Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-10-2024 15:57

General

  • Target

    2024-10-17_377de5a9a4ed12e54661dd182969b658_wannacry.exe

  • Size

    4.1MB

  • MD5

    377de5a9a4ed12e54661dd182969b658

  • SHA1

    e486ccb51ead0e09509b0427890768dbf64ae581

  • SHA256

    b51c013518fe96cb8b7209e55ca9d34adc011fccbbfffc366b9b0d9a2d4b38a6

  • SHA512

    786af641a60fda34394b9f265321840e09e624d0800e6cbeb6fbcc3022c87ad45acdcc8ab786a0301cdef1c2076a68b704309eea8767a3a78bcb6133219c0f45

  • SSDEEP

    98304:2DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HXbx4uR:2DqPe1Cxcxk3ZAEUadzR8yc4HX2

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Contacts a large (3001) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-17_377de5a9a4ed12e54661dd182969b658_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-17_377de5a9a4ed12e54661dd182969b658_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:1768
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:3612
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:5080
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3116
  • C:\Users\Admin\AppData\Local\Temp\2024-10-17_377de5a9a4ed12e54661dd182969b658_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2024-10-17_377de5a9a4ed12e54661dd182969b658_wannacry.exe -m security
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:2020
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2988
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2980
    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4632
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2432
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:4812
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1852

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

      Filesize

      2.1MB

      MD5

      a9cc30c439c43b1397f5ad0f43badb32

      SHA1

      79cfeee104c1029f402ca442f04bc4720c5ae47c

      SHA256

      c98b3ec4af0b18cbbbd992fb86b26f37a384e1fc09a8f6d6f7fb5a43a33ff681

      SHA512

      aca96f62b73799887b3e47b41d7862f970bd7481a87992a8ff116630024128ced026bca95ee40b68b06b2640159ba9cee70f4342e3082e6b34810fd572041442

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      789KB

      MD5

      ebf0e3cad90b076569914b7cf1085294

      SHA1

      9bb50534cf0725721dde12fa1314ca8a5d817a61

      SHA256

      60824c36f1b562a4144bfcbe3b8f1f52a9894a3478e1708ed1544cc9b22f2d81

      SHA512

      1636eef021cf0085ca224983f39a1da9c63f0fda75e1f3db7da77844aed59ec17d9a87b2aac913327b984a28031a7066fe00f8add0e51787c015940b17aecbc9

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      1.1MB

      MD5

      831b9c0575a4ef58ae8cd40f7490e62e

      SHA1

      7155c4e44092bfcc63c3a3305b7a19606db40887

      SHA256

      69d6ef33c7d45492e22415a587faeab57b179082d516250f7d6e506f8bdfb06a

      SHA512

      69e047a04eb510799f395d5e99e85d8b8a6cb575070e72fbc64847dfa37a33a552baa202c36d4c256f087d215d1ef21844d0c2878a3ac52c2735213ff4fa82a3

    • C:\Program Files\7-Zip\7zFM.exe

      Filesize

      1.5MB

      MD5

      9fbe9cb0e7328b832cf126373d13130f

      SHA1

      17ea19b8274d5ca4e27f227c781c8a233349053c

      SHA256

      67b805016184949ccfea663e37ce98ca8be1bedb13c2eadf4d5610fab0875f67

      SHA512

      7f7d7147b7c50d68872ebedbf38222fd36ecc256182327aaee10fa55130900067158104131bdaaf813951c2fa8dc1497a20abf640862ea9c3faf8ace2ad8b306

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      1.2MB

      MD5

      38db8b9f91652d9fc27334debe4de98f

      SHA1

      284588049a53995ab0f9150fdb63956ddc1b1b45

      SHA256

      e09108410f64aefd4d796de42732224fc3892d151a856cf779c12b8bc680952e

      SHA512

      5afe53cfeb83c77da71dbbb5467ffee066695e7f91faf1568a38f67fb9a69026da3dd6cb89e6ebc629271291957e05f75c7b4af1effd36ccefc4d224e053a12e

    • C:\Program Files\7-Zip\Uninstall.exe

      Filesize

      582KB

      MD5

      726ba2b05b9ae333ed3282045b58382c

      SHA1

      d1fc179a65069e865b88595d8f89d0ffae7b45d6

      SHA256

      b303c6adea8a530f0003263df75676bc93f217debed42ce5a62661d586a497d5

      SHA512

      e463d619bb786882904877ef38030c16faac377af5c33bd3dc9e0095c7eb7f63a1b33a02e23834ccaeb111ae4ba2f3875519ab594ee0ca7dc43c253d70cca4fd

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

      Filesize

      840KB

      MD5

      1513eac3c8e6d62e0dba5cddc8f78bc7

      SHA1

      532b5964685b294b954aa87fc782b5744407ff24

      SHA256

      0021072b6fbbec0b4428fb377d34cd0613f042d927b21756bc88dcc56ba81312

      SHA512

      dd5f50cc479b9f4d0b1e81773db4885487711fc8c9c95d2525bd4192b836989da9f6371264862b7ff1aacb39c4cc98a003c5761f3a14579d4866d573ce85abba

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

      Filesize

      4.6MB

      MD5

      b796e1958c8c11f4fed5c732bcf79e2c

      SHA1

      a8c6cc94ee519c5b4fa32b1134de2efb93d3246a

      SHA256

      878d1758aa39bc30eea2731c1719816da865a96bb9fbbec09f7d6c2131c44eed

      SHA512

      a36d508d994ec8bc466fba499b375526707a4d1979264aa0123e95d360d47f31a73d37a3547d813ebc63f7d66e9fa3d24d8561cffbf5f88ae525884b61e215aa

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

      Filesize

      910KB

      MD5

      cb9fbf98db51bbf831edb546568cd50f

      SHA1

      51e483932e34f99a372538470ac530dc908fc278

      SHA256

      67480a4ed7a564991dfcb6cd82f321a7dd39c953d024a21424bc3a9c9d7f14b6

      SHA512

      f120db856d92fabee76c8e7d970ff4c5642da80ed92fce2acad69ac5c2fa04f484f289d66cecfa077a151428f609f30b3be2baf20e683692566cb481ba1353fb

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

      Filesize

      24.0MB

      MD5

      c1de1fc5c8a48d9d6193b766308a0d74

      SHA1

      376b2667eda7acd4d42b8352ffb9500a6f8c8c07

      SHA256

      ea3f041927976b079977ebf099c70449652e39f067cff3d279c7bddee6bfcdd9

      SHA512

      0e81ff0c542cbe0bd8fd7c0819f4234f3a11f3708b656b5cd21e291ef455408187c61337388c025c7de473c3171b38185feb53f17b102251555cc308427c6e58

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

      Filesize

      2.7MB

      MD5

      f756eb07c7cde2485ab5547534cd49c2

      SHA1

      99d5ade720fb2558c67c118147d639b893d1487c

      SHA256

      97481d4bd56940aeb0a23409aaedf15c8c2a03a50ab678589b481e99fa5ace6b

      SHA512

      9e3ffcc2b103648e8a775c304db3e902a0d8b22f1e97b374b4d79750917e0baea04765eefb95b75722f72b84c0bdc77c4a8a381ad3980c25e87cdac2106bfb40

    • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

      Filesize

      1.1MB

      MD5

      2156fb4b432c30a9a3ce25828801a324

      SHA1

      8a020f5b2a54bcc54ecdb5fb6cf182ac5e486134

      SHA256

      0719b10f5d1aed0bacc55edbab924790f5d370e8dc9ce9b4f894d08729b0f520

      SHA512

      2890bf315b66b1f54d39fe40eb171b5d4728264992ceb0e73d6ad6089c2ccc5ed2caa3f1a6aa463b23eb702a11f02ac452c75366005c19aa0d905631ee748179

    • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      805KB

      MD5

      dea481b37910d97f0cfbf801b5b803b9

      SHA1

      8afd8e62f36e6692630ed0ac15b305d9f4655972

      SHA256

      c08f7ec8f5c0e45a3d39a27729150ce46da6af23a2bf156f8c3cfda0a50db3d3

      SHA512

      f2440852a2b2886f786874a86b9a8a74e9ba779771eee7ccde165c0239e20cb71448f3a2a8eaa895cd115f365602381614868c581c1c6bebf14ccf16a62db9ba

    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

      Filesize

      656KB

      MD5

      ce0b48a37ab918b0e2c1c4816220bb2a

      SHA1

      86916241c18aa3437c12644121130840e736db93

      SHA256

      baf96466f931f3404e6c004a2edf215d3f469437b341fa7ebc406329c8f9c526

      SHA512

      d484d43b932bbdfc41a12c866e3f6cfe63f1d0a7e386a6462314fd2524894bdf14044b1eb4287389ee8015d1e93230cfcd8637f24db92418e730597e4c7736fd

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

      Filesize

      4.6MB

      MD5

      1ff3a3d985d924bdc4b06778d175abb7

      SHA1

      4e3e155254f3d524af202353ad53f6f804484d50

      SHA256

      7b3e1f9befb4e749c00feaf556015e6cf6d95c6f4e31246d517d24a2738a51bb

      SHA512

      4b86f87af6d86f85a3df8860805cf00a42b124b7da626f26d96edf41bb501c43079db1fcf95289cbaddb1b3ee56d8395dcf897b7a69884fcb5894a23ec542c5c

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

      Filesize

      4.6MB

      MD5

      670d7c782bce2aae1c0c769b9735a26a

      SHA1

      49137de263b08b1c15739513c9db4007d47f0822

      SHA256

      a0b6042f821447af1d8dbc186af60fcc2adc7bf27f8c2cb93a9070d2868572c4

      SHA512

      175f5f88352038b6453c52eda09fefffb6541b02d1299be7d0afdc25b5961aca24c34a0c1330f77c200bb3483bfb16cb8bdf3670fce6e43daa2cd3b9631b002d

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

      Filesize

      1.9MB

      MD5

      12e3f7cfcc817c9087e6cb050a8b0f60

      SHA1

      454716bce8c8c713aade7d33470f168ed10239cc

      SHA256

      722fca87f883526da74a2bd9fa5cfa7a0310d4e82cee008754a99a9880a2800c

      SHA512

      ef5c5061546852be853d85f6ec796360e0ffe53b9917794fd537176f870fe94733616e6710747fdf6b26d8a8ab080d117d7f3ea2f6c6f08941af7ff557d7516b

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

      Filesize

      2.1MB

      MD5

      b36943932cbe7cb20940ba82e4124ca6

      SHA1

      9ed77182b4b3ab1f676ff70a4b408cb66a27b938

      SHA256

      b3d78a814bc797e734ea897e6c6732655a936661e2a7761b14557a637a14ff07

      SHA512

      f460ecbdea2dc58c13e07c117725aa752f0c9249a8da9b6936c8d7494a609ec1a507561f14ad3e77895d45a02e22a49fb090a7f4dfdc4f570538d98eb740f76d

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

      Filesize

      1.8MB

      MD5

      f958ae0a0c4a26d6ecb3e1953300ec62

      SHA1

      7927db0bdce227a02a4a766cdee488bbc3270c45

      SHA256

      c16b0d0de00898d8caf514fce91ce8247c61cd41ffc6a574e44289a3fbd142f0

      SHA512

      f556a875d1ccd57fda572d388168adad612758f965255bd8d7f8bfa959652edb393ec5b77bc2eb002820923277e8c73c603edbf94669ffcc6a15e47265313cb7

    • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

      Filesize

      1.6MB

      MD5

      157e678a0e635d1102f06a32fb049fdd

      SHA1

      7476aef8971cb2eb57c83662d431156f5e5664e1

      SHA256

      f4b546cc8915e63ae921b67959967dfe41906252837ad8a669803eb4f99da265

      SHA512

      354e6000cc17789c0d5df8fdeac2fef235731c9cb768388704f4ec52002baf20592ef26a29fa7bbf4b463dfedf8bf2630b480f13b762b95ae147dd2a3a55dede

    • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

      Filesize

      581KB

      MD5

      550510ca4baf31cdac7be4fd67015b10

      SHA1

      330c02aa7449683150fae65b9efa9ee5d9af9508

      SHA256

      c9a53915cbf1ef4ccace0b33f1ef93b63eb541e6636b128e603e42ab7423c961

      SHA512

      37e9e93afa9593b594b4c0a82297a8a034f1aa875fe0d9f5fdf17fe691c437b6d2887fd6e5d2b2f871febe64724d14b587a197e4c2b4eba67e864478e9fbb9f9

    • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

      Filesize

      581KB

      MD5

      acbeea5047f1c08afb108eaf944d6356

      SHA1

      61b7397e72cad378f7bad726da20848325c5bb0a

      SHA256

      d07e38fb2a8436d597cd8970d3f54a62d262af2cfd2302a71f60e2b582778f8a

      SHA512

      8a8de9e4eb67c766333fb7538e19154fe95536a989624576f559f20625f5e87ff990ea99b8463c523a552f5a364bf4f0c54cb0218c98b7c184e49daca1b7bb66

    • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

      Filesize

      581KB

      MD5

      402ae9a8346885c7c30dd0daf689d116

      SHA1

      f176f0959530de682d4adf0fd4aca7db70d31586

      SHA256

      e7fb6f1799c191af33c4b2270efb0f63760f1ef195827447ebc41c5a628e3370

      SHA512

      365a75dcba9e70d05241855b675077aca19fffd0d26b16fd2a1b632436c40831724852b034cddd5cc1257133ebb2c64d48ee7b89a8323a5fcf94911b55cb6d9e

    • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

      Filesize

      601KB

      MD5

      96373aa76eebf3171772e8a10445e883

      SHA1

      39b771e76054f6defe76c6795ead680900544c7b

      SHA256

      c07af7071f6ca0057c9fc4a11c9fd4d2b52b9bc01cc85a7a3dcb98cf191c40a4

      SHA512

      d00ed7ef222b12c0f557a0e1e270df1863c6bddb550089ccc80ea10a0214f7a51ca48dfd42a591f22a7ebbb0d19f2c1e045e5b36a7a1fd97e287d57c2f27f932

    • C:\Program Files\Java\jdk-1.8\bin\jar.exe

      Filesize

      581KB

      MD5

      db3bcc39c842a67af5e6585fcd483f3f

      SHA1

      9b02abf503ee230690a5203c89e2018f025003b5

      SHA256

      69a29350ed0617483e7b21e1bc422e5d20120aa2a0bd6b7e06d660a6a571813d

      SHA512

      06b48622c63b77554083b64141a23c8de1c693d2985ff26d34c31c0f864e1c5e15c670376b2eb637de0596eddfe0c63c4df97378ca2de35cd13377866d606a98

    • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

      Filesize

      581KB

      MD5

      e7bcc1969aeba50d20d93cf9b1908d8b

      SHA1

      423e2e63abb534ba07cfd78ec9571645617b8858

      SHA256

      83a8b39f59f32d1e5ca4b2da98a9a41ba62725f079a0b33598a8994689c1b003

      SHA512

      eab62ee261c83a7baf8cf377e078d11aaee9eb942641a7964b9fa180ff017ad61f43a8175333f8b7158efd0402b66ddb567f81c01cbcc4055e42c96abd30bce6

    • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

      Filesize

      581KB

      MD5

      18a4c2472e40459d011820e8da0d4c5f

      SHA1

      3c3d5e2e7dd2ff35bbbd1c362295ab84e3257ddd

      SHA256

      d7a1dca2ae482bf921f61a80610eec5f02e432474cb45d73a1bc83460daf18f8

      SHA512

      1f161a7096da2717dd864da340e5cc4f1c7dce7a8dfc034949135decbe552397d71b533b400e4799108e58e170e58b5276e938db1248c75924546b78e455c0c2

    • C:\Program Files\Java\jdk-1.8\bin\java.exe

      Filesize

      841KB

      MD5

      e135f2db57f3ec8f3e4e43cc4cb6665c

      SHA1

      5d552999808547a0116a7804c2576996d9429e06

      SHA256

      9d39e3f63542e252bfeaf81a584a038ece44ce645c4e99dfeb0d7f64aae3e904

      SHA512

      d14ca4ba20c24bf6999f2d47efcc2070f9cdc711259a02e0360161f639cc5dbe90f59014b0ffa50c0533c2ef06d21a1e474568f98122aa0330b248a851e87066

    • C:\Program Files\Java\jdk-1.8\bin\javac.exe

      Filesize

      581KB

      MD5

      c3326cf33bdded0bf4e4e448ca7b69f2

      SHA1

      7b564485349d12004e64c84d49a9644aec279670

      SHA256

      8fef35b380417fefac852acbfca669328110610ea18cdcc44912a09a91f3945d

      SHA512

      5773d87b4f94579ac6629aec9eb56e11daecd7f9665c31ef47988dd562cbc8722d2b5349cabd4ac0738e684d90308899b58d7d42f2312c3e18efe37e23cf9333

    • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

      Filesize

      581KB

      MD5

      e6dc1e6eb7b8a074a429f6ffe14692bc

      SHA1

      d0f1744990b22ea8011a3510185be3b8e1f09292

      SHA256

      7e9758b1aec0ab1d01efe71a949adba4e02cbbb84066a15830c6e4c21eb6809c

      SHA512

      7692f4b0e2523a7f8b149d77623d3290b8a649282b431d8a2dd677eb0aa09ca0098bd5b862fb1cbf2d722d76ccac07998daf3c422e610c6f8a7de32cc2f12b06

    • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

      Filesize

      717KB

      MD5

      a955d8df59df2575e598b8d59ed63533

      SHA1

      dedf2fbd23047c0e4ae0f9cdcf3de873f4230d80

      SHA256

      126a5576da3e38889891ac0abfc1e3410ba7e091cd41e9eed05d189f426e8c8f

      SHA512

      2065c73ee2aab4aff1ceb7103c38ea47b6b75db8ff705a54ce0575e7e1043cd49ff3ec029dbae825b11d021812006837b8595dbfcbed310a3568b6db4d3f7c0f

    • C:\Program Files\Java\jdk-1.8\bin\javah.exe

      Filesize

      581KB

      MD5

      098051a422c6f6d0f8c888a1094aa177

      SHA1

      340f7421abeb9974309f48e98a79b3c7709bfaea

      SHA256

      93e241dfaa591e97fea9b7ec1f9bfd2be82c25b6020d74d788b8ae72a5ff94de

      SHA512

      dc9afdc578032fdd2970af47f407e51bd04140290798c9aa88ea0c1acc8ec56769cf500c55fcdbf5d38ba14048e56f646a5d3bb428f1673c6adcd6bde76a132b

    • C:\Program Files\Java\jdk-1.8\bin\javap.exe

      Filesize

      581KB

      MD5

      94e9bee1976b2bb76747c8e315bcf7ca

      SHA1

      1934537c2c29d727aa49d2d7f0962d362e238a25

      SHA256

      dba7b38b571a636c7cca10e3842460ef9d6c509a70b2eed697ed1efe06a7756c

      SHA512

      50fe29b8713bf4aa963927d572108a0828b311cd7fe8cd7596d210e165b1bb3acfe41168574f6aa60b851ea5147361bd0a32052dc45d962faff961202b7ac662

    • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

      Filesize

      717KB

      MD5

      b1ddf9d0568013f72c364f6626baa3e9

      SHA1

      99dcded5b2fa71831a21bd0e9a70674d666f9172

      SHA256

      62f99545af85e74e1d419180c13c5fd69299030d6412e40dacad48efe7658d14

      SHA512

      7e8e32d0cf068208bf2b5e6d733cba79497f32aec182684c0d8fa1f54ab6e5f033e9615279cff34692a7c65659c1dfd93882ad4a740998468cdcdd879d740ef8

    • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

      Filesize

      841KB

      MD5

      667412c4d47527b7af94766bac6d794f

      SHA1

      a2e6e2f168fd9c47e80d127afe16347a7b6131aa

      SHA256

      df31a558abbd2ad33b658d3fc131fa024c5a92e7d5a77bf0f304acda4fec6de4

      SHA512

      e9827119f302ab536aac800d494c298eec060b2fa4dbc88c7ca0333fc72b7ece96b177f096ac135dfa6dbbc40f3163ab5f23a779d22b462cb0359ec03639e392

    • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

      Filesize

      1020KB

      MD5

      23aafd90ec74a97cf83da812493c6e5f

      SHA1

      3dff36149d6f58eac0c311de144e303e17aa1912

      SHA256

      dafbe97526bfa1d4eab996deda321702f4a3e928fb85e3a8382ee822f37deafb

      SHA512

      705f370589e817d68370d5e2bcce6874d6ed13f429d5e16fdfc28b8e90abc72740f10aec082e6946c1bc18f0c6d8916f588d039eef81b7bccae13c30d358142a

    • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

      Filesize

      581KB

      MD5

      85febbcb8a284afe8060e3530b3571f1

      SHA1

      72c05b7a71bbfa83ea7fa2f2b3bbe380cbff25c8

      SHA256

      38c90fc4f2bcad38a9d0717e5cdb9dcf819e223da6ac1ba4e0266672e4f98db9

      SHA512

      a81fe5acd609738b4e732b2efe88b7e99e8df7dd9c30f0002028921959c7657a3d62beee46211b506aff7845fc083cd849e251ae3a9e317ccc0e3e5b8f354ca5

    • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

      Filesize

      581KB

      MD5

      f28ef68bc47ebba83bf742f0a9aed440

      SHA1

      e0f3d6d4b468a1003d44ad06384deaa42683de2c

      SHA256

      e423838697dbb2593b888f1f832f664894116d05bb39235e5147e5e490d38f23

      SHA512

      56da422415f43d21d3118e976afeb6617e18dbe03ab24f70874eb6ec71c72b94ec78f49907778e87f169dc1a81a6de75ba072e11db733d593a0f0a009fb251ac

    • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

      Filesize

      581KB

      MD5

      80954e1524a6b2765b8b107ecc651df8

      SHA1

      117701b8bbed6d281b628cce15655c3f8ad46164

      SHA256

      b5d45610a83c13ed19ca25a9f1d4fab277548a3d86d9bd8f5837ad8570e3488a

      SHA512

      3d00ecd99ce9d2455dc11fa1c904bb8f069f8067e4cd875f9d10bc6315c3500ec80096939eb4ff2ba029ad5ea7e5770d6c859ec27253242ea914221a492b6778

    • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

      Filesize

      581KB

      MD5

      d56cbd13d029361c98526ddc66b84e20

      SHA1

      db4f97d9fd4c26fdbd8241ff62af3bfbd869a396

      SHA256

      1a998f6d633d4835bcbf59ea4e653c54926578346540439865f07373054476d1

      SHA512

      043a1895e25bfe031eb2b59354bcd67587bac3920ed5a83b1e6509b13e164b503fe9cafabb27b55397cf1e24fcc3d5aeba1c2ab43e1ebabffe543449412c7a36

    • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

      Filesize

      581KB

      MD5

      69a1d6e9e75de03d54ecb1386701776f

      SHA1

      37e791ca229590949641f808cba19c39423da65c

      SHA256

      158420dcfef886861d3ef5f0ce6f5a807ba83ec4a7f5fe4054255047c55553ab

      SHA512

      98d847fbd71fa3129aa487287f02d61cec8a55f58c8e223ebd883e06d2ebd07adf1c5b77be231e46645e18b307a1f7b594ec6d5120382f870434b16e034c9e6e

    • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

      Filesize

      581KB

      MD5

      32f526e291cc5f029a5ca7213e6b1a92

      SHA1

      b300751035d404287726424bb7b512ebd9f751d4

      SHA256

      279b86197048c9ecbb6a0799bceecfa25f69623262eba8645eac3cb7f2d06ff8

      SHA512

      3889ee62882a4d2687429b5caaf45684726c54647108ebc9c22152de81b9345e03af1432c7d0f0bcd4e6d800cb3c30efeb1d523e8432b414483a11c8d0755f76

    • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

      Filesize

      581KB

      MD5

      d05206f5a5497cd760e07743b33381b9

      SHA1

      d54bf1ef366ec5cc9edf8cc8a394967561f75bdb

      SHA256

      94c505f5c5b8cd19ef816d2018b57986ae077c3153f3d796d98e20fdb51f85ca

      SHA512

      2c5d3e142ba70bd9717aed59516ecd6f0c1f6651cc764e8dc7e80f3dab7ffeee5945ce9095a0a98a0ca6fd0178e4f7ecec506ad6c5450fae263d203bda5c73b4

    • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

      Filesize

      581KB

      MD5

      181b46ac0aa51f3b4db14936c48b0b8f

      SHA1

      d2bcc18c939fc120a8aab233f0588662ba6b6dbd

      SHA256

      797618b3ec0ea46a25b7d4f78677cff564cab6fe1461dcdd0468f4a78ea6a5dc

      SHA512

      e35b0e92b12e4cba8c3724e8e42e3fa281bf94724e267ea1226fd4b4c12501d71888ecd3c8dbcea5efda85170f56560713d315d51cfd519867902b3a13ac80be

    • C:\Program Files\Java\jdk-1.8\bin\jps.exe

      Filesize

      581KB

      MD5

      16694cc4ad019d47826472addf64bfe0

      SHA1

      87bfa2b9d61bf02576ffd4fda85a4ced0a536fcc

      SHA256

      1da9130ae05c54d5d91633059ffbf453b3333a488072311b6522aa7e00a535e6

      SHA512

      f0fa8707e07f7e59f8ede8b902c225f63f85ec42f4b142efe43374068182c249fb06d69c56fcf482751cee103549b097e69a88bbc32bf0994a26bd6abdbaee4a

    • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

      Filesize

      581KB

      MD5

      b92d489ff20f0d220fac1e8d6abf7924

      SHA1

      295c0f14ded06a88ba09bdf28f749a6dc76d46e5

      SHA256

      7989c9f95920393ab1e3b077f633b7fb6732a56a07ecb7fe936d1d9541ee464f

      SHA512

      132f0cb44cd22cbcb6d7ea42ab5ab4a2a8e31244b8e1d8d205b8c8a7e95e08a72e3fbbba0d9381175d1dec56250d0402300b6ffd83e1666315e86dac232e257a

    • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

      Filesize

      581KB

      MD5

      9a1bc8b32a83740a2c533f0809e07f72

      SHA1

      f30ca76041d0fd277e19fc50daaefeedc4f321cb

      SHA256

      e89d80e97272e56bf7eb24104d0597fb313e4c302c65a7c902f8d88bfc2464e9

      SHA512

      34bc42fd3de4024fc3a89bce963d3cd032efc84a49c6989f1fc4e6d225cc1350fc1bccecf0a356eebcf5531f85c51d474836b1c51687f643134786697df88764

    • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

      Filesize

      581KB

      MD5

      05f1ff1a113961438b049ddf1c016379

      SHA1

      af279991e4f8ac0f2669de83bb0bc683acf98e1a

      SHA256

      b9a5305e3ab47c0621d755a898f382bd2b5d5b1ee487bcf438d93c9290c2aa4a

      SHA512

      7afdebfa4dbb203b23b99b98ee44f610f9e63ee18de501731e02a7b92a7411ed7137da5119f6715ea4556370726996cfc2f5645fb516eaa73062ee7e5eb48c3b

    • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

      Filesize

      581KB

      MD5

      df76754eb34efe4d0699483337382f63

      SHA1

      a98623fe2dd71a7a0c36306b94be2d0e07f33df3

      SHA256

      5de0b8667100f26062fab026071e01c065ade0e516de8638732000626267d624

      SHA512

      9e6f1925d46bb1f42c9e4d439256d573df693547d37a39e6e212072e782640e05b7b348e94cb992189557d6d0583a6d76c0422b2fc9dd60231d55df3a984a6ef

    • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

      Filesize

      581KB

      MD5

      01adf225cd4a79eed7a82d6daea63fa2

      SHA1

      650c71001e9e8f87102a3daadf4dcd8c2d58bc02

      SHA256

      d2597ffcac11e5cdddc4ed99358e0f8c8638a739406722523a7b1dd03f162851

      SHA512

      eee135f8ce798e100e33e6920941cce497fb4705aea9763e7b74227d97da8c020b47b152a943e8784264a6f013e50d378e45efb0fa37384939ddb9846174e6d5

    • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

      Filesize

      581KB

      MD5

      0dd29734550ee4b11d8b148ae26c8241

      SHA1

      763cdeb039fd85bad6b3f395b48970b3bc346038

      SHA256

      fc299289c061c9dfda834bcf0fd20a5884e9eb85e3982d7443c5471f41b8846b

      SHA512

      b242f32f5c9687c41401c99c74875c281c9e98270af075f11954f5391c82ab8ee3dbbc6ca44a65f10d5b89cc331bb1da747c903bd016ddc7e42f19083f64167a

    • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

      Filesize

      581KB

      MD5

      6198b2814cd762b8e5c35fc4612c980e

      SHA1

      4eeecb60330c2f7b70cc75c41b9fbb7dfdceaccc

      SHA256

      ea43ab46f794007f26a42217e515af5b2b2762f19df8071f8a5bcf122a06c80b

      SHA512

      6694ea250aad343a1dc8ef7596586524201fd52e44e0c2a02f6c4afd17b14b9533be22af02b7dca457a7a77024d62ef7cfe5ebd5dd36f0994d2c7fdc4bd80805

    • C:\Program Files\Java\jdk-1.8\bin\klist.exe

      Filesize

      581KB

      MD5

      d2c40131bd2663629f2ef83f6df9188a

      SHA1

      5e0aabcbc73dc01f4f77ecc83339f8a38fe39f2b

      SHA256

      d870f5a1a0c67a3ab33f0ef1c76c74e880d89c2d3d27b12da573008a4efd7c0a

      SHA512

      661f6b36aee489d43c7f6362e24c3fd3dd6092bafdca7ac40349ad58f7596bd68527fc3e870927e163d81a70a40dd4810b6c8341db0031cdbd12a956cabf77b3

    • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

      Filesize

      581KB

      MD5

      ee010f8532ed4f2562fd2b486daf6d9b

      SHA1

      e447079090c9d521a754ebffae163173f7c3f545

      SHA256

      4a3603cb9aa8a3f179d5b5cb1028dad1b2a76195f5c67f5772878c11b102e8e3

      SHA512

      f2fbcea5c1914bf3543c8d6a3a60451f71f8cfd7d50c34c8a2c8dd3e334aecf9ef865edd3679962942f982d3834c1bedf7d5d7dcee5517c746a0781fb01bd018

    • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

      Filesize

      581KB

      MD5

      940db66f05b00506332137d6640ddefb

      SHA1

      6b473666344e854c856a2b3ffbb5650198ba75a2

      SHA256

      71627442e0a286eab6b310f07a47482a678daeb02e13ba1785162b27631b7241

      SHA512

      98ccffb0254a0f25f35c223165bd973a66074ec2bb8cbbe48ba1bcb654a18cdf71fb74278a71bbf1a3179d6c099114cd4f5e61349255584a9ccae8b59afb742f

    • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

      Filesize

      581KB

      MD5

      021d4d79f73458551cef346b7dbf1c44

      SHA1

      724413577e17a446c8face842464c46504c2af62

      SHA256

      aeb27604c4f029fff3c82d4f12dabe856273cc26bd58632841913cb8974c4c9e

      SHA512

      e64c829603f504f279a84da75d4908161d4d7e42d160ea330e9160bad988a25574375c742a8f72e51537f9df1bda862da049ea58ac1f691c2d0bff58ac1f195a

    • C:\Program Files\dotnet\dotnet.exe

      Filesize

      701KB

      MD5

      2db0b5e1ce770be038bd9ea3c0105ea7

      SHA1

      5c2239abe787fcb1154c4f7627c85de712831a7b

      SHA256

      c01a1225a7d0a49473cbbab6e8871b16a26c8965a848144b1637d132f3bf27be

      SHA512

      41a4f097b132c01c1c546800db11652fcefb47d7636231e5d5cb758a47a3d8f75e0c1e350cf1adc071cb34c2bbfb9f71277308c15d383ef02c39f63c89e55f1b

    • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

      Filesize

      659KB

      MD5

      c97c6405694d3ecf2035ceb003cdb15c

      SHA1

      8151b5411bd3551e6da2e6aba019d8631dfe9e8a

      SHA256

      7e879521f7d6d927af29a19e7d904c97057c671c8e0e1d3a2ce7f4a37575134f

      SHA512

      054ec2d91c19235364c0e2ae8062180dcadfd8ae365de48c78147bf4f742df7b614f598e475be58d1017b1e301c149390b4f6d5684dad68bfdab446a05530bc5

    • C:\Windows\System32\FXSSVC.exe

      Filesize

      1.2MB

      MD5

      3e0eb142497b3a435bfde8178bba225d

      SHA1

      addb2f6fcde5288e6a0c20b0acd5e3a9db852a46

      SHA256

      e3757313c0022db7f22157e267ac84dc97753ca3179c105a43d8c9db36db8565

      SHA512

      55f22b0f5e0b541c4ce8f947c7ef9a10976ac8c08e3db0ef023d1fbb7ed07bb372295262cd47f0bec779c830a8fefe51069b911032853271b7845059e5abbf86

    • C:\Windows\System32\alg.exe

      Filesize

      661KB

      MD5

      37af3d7332441693ec43e831de092274

      SHA1

      2bebc1b6493a38e27e6ee317b0c2377a7f4cfc89

      SHA256

      1d09706a673ca031e41e437586a902e470d974916e9c93c2ddce3a2cab3601e8

      SHA512

      370a110c5fc6fe78224aa70cbe4928d62be157fcb039857fe6c77da554f1a8a8e95a6789716bcd7a6b25fce4ff5921ef95f7a0d85d5a5a09a22331c733e3a18f

    • C:\Windows\system32\AppVClient.exe

      Filesize

      1.3MB

      MD5

      2a3698fdeb22a073e7f72fda23e70a7a

      SHA1

      3587001310278bf2115371e38cbf25bab490c28b

      SHA256

      d46832d651e2b26cec6b500e184d36c08eb2bf87c3f8685406876596d91f150a

      SHA512

      f5c5321029cf3494e4df52fb4b4f2f1cfb45c83476328ab4182a9c36fcf4753f3aca81f49112f04c32053ee25e74870e5b4b81db5c6c9b065ae5a3cbe10f3292

    • C:\Windows\tasksche.exe

      Filesize

      3.4MB

      MD5

      7f7ccaa16fb15eb1c7399d422f8363e8

      SHA1

      bd44d0ab543bf814d93b719c24e90d8dd7111234

      SHA256

      2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd

      SHA512

      83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7

    • memory/1768-7-0x00000000011A0000-0x0000000001207000-memory.dmp

      Filesize

      412KB

    • memory/1768-77-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/1768-6-0x00000000011A0000-0x0000000001207000-memory.dmp

      Filesize

      412KB

    • memory/1768-1-0x00000000011A0000-0x0000000001207000-memory.dmp

      Filesize

      412KB

    • memory/1768-0-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/1852-274-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/1852-113-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/2020-36-0x0000000000F90000-0x0000000000FF7000-memory.dmp

      Filesize

      412KB

    • memory/2020-43-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2020-41-0x0000000000F90000-0x0000000000FF7000-memory.dmp

      Filesize

      412KB

    • memory/2020-44-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2020-271-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2432-86-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/2432-80-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/2432-273-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/2432-97-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/2980-53-0x0000000000DB0000-0x0000000000E10000-memory.dmp

      Filesize

      384KB

    • memory/2980-46-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/2980-56-0x0000000000DB0000-0x0000000000E10000-memory.dmp

      Filesize

      384KB

    • memory/2980-47-0x0000000000DB0000-0x0000000000E10000-memory.dmp

      Filesize

      384KB

    • memory/2980-58-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/3116-27-0x0000000000750000-0x00000000007B0000-memory.dmp

      Filesize

      384KB

    • memory/3116-248-0x0000000140000000-0x00000001400A9000-memory.dmp

      Filesize

      676KB

    • memory/3116-26-0x0000000140000000-0x00000001400A9000-memory.dmp

      Filesize

      676KB

    • memory/3116-33-0x0000000000750000-0x00000000007B0000-memory.dmp

      Filesize

      384KB

    • memory/4632-78-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/4632-66-0x0000000000760000-0x00000000007C0000-memory.dmp

      Filesize

      384KB

    • memory/4632-60-0x0000000000760000-0x00000000007C0000-memory.dmp

      Filesize

      384KB

    • memory/4632-272-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/4812-89-0x0000000000CD0000-0x0000000000D30000-memory.dmp

      Filesize

      384KB

    • memory/4812-98-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/4812-114-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/5080-21-0x0000000000770000-0x00000000007D0000-memory.dmp

      Filesize

      384KB

    • memory/5080-13-0x0000000000770000-0x00000000007D0000-memory.dmp

      Filesize

      384KB

    • memory/5080-12-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/5080-112-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB