b85

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      1.1MB

      MD5

      bd423a1947a8be9f8a6ab582481f0ce9

      SHA1

      99151f78620e7b28f2e14aa1703f01117dadbff4

      SHA256

      c43971d7310887941cffbef7aaabc9eabb547aea8c73e40c5f41a8268b118bf4

      SHA512

      9585c2ff49d9c2c9984e4c8e91b186f0add72dac3a57e88091e38a234f48f14ca61e13623039a92c75f96d0928479ccc38dbb3617e66e13c7b9a4253aebb17f8

    • C:\Program Files\7-Zip\7zFM.exe

      Filesize

      1.5MB

      MD5

      72df13905c7a2e53426ba97b6eb773d1

      SHA1

      ea47aa7e16da2402094ad137d1c462b14d0fd00e

      SHA256

      5bb535ad2ce69c1141420caa7c50434edced3d5c6fda8d5c99847485f1aee399

      SHA512

      db52d3f2e0118bf1df8272262a5de6e52fd5a96e6e133fdedb6000fd7d05c02843924e3f4776f803c86d8f7eb00f2556c0bed22d0b2c001b5c5d4623cb9a6eec

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      1.2MB

      MD5

      5d9265dad0dcffcf2fdd61c181f82562

      SHA1

      bab9df54ef9f0826ed4984bd60bb95f978faf6b2

      SHA256

      75fc87c61b73e86e11b15a7955ad7707a9d693bf068cb9b807f0a6b00797bbea

      SHA512

      2d89b66131867fd71a48420ad2afad0467e942c79aff0d99c36652dbe672e499dc3368bdba519c950e9940a68292b1b0a150bd4d4adc605eb6dd9650bc14c60e

    • C:\Program Files\7-Zip\Uninstall.exe

      Filesize

      582KB

      MD5

      c6136003eb88811ecb730c8edce50dfd

      SHA1

      55f6d07605bda85d1a20e73547e9bf16bc2d6e3f

      SHA256

      40119fcc611b93a50894cba89281973baa67747776757cb84337ac7618af1bde

      SHA512

      b835e8148a1d704afb3003496e22179b03a6c1cea1d56e16d4ef1fca5e4e2f7a9807987c8fde0209e58f325ba62b613995861e4888d4a480c810322c8d406537

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

      Filesize

      840KB

      MD5

      67e2121ed18c837a359ee07eba51c698

      SHA1

      a5ab31aaf5b7e8674d6b8a3789772efeaa7c138c

      SHA256

      9c3f3d4c44c23f740ae0c188ff2d18063c2df00c09bd191f966606e4bd291354

      SHA512

      3401b9fee1a29fcb078a3b64898135ff1c23f829e030a98dafa9cb5124455118a342dff1c9b7d962c148287e845c5dd863347335d3a7e5f61d87409fdcaed252

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

      Filesize

      4.6MB

      MD5

      88ec7037aa87dcddac78dd8ec368e209

      SHA1

      26bf874b392a61bd19d3bfed3b341ff61da6880b

      SHA256

      254c015091e69df324db6c63fcd8c8f11138330c24a825b3cb537530d04d9092

      SHA512

      589c9b38252a2d900cbf6b2c246ec375df317245a85f64a616ae54b0dbe954157c0a5801c4d1ee6f41ed71d4c359a5fd0a8795365e5632e0b4d84ee8cb77690e

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

      Filesize

      910KB

      MD5

      d6643d9daba6b14b75623aa3265a94b8

      SHA1

      e7ef51b2f1e76c43b75dca5ce82b2ec8b1788581

      SHA256

      41291eb2624b1b6eed9ff9e0040fc5736269230c00bc430bdcbba6c1dbd7e23f

      SHA512

      c49999bc80a884f8b912fded750a7161f06fd8fe6e7a5b3fb5c733181a1e321580f66f8f9a13cb9d51fadd5b781104f20d6c592521104202e0ed3f5d3240519f

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

      Filesize

      24.0MB

      MD5

      53b68a80c24e51976477ad27c557b806

      SHA1

      2d72eb3a9edaca201daef919d509e4166567b511

      SHA256

      59e00141d1e88da267834f3683179a292519d16df4a8a20f3bc79b4e2d1523f8

      SHA512

      2f16a96e3f2833199d0edd21b4310cc848ce7b8f3df4207821a421ee0c5c2f9142f77daa2d6c0af44713d75c908877dfe9c84e3dcd7055b9a5d0a17ba30bfb94

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

      Filesize

      2.7MB

      MD5

      dd8aa5ec9ba67b1a473f71468c520a6d

      SHA1

      e17e1fb0611dd960722b20163cb0401651b712d2

      SHA256

      3e7f7a9b90c1bb14d4660be0e5563564c052afb55cc79a8658dd865a6a8d5b1b

      SHA512

      3f4ec54975236585ca17c41ffa95e43bd242e4960dbb90e5625c92f24774bcc520d9a046a5c20d5928c6e0d16a5e84d2d5738eb6c139ae026d8c05da66787fe3

    • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

      Filesize

      1.1MB

      MD5

      c493ac3e2e1053079b9facacdd0c56e1

      SHA1

      c1f107bd31542e56cb9418816470978d13095597

      SHA256

      0623f4f15177418e787d33abb639fa19723bfb0fdce572ffebdd93759d36a140

      SHA512

      1aabecab182d6f3fd414deba23ae7ad8e4d870f0c31874cefae03ba8137655c1001583cc1874a37b3118cc65149d6cfd519dddca410d5ef592af0dd1d2450e76

    • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      805KB

      MD5

      410c73c5fbf4ea2eff8c4a0e36c69565

      SHA1

      1813293b2613501d1bbbf8a3daf0d8cc91dba6af

      SHA256

      af1793af5290b725037d7d0d50697913a9df8fce7ff65e4710c891ddbe9bd270

      SHA512

      27641dd74252cf969e12572fe2a031c0da808d6f2e002399dee98b6a7e367633036261a4256b886c01b278990faf7a6cb79cd4267a2eb60c5bbb4b5c2773d6dc

    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

      Filesize

      656KB

      MD5

      929541765a2cd5b889b1c597719057b5

      SHA1

      40585697e3cb6c704a9863576d02a8cf9cd6434c

      SHA256

      b7acde21c89ca31c0ec309875569eb927dd7b7ad4bbe1bd97cdd805d5b96bf91

      SHA512

      f1f1f49b306309cbb95f691a88dedee647c4a2fda117803e8555c7b3e84c0f0f4c9774970b3cb79e59f95aafc915f32dac63515395718a3b14ccabf5441dd658

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

      Filesize

      4.6MB

      MD5

      0aae78c5e8187041b8a3c704e3dc05ea

      SHA1

      5f38163c95939e1cbb76d45d4f79734503fc294b

      SHA256

      909fbfef9043dd3ba041ad9408a5f70c0f17b01f5142d0533b4079cc1e57035c

      SHA512

      545ad57fbc3d8ce42885f8eb4ba4669ac75b2b304257ef1b8e7581f95e48a695c37b988261c7633d22cba0edf22350f84f6e625b893f9b02ea36c5c8057cfed1

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

      Filesize

      4.6MB

      MD5

      59da010dbd957a7608b88893e593ad83

      SHA1

      0eabe4c0581bad2d71bfef0c863f8d1ad6392aea

      SHA256

      22374ccbdd2d82f207ebb3d39665ea3230347c84640cc03ffed4ab9428475b48

      SHA512

      5415fe15c9ee0bbc42f97926912af65c1d9a1022588d3b88fb1657e73c66657bcdb7a90501c24aa2c3039b413485dd135f239cea36791e3f4588bdd3f2d74470

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

      Filesize

      1.9MB

      MD5

      30bf46c57bae895e0a08d390a6120796

      SHA1

      880fe2e5fb45f663457a1f98ee33edaad91736c5

      SHA256

      871b9a02daaf997579bf494a7d39fbd546291deafaf498888d15a61d21c8b1de

      SHA512

      5019995913524b8ec131bdd4ccd89a26cfb03b7f4f0f8af396e43c22dad953dbead733bad7c7a1053591c400c7e54c383492de64942b8f36a24c5bb480f0defb

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

      Filesize

      2.1MB

      MD5

      82cff6ec9b2b7457fd944b00b5931728

      SHA1

      8d112fa32465bdfc2b969dfe1a2031e5f5152558

      SHA256

      cfb381270569d3663c3df2f0127706a7ebbeae517fd6439791a2f0b7c752bcb9

      SHA512

      b6c9dadd731f5b9f5f6259e364ca8ae68a1af881c795f5b629597c85e773dc449880c6418efdc8684d12056a4807a4b2fff9b206eef8183a5ee8ad5b16506452

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

      Filesize

      1.8MB

      MD5

      bedebe3510215d7442350e62ae113ab6

      SHA1

      f3987597e58c30d3bf76f69929c29444f19a3d56

      SHA256

      88ea01b80096693ab5aeff8344f64e6da2cb01811d42623dc3b3b0ff6dc0bb32

      SHA512

      2428ef0c920c2163433ce16b3c9a4f442dca1faf234babfddc4d54d743bae7f87f102579f22b8a361ff3f72301fe53abc580291ccd2cca37d7b8c683800c89ae

    • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

      Filesize

      1.6MB

      MD5

      7018204c66e492d78007e3223105f3f4

      SHA1

      399aec915dddb6b5810a4fb22c61550e8445d67f

      SHA256

      d86499bdc48d456cd9af3da865cae08795af7a08725b1a52301b60093333bcfa

      SHA512

      33ea1c64f085f04c1421effcc182459cfdeb7a3f5f27d5f5410d7ac6075ef5e97b105a9cd59fe1bad0a10445f384870c3c500c15680934cef8aebae1b325395a

    • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

      Filesize

      581KB

      MD5

      1a49b706943735554463e89e1557a38b

      SHA1

      f12b7045018a363deb30c87a66f3f2ce2ea3570e

      SHA256

      02a0be5352aa01ffd493a32290a3f911155d4e287eb786bd46b80ca58ff75bb1

      SHA512

      667727be6c8777277286cf3377e20d39b10f93e74a0e64b40752d9648ee9a808aa8b046de99b2394d557922af92c98c3b714a71408287d2b9317353c8f77768f

    • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

      Filesize

      581KB

      MD5

      d5972dfc35ba71b965a4c380eb92b38a

      SHA1

      2d5eb1526727919470cb14be7a81dab6ca73e4c3

      SHA256

      97d8e59287c8878dad5daf652c931aa58dd608c83c9d8c054256fa8a29a38373

      SHA512

      63180b2892f6906ab4a2d9b5e2bd40f4b8831da811690d803eac1522c6981001c54b11430444360b2c7454be50b6a5fa8bc9c115e7cce6f9a44d377124a00852

    • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

      Filesize

      581KB

      MD5

      6ae2f3513792d851ff9f18273e54e34d

      SHA1

      911844025dd75a9d871e4738be3b4bad57b432e4

      SHA256

      44f26338c37b87f7fd688c193f27bae5c7f2f54cbc7cc0f61f8749f860f18357

      SHA512

      d067d1ed11f1542db327c1d2bf14caa7871fbca21fcfc013a31e9d726f1c32100a06929ddbe6d99446aae662a7a5ffe826706f9d6105a5d7ebb6bd5fedaac8df

    • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

      Filesize

      601KB

      MD5

      26261479b2daad5bd56cea05aa34d7ef

      SHA1

      c5a3777b81a13cdea84e6207ff410d78617cbee5

      SHA256

      aa85a8d3f1cf634b495c4589a62a83ad3ca3e84046d54e9cee76224b312f0db0

      SHA512

      3a2fbd28839d9a7f85381b93a91a9d82c4c6b1b2aa824e1315200b19c03ecb6d3ddc6c6f47b1660c8c7a3236bf491eea2264a492a8505cfd7d2a88cb30f3ada0

    • C:\Program Files\Java\jdk-1.8\bin\jar.exe

      Filesize

      581KB

      MD5

      f13dcec3cd9a46077251ae0bef58acb2

      SHA1

      df32e0d29bb4c6201c931eeb668db34b0011413a

      SHA256

      001df09d8b0fa4cbbf67cec66832b5ce36e97fe94f809f3f9de66bafd32e7e45

      SHA512

      9cbbfdabb341732e9dd131a84c5851525c00c4657a91ca1573cb42d3c7152bb251592caf83926bcdc11c4096a4f40d1cc609a924047c47d0d56ac6623c533dd2

    • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

      Filesize

      581KB

      MD5

      54418d79c7e65545bde3c2cfe98fcd0e

      SHA1

      c3e74d73526bacd646fd654ad2606bc1ca51b5da

      SHA256

      511c29d363eb951539efecc44f1a0178a044b12f2da781788e1715b960193758

      SHA512

      2c4d3025960eb87cc6937bb106c2cfaa8df7100bde907b733c792f6e23909fc4512c665f5ceec0cab8730204b27fcec71bcca0cd784a818dfbee8437dc9c15d9

    • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

      Filesize

      581KB

      MD5

      76d819d50f93c4b12a21eae16d309c99

      SHA1

      7bb1fffd21fb4263a9796c2f5b3cbdbee7809655

      SHA256

      4e29bccef83550600df3267f20df71074fff17cc68bb7559d0a7c59217763d6a

      SHA512

      ba4a092a9385aaef1e5a7f960326123c658f7f058421091faceb9f9ace2505a88f8392f40b35470d62cee233c420b4f4b4202484a0f021106fdb6ebbebc1164b

    • C:\Program Files\Java\jdk-1.8\bin\java.exe

      Filesize

      841KB

      MD5

      0f5e185d63ecd71a702a4bd6b21712d8

      SHA1

      91a300512cde25e2dfae9de399deee01b50f50a7

      SHA256

      f8c8254c3eac554561bc632648c120bdcabca3202aa88935a5dbe1cb128c9b2e

      SHA512

      78b355cdc8c45898748ac90043a54ae6ccb25d1f37208eba2425d3f167efa1125edf50f3c2e4adf26a554ab6a2e0994026cd00ac44e9bac5e9968d22063b293b

    • C:\Program Files\Java\jdk-1.8\bin\javac.exe

      Filesize

      581KB

      MD5

      68947e06426964a9a5eb03ef7bae8710

      SHA1

      c70e910f7eb1f360a879eb732d75d1d006ea9d7f

      SHA256

      8ab7fbaefb66e521f23ff4d56a256eafdf932845e77eb6ed32259b0efa629a24

      SHA512

      57c8a4608add5ea510b044acd95f78e3677cbf5ac2ad66c5d4b6fb59f3bb7ad06da0bc52219ffea31ff6b733efd7c54d86f72ca9351077ad09a9c991b5280142

    • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

      Filesize

      581KB

      MD5

      ac354d8817390ba14e3dc5684664d81d

      SHA1

      8062e9e57ea1a3e983ed033d832b94791f9fb28e

      SHA256

      104d15dd09a4dd5fbdce13617083c10ac6440d414f6af8019ef1e56b7553ccd5

      SHA512

      da656d915a2383348a6ca5c051a110797261d599e74560ee7ef0d0ca2eb9a86a127e77d370eb8bf479ac9305dd7cdf41b6d105a9800d31b84366f18fa81c7226

    • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

      Filesize

      717KB

      MD5

      9e75e1c71802fc2a66d4b8b122c017c2

      SHA1

      3b4ee178f4d5ad9b05fc8e06476727f0fc9ec64b

      SHA256

      cfb1804d2fcd432771237e57be4e00bc0ae78a998c81313364524ed034a128ca

      SHA512

      b5c1bfc795bf0271e99a6865cf294732a45e91925f3e426f8748070f39d1b55c88f1443ed843036701be720b62d4df5b76af0442b8445859e42ee7feb2d4eb05

    • C:\Program Files\Java\jdk-1.8\bin\javah.exe

      Filesize

      581KB

      MD5

      12628d48db0aff52a94175731b6885f7

      SHA1

      b97905d14f203524c5e6930f341d31ebc7dfa0c1

      SHA256

      c55b2c168048337f8c7db8ff948a84fefaf7cf82754208f79fb22e2d5b256992

      SHA512

      fcf8c1bb82472999a4adf047fd15dcd3490defe1a156cf839933661dd8e6570a26af59d6474dd49b402a194e7a305e0e59844e3a1b98c8e2ef4a15c03e6078e3

    • C:\Program Files\Java\jdk-1.8\bin\javap.exe

      Filesize

      581KB

      MD5

      ad692213218f29370d9405a1e6616832

      SHA1

      f5060e6a1a8dd58ce5ae88c1a28e5dc8d3fce1ff

      SHA256

      2180453caff95a2855bef82c50788c27851e154c1c6a8f0874f2bdd766a5be2d

      SHA512

      bd3f8c00c9affd5ad57aaf590198428e9c09932fe52d46f6005525e3e79957ed6ba2d16bbd00ed5f820fb47951f2296e62f747d1571480e14adc8a34e472f53a

    • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

      Filesize

      717KB

      MD5

      4fd64efebf7b94e2336c3db28cb8fa77

      SHA1

      e30136c5b3256d5c846cbda75d58c87a1855847e

      SHA256

      a19379d6d5088da4ec4d468899796ff48212010024b29f97d568e08bf65fd8cc

      SHA512

      273d972d4a212974578722e4919244e746948439e628f075dff19b54497fd8c30646e53d9e3093f2616b4f2833582b31383ba2eb962475e742d7f33f4375dfdc

    • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

      Filesize

      841KB

      MD5

      2636da04cd20f5f3f6d4cf5b356d0848

      SHA1

      e265a1caf09f4d0e877f7fa076357644f0f708b5

      SHA256

      a9338fde51b5767c894b11bbf12dff911f94d963cca21d3bfc4aba87af4adbe9

      SHA512

      3249f0aae42cf4af2b23d87008043891a323acd380cb980a6cedb89b4664c52566c1cb8344646117d2807696361ca066111618694391d7f97f6b762f5ee87156

    • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

      Filesize

      1020KB

      MD5

      03095ea9e1c653f40a1e26cc0fd6aa00

      SHA1

      61a48b74b6b191bc8bb40362e2c677c9be38a946

      SHA256

      038a7b3cf66bb19e4a4f7dc30336f9b299cf601cedf0dc5b168ee003eb4f83c0

      SHA512

      5f59fe182a565c9f7ef0be5f5303e635aed6f1fe6f375cdbbc181de9579f67e775ddf4dbc41ddb225842c4e896d17755556920e235c3cd526d1bc3d1852bdea2

    • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

      Filesize

      581KB

      MD5

      c0e0a4006498921fa9a7ea78dd819418

      SHA1

      8cbcc39b604a9e826bf5f53aa670fb2b32e9bca5

      SHA256

      fa65774dd44910bc5d2ab354a1daa25de4588842417c6cd0bb5df21ce49ddb07

      SHA512

      dfdf9c14f2c591707a6d938b75d7932e918a4d1c06549b6698aab3f5ce8a8381d6af850db332b39ddcfc6a24fdf5da28c4d47fad2cf7e5567bccb5b233c0559d

    • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

      Filesize

      581KB

      MD5

      b228bde21858b05af842509da49c570c

      SHA1

      0246a4056be2c2aa54ff18df19c382adcd02fac6

      SHA256

      13d67adf03bb9af2ac26683a298377627bd13b382f09a32e1c3c84b200aef085

      SHA512

      a033a347e183599f8422a17b866b3f345090da86a088288437f35a6115cfbfeeb104c2cb07850ee29d77399fd0fbadc9b7301bed445789cbe78eff5360bf63cc

    • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

      Filesize

      581KB

      MD5

      25f49d38364ec980ccce8603e897383d

      SHA1

      5990635d4ffaea99d7d1cfaa5152254ef90a4014

      SHA256

      f0d8450dc9271d0ccb51ddcc4e592110b9a9e72397937d225cb4dc2efef80d4d

      SHA512

      5cee0dc381c54bed2c35b81e1293a74970f3bb7cb13d853965cd80a68fbb40a8701a660d61e35ae5b666d47af4a7817056944062ad018ce748da6d4c6c2314e0

    • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

      Filesize

      581KB

      MD5

      831f9a59721de80ed55ac9ed7c7db33f

      SHA1

      4b7d1b0ce18b5ead63d1286ca88dff32693d2361

      SHA256

      61ef9bb5e5a24282c7928086f449df3eba31c3bb274fcd7c8e60df2dbe4069ed

      SHA512

      32b7414acfc62556bc1b824ad12738bb9fd5904cbc61ca8fa52e7be5d34dc1e48a0284414849179ca231de23de82e7a9fa266a0bba3cef40636d2981305661c5

    • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

      Filesize

      581KB

      MD5

      a95b44485823a035ee30620c61a8dc55

      SHA1

      1593d5de78496a9292dd4b1c302bf6c566116c10

      SHA256

      574da453187a13f98e1825cda70fb9e6a40ece8539da46638153aa78ff0c8aa9

      SHA512

      e478c1453dee3d6c3c9f526b966eb3955f2cde3b1ed29e224b0b0b451b86b9d3e672e0d8c5a4a516b2114b09dde5732da29e2bcb7d9bcdde4054a6770c31d3c3

    • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

      Filesize

      581KB

      MD5

      678cc5bbce1d1cb5ff8671132b285bf6

      SHA1

      b4055abb9f94fabe821f6707e219bbe72d4791e2

      SHA256

      24aa11292eadea97d08ccb086c86a4af106670c19767c6d6af00920c8308841f

      SHA512

      4ff13e4f520afde1bb1c6412a2643bbb64bcc1195e36bb0d4a5253ad80b4cab3c2c4171c54b2bacfdda3e7e7f8d477ca9003822a9b62f9c89dbd3cb0e59870d2

    • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

      Filesize

      581KB

      MD5

      82d14639a94949afc04b3519b7b20ace

      SHA1

      f9d529e9ae6bc65a5165fbf8e26cf04669f685d3

      SHA256

      26a5b56e0e252cc8585217a003230d537e57f5943ae83b329ff5060a1c764fb9

      SHA512

      bf6379b2b83f026d10c2706933ce87c82260909d843ade40baf5d77369608b6b503f2037edd20ff236bc5c13ab4128ffcae5d41e9da9cc4801e4a5f1111f726d

    • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

      Filesize

      581KB

      MD5

      2317b94e08e2bb85949a6c54735d7094

      SHA1

      f0754a0f238740ce58be4d946593c2d067775913

      SHA256

      3136172fc90319b127d9136f4dddb58070a32af908ec8b04a2b55137239abbb8

      SHA512

      90fe5f94049e61d6cc09810718ea173811175de4319c724b8e09381849b85002973216651fe20405aa0392c527bacc77286c6c167d911535f1fdb15b7ff727cd

    • C:\Program Files\Java\jdk-1.8\bin\jps.exe

      Filesize

      581KB

      MD5

      237b80dfbc167db1f7f47b796a730b79

      SHA1

      19ed275c291f41d87af1e43a2ab4c5cba10faeba

      SHA256

      e46eb9e63092b0ba3984a54117af36813427080749e6af26c6412f160f9ea116

      SHA512

      bf77ffb6f113bbd8e637d0c429dc1f7c82bd24d035d0e926ffbbfdd684368748e31e8621998813e43d2a5dbf4818eaec291353f9af4a208447d93c9bb2f2e80b

    • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

      Filesize

      581KB

      MD5

      3c454485edec20601defef150f10a3b0

      SHA1

      c6da13891c26d899a206c02e451ef0ecd76c0c1e

      SHA256

      6b825e5644de448497eaf2f49086b111133d8e84557685f3e423d8df66d31ae8

      SHA512

      532be7f290f999d7b4ffcccf7a4a8faebb6ccc0e642a04fc6b7f74811d6e31d4b398afc648b12c80c929d41c14b647878fa7fde2f017075c27299ba524c4f8d9

    • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

      Filesize

      581KB

      MD5

      734e168091bd05ab328ec0c93f4971d9

      SHA1

      dc12909019b563ec98320e2f711a81b14b8d8922

      SHA256

      128aadf05901eabc6903a6784f4cbfcf0320a54e3b31bb07c7464ef4280b75a2

      SHA512

      163f10316287c261d996fd78c7ce6bbfb4ce41ac71ed4c98b3bc33db89abed492f90f9050683197797cf33642c0afbf301295ad8335d4fce47abb1d3d3fee68e

    • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

      Filesize

      581KB

      MD5

      4d51e2ebf96ec537611bf69bab8783cb

      SHA1

      3db17de9d7564004d688e5822117f5eda8f3690d

      SHA256

      28dcda57faf361a25862a21d2e411c7e6aa94a8b6bb123c1bae404fa7374e943

      SHA512

      0a3e9df9ce58e480dbb229db4ef5c3fc087ac7068fbb81ba8cc37d2b1b3b249781d89ba182b953636b0860a8492b592a5ee137ab86bbbdbf95c2f9ae0738fc3b

    • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

      Filesize

      581KB

      MD5

      543e87b89fb69de020730a140d7c5198

      SHA1

      43fbad208cad8bbee267060a8d9d3f49acff152b

      SHA256

      ca615d0f992da05073b9b439d67ed145cc9e171b930cb21e8b8877420dfd3241

      SHA512

      cff228e7ccf7235d24858089544927488549f2828751904447afef77f680d85cc14c93bccd06c08ccbb29d7797c39f5f7bde32f58f342bccea62ba8e2df48e9b

    • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

      Filesize

      581KB

      MD5

      c4046b30072e8ad07bb2253b7f4313a9

      SHA1

      5e37a558d3f428bf353220c98417c01386587081

      SHA256

      f87184520be6c1777c4d1a8011bec8495f76c9c7d4f68407c769785173d39452

      SHA512

      87e077dbada2843b7a94d7695b10d4e5f79147fe9770a71eb257eeb37b4d051a54d50cee00309149ed8b5409e053205b69f6e9b168990dafadd835d1c65a12a0

    • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

      Filesize

      581KB

      MD5

      9780ff6bb72a3baaa90f8688020f1e65

      SHA1

      358e60723b00055f8453be02efb7ca79d6ca6370

      SHA256

      d9714a502c530b81577531a9d6ada4e422a673e9b8012e7e0a89fec5266d260c

      SHA512

      7f332be8ba6ef3266859f7dc613c1b4bb8bf8b9a05420b38116f888f693d677b0b7ddba85e126c80e6dcb7d0609e9538a98188594d3948b5470075937911d0d3

    • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

      Filesize

      581KB

      MD5

      3d4f35a548d4d6808e7f4469d5bd48a8

      SHA1

      2aed5ce4e9c9687a8c4ad0c56cf758833035ac30

      SHA256

      b17f367a904be18e30c4c353dc599452797cc8804487fac852c9003485c888aa

      SHA512

      8a8af8a2ce8e31550fee62142929a5ce37f1b7e088f5a44dafaab90eb4178d32502b524281bbb83b1f8507168e7eda888585b3d6a9678563e3fd170f3e56b49d

    • C:\Program Files\Java\jdk-1.8\bin\klist.exe

      Filesize

      581KB

      MD5

      12da99dcf3a0b5facb1f19da5944f70e

      SHA1

      7ea9e315904db5939060d988787eb415e683c43f

      SHA256

      3cf0a2f64ef6cc6ce61a1e8a78c0edb7b06d7cff6e562b596d7010b76f93c97b

      SHA512

      99ac14e5314cb2b0b301d8975b3ea3c0c98aaafb6130c29a0b1071853c939d7e4eb18fef39bf7a27e77fc72dd760a672996c094988b1bf8322a506f950e20c9c

    • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

      Filesize

      581KB

      MD5

      383d8ee6c524e51d6c9231435516dfeb

      SHA1

      14389c8d68e5f4fa16072dfa107aafcf605106f5

      SHA256

      890c112a8c92ec87bd0cd46ed4afc9ac171750b113acdcd296cacd3b248790f1

      SHA512

      7da01aaf113297c67b787390c54ab2bfb7b8f22a8afa5a4f0280abfa8fa0b3ca89e49835b758b5b09f127463165fe5d55cfa33ea8c9d029d2756e74f0b9568d6

    • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

      Filesize

      581KB

      MD5

      368e440f56851efd1c08bdd451c1e383

      SHA1

      bb3c1aba009d8dbb4fe8db7edaf40c54a5432814

      SHA256

      b4210aa73ca0c46d85f3da018ff4e2c44bbe7dc99d386ecb1d7cf95db38a76e0

      SHA512

      686ac78fb936f3464a939af274641ed261c59d557e14f414e6cbb3c8049232e879e6e7cb5d85b3a34d12a74f8e2d4e190105cecb8bce670fd2dead4afb545577

    • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

      Filesize

      581KB

      MD5

      fdf2325ddfc91511506669b5647bc58d

      SHA1

      276eb2fdd326f58ddcf9704a08ad2816df50d931

      SHA256

      11bbb67db73e0791bd4281812ae56af07bdb32b17c704a1e93048ddca7544801

      SHA512

      c28fb8fae6484523c7cdfcca812eb20e7bc18ec10d930afb85bff77d475e2e50c1dae2c4fbe2bb87c71a7bce6bc417a7b985ba49c1fd691a7a8340e3517f8466

    • C:\Program Files\dotnet\dotnet.exe

      Filesize

      701KB

      MD5

      9cf38a7ce5541670bb6c6bbdba749d37

      SHA1

      84cec96f90d5806ed3ac278f1ba7869f14f4f24c

      SHA256

      4b1380ea2f7e6a413075befa4bae348afa310c33caebff99a78b60b02569acfb

      SHA512

      81eb37611a777ce8b78d5ca90c39375e6b59fc40b8e521a73472415fd86f96beca25733f800441c221a054f41be535a6b87b34e28e88bb3a97817b7f9c127ac9

    • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

      Filesize

      659KB

      MD5

      f60672f902a6f4ca414d8a89cc885174

      SHA1

      cb913e37b4598991fc39722288162d723d1a7e60

      SHA256

      b56156d08949177d908fe6043c689a7ac2a04277898af237de3a2b9af29b9f3c

      SHA512

      edcf86f02c417e643b5155c499ebaeb85b2aad263b987d4e8ff44104562fae0ada748d97ed212c2f3451be1b45cb462dfe241eb79374ddb017416e86c4d099ee

    • C:\Windows\System32\FXSSVC.exe

      Filesize

      1.2MB

      MD5

      39c02b4b7ea8c80f645e225b80448e1a

      SHA1

      642737364f7bcbcd7bd6d45fe157e8b92939b861

      SHA256

      7e8a589ab33958f3e5eb2c71bbd5c80cd443f0d8a3a1830f71912f2bdbcb0c0e

      SHA512

      026c9f2c8f430e63ec13ceaefbea2a5788809cb205366364df9d3ab6038d790288db8bff8d30083c691fccff55364b48632a5a9b40125ff912f76acba690de90

    • C:\Windows\System32\alg.exe

      Filesize

      661KB

      MD5

      184fe3b02eed89a6315e44c9396bd6ce

      SHA1

      bf831bd025b0c6ce16037bfd4079e7b7157746a9

      SHA256

      1811f9f5169cf40eb3267a2b1b0bdb1062e09dce76b93d20daa57bee543086f4

      SHA512

      fd4fce3d10c699dbaed522f2a165ab82c2fe74dc8124e6478fffa8ea42cb32ae99a840fa03fc7f389dd0b2f1a402d1b7ff2fbf31ac6baa3090c14bdc535d25c7

    • C:\Windows\system32\AppVClient.exe

      Filesize

      1.3MB

      MD5

      8c1435d113d2a537c9bd581662557e51

      SHA1

      dd5251bd5bf004c6e0177b9a8249a13466e99d8d

      SHA256

      036806ec745935448e174eb7d994bd7254164d2c346c3bc9377fbd3e754e0235

      SHA512

      ba09955a9bd4f3eb8b700ff54006a5ad947ac071edbd233d6f4fc1f6d1f3f26226fc34b3488d20e9a093ca05b1dc3bfaea51876c56cc8c154f50f66772461f23

    • C:\Windows\tasksche.exe

      Filesize

      3.4MB

      MD5

      7f7ccaa16fb15eb1c7399d422f8363e8

      SHA1

      bd44d0ab543bf814d93b719c24e90d8dd7111234

      SHA256

      2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd

      SHA512

      83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7

    • memory/632-270-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/632-49-0x0000000000440000-0x00000000004A0000-memory.dmp

      Filesize

      384KB

    • memory/632-48-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/632-55-0x0000000000440000-0x00000000004A0000-memory.dmp

      Filesize

      384KB

    • memory/1524-63-0x0000000000D50000-0x0000000000DB7000-memory.dmp

      Filesize

      412KB

    • memory/1524-271-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/1524-58-0x0000000000D50000-0x0000000000DB7000-memory.dmp

      Filesize

      412KB

    • memory/1524-68-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/1928-11-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/1928-20-0x0000000000730000-0x0000000000790000-memory.dmp

      Filesize

      384KB

    • memory/1928-201-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/1928-12-0x0000000000730000-0x0000000000790000-memory.dmp

      Filesize

      384KB

    • memory/3228-45-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/3228-44-0x0000000000E80000-0x0000000000EE0000-memory.dmp

      Filesize

      384KB

    • memory/3228-67-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/3228-36-0x0000000000E80000-0x0000000000EE0000-memory.dmp

      Filesize

      384KB

    • memory/3228-65-0x0000000000E80000-0x0000000000EE0000-memory.dmp

      Filesize

      384KB

    • memory/3380-79-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/3380-70-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/3380-76-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/3380-272-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/3704-0-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/3704-109-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/3704-6-0x0000000001090000-0x00000000010F7000-memory.dmp

      Filesize

      412KB

    • memory/3704-2-0x0000000001090000-0x00000000010F7000-memory.dmp

      Filesize

      412KB

    • memory/3704-80-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/3844-31-0x00000000004C0000-0x0000000000520000-memory.dmp

      Filesize

      384KB

    • memory/3844-25-0x00000000004C0000-0x0000000000520000-memory.dmp

      Filesize

      384KB

    • memory/3844-34-0x0000000140000000-0x00000001400A9000-memory.dmp

      Filesize

      676KB

    • memory/3952-88-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/3952-82-0x0000000000C00000-0x0000000000C60000-memory.dmp

      Filesize

      384KB

    • memory/3952-119-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/4480-273-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/4480-108-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB