Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/11/2024, 01:26

General

  • Target

    2024-11-16_2b888a9a4de8238d87ec0467b80f90c4_wannacry.exe

  • Size

    4.1MB

  • MD5

    2b888a9a4de8238d87ec0467b80f90c4

  • SHA1

    e4318ac6786e7af4395f2e9f82f61f6f2a4a78c9

  • SHA256

    ff66b636e48f6b4eec703f50431b0268266677bee8e71eb22c612cb4dd599c06

  • SHA512

    8d79cbd55a19df5dfadcf588f2b110f3aa961248aa5ade83d4f19dc86472fab4099858342c3d83d4612249c7a1d09d934c2f32f9a4e2f46779e05573690c9a87

  • SSDEEP

    98304:zDqPoBhz1aRxcSUDk36SAEdhvxWa9P59Uc/JB0+HDHRXJ6s3V8:zDqPe1Cxcxk3ZAEUadvz0CDHp8YV8

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (3139) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-16_2b888a9a4de8238d87ec0467b80f90c4_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-16_2b888a9a4de8238d87ec0467b80f90c4_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:4672
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:2460
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4700
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3092
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:700
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1644
    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:684
    • C:\Users\Admin\AppData\Local\Temp\2024-11-16_2b888a9a4de8238d87ec0467b80f90c4_wannacry.exe
      C:\Users\Admin\AppData\Local\Temp\2024-11-16_2b888a9a4de8238d87ec0467b80f90c4_wannacry.exe -m security
      1⤵
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:4368
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:876
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3508
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4376
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4940

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

      Filesize

      2.1MB

      MD5

      a6135c596bdf4b0449d5b2200513e66f

      SHA1

      45e63bd23ce0c99e8bc8dda62c320a11886d979c

      SHA256

      df38717a32062cb688e6eaf5831c6443b62cc4f9324a7b1337439aef02152f5f

      SHA512

      29e70843fa311d67746a25fe8e78648b76d5571f8b035833874c76f9f24d21d447acf2394d5d8de90b6c92e87ca642596a661008ebfbb9d4bd51f61109f71d14

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      1.4MB

      MD5

      bf5d0f23a755520e6e462e6f3374aab6

      SHA1

      8fb9f5f362e4e82cb0727af38cb5e82f99d1f8a7

      SHA256

      923b12b6de54e15b830bbef9280b028ebfe2d11c1e6681d5f6ad7d8141a653c0

      SHA512

      2e95aaff810bb78bc85f5c26966e19e4962d65cb0e252137b515817e9a59df854186bbb2021a44caff931e9e1be3753641080fc9bc9900e435f448fce3507761

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      1.7MB

      MD5

      89c0b3bf823e875a00785a60751727db

      SHA1

      e4b41ca1533b678bc242cbc76accc1712c1813c3

      SHA256

      58b4f3e1c96ce2e44c66732f923a7e290e54262707d0dfde2b698a2a20cd987e

      SHA512

      dafaab700ca6587e789c475c61f53782201c2ede7da9adb70ba38a6338b970ffd17afbec15e04a9635d3eae68c7a82d5eb209c56797e5003c762661adbf42dda

    • C:\Program Files\7-Zip\7zFM.exe

      Filesize

      1.5MB

      MD5

      73553ea5a045aa8e662fef5277a5cca1

      SHA1

      a79ac42b730b4b62a2d5fa75c3093f7f1f03e56c

      SHA256

      71cbe9d10fb6090980c68fd9150c2e0da238c83d38313d7ae30b5acf78f4f8ee

      SHA512

      cc1dcdf6e5cf26801c57e8decce23d1f3a8ec7d34a114481df02ba07e6c489e76dfba34ba451f209ef060a7a1730030b8c2e858e74bfe455eafd9eb6be6c60d2

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      1.2MB

      MD5

      d49e90f39732388730de05ffc4d0a642

      SHA1

      88b4ef67753fa162f0bdcb20c8f6e93b95d5981e

      SHA256

      9f51ec5c18bfa61c1675a94aab49f796046bf5e568e6f22454e27b9e83624112

      SHA512

      e1bc2ca9fda7e52525113ce936b8bd5c28b1b3d8814d391f48cb8f14766911e9d3e4390585d9ab22032d90a1fa6270da8c3a23aae967c49d78a9e9acf3ac5bc3

    • C:\Program Files\7-Zip\Uninstall.exe

      Filesize

      1.2MB

      MD5

      0dc2acfd1b9a98325314c4417bac1341

      SHA1

      dc3f232e061260a218e4ea7470d57047102621ec

      SHA256

      d4a5cd463022374b7304b445558a10e3f3e91400455cde34ebdc06d9f215e6ec

      SHA512

      6e5287dfeeed1efd1ba3d8a2c733a3a4b199a633107cb601b6cafb850ba451544cb386b93d038eeb79e6c539c452f7e3229a6943f4eb4d5ffaf322dd5488a4b7

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

      Filesize

      1.4MB

      MD5

      8f8de01d7a305dab62f1f9cb85b3b3a1

      SHA1

      4ba5a014c98579e76feb4d4275d45658863e40ef

      SHA256

      594a6c6829723a71ade0c1be2e593bd45b532f6b21b85ff58e9696a97612be41

      SHA512

      11aafad3a7ac26cd89c5571906677c3486aaf5ebdd5f5db1644fcee3115c0fdca9350541be5c1dd516dda4dfae45d93b4349f82929b76b9157764615faa6605c

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

      Filesize

      4.6MB

      MD5

      ac2d8ffc739d74e993feeab916d2596e

      SHA1

      4e727c0fb53b45d258d959078366ced02cc73b34

      SHA256

      eb7c9620a6e91ffb62a9ab333659cc94a33660a0972560be6e33e824725562d2

      SHA512

      b1aef33f5deacf01f35d299b4f3b250bd5dd1d5498d8c1b16c279a4139f17c6a3d8075af076dceb8659170ad17d60cdc3a73d18babe3deca8095311dd6f4f2f5

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

      Filesize

      1.5MB

      MD5

      6ad787b3c7e6677be22a267a0e737659

      SHA1

      fb786a1c75e0362ee33b3b9c379836ac0d9f2390

      SHA256

      33a8f3ed64677b1c83af66ce74a3fcf4b48103e0c0d0b5849b694f210abba5f4

      SHA512

      151f93acf1197de876f6a1049d07181ebd9c831ceea209ed5af736982fd266072d63af400dac858ff315a68f801b5a08fa73bcf9025201ed5edd9a8a652be5e0

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

      Filesize

      24.0MB

      MD5

      7a649d86ef42de317ebed1147983b4f5

      SHA1

      f566f5e959ea109a0dd569defefa4c594e5eaa7b

      SHA256

      98f10915c53abc1d9f867c0fe8b92208d8a67ec4b5275c5032014f53cba0e218

      SHA512

      1fcbb4e62aa741620315b6e9190813b50f9d252a06f666813051330a61cbaee919cb59b476f3488d70c64375476a2b012872daa99f5db720896c069753797a0f

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

      Filesize

      2.7MB

      MD5

      44743d243a987af6a281fad082bf4160

      SHA1

      1496017d796ee715b06958b06a814fc3ca987814

      SHA256

      8632438b93ae39a13cc4fc7d673222ad89b1e00dae57e058ba402faf8b5d9bbf

      SHA512

      96d79fb4e5a06a7ebb4765a6e9e470754dde20b1edff7ac07a35f7057afec40c419e806e630e4949db553e10444deee2b6be6ab47facd8b288200a5d67a73bce

    • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

      Filesize

      1.1MB

      MD5

      6b509ba951b310cb619ef8e7ab91284e

      SHA1

      f602848cb4263cd8859f1cd0fb8f939e75e18ba5

      SHA256

      b9494d010ed25c12f056ec6ea8ce4f1be60a7db88b89cdc3ea9554798c2786b4

      SHA512

      60b0d27ea3b6465d3d74b773f797ae2070fb1f13485aa4c10941563629ee387f20845c9f6f330608f5a971627d88e0a834aeefc3830ce810e33976d046f503b3

    • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      1.4MB

      MD5

      54e352188a668723c1ca646aa572261c

      SHA1

      743e3c4fed20983537013953a370510342624a59

      SHA256

      07a7357829ad2d295446fa450c777be0729be0a3e72439e4ee4e65de897efa39

      SHA512

      98acb52b694f02e663b2584a0b07c4442af8e96ca51013ab98e4baad3acd38a364afafce33fecd8df7b9de64469b5f6a1d41b27a5a28be5eb76b40bbe9e7ec19

    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

      Filesize

      1.3MB

      MD5

      d4af6d5290b551373060a552b905659a

      SHA1

      63a2c2099ddca3d2cbc3034ae69e07ec538f8f63

      SHA256

      b1fdf69d6b8f03abaa4f3b6812de44dc6dbc17679678b69e069c77dc877e50d9

      SHA512

      7be123d0cc07433015bc1808c53f5ee23fd243b36cd28b7b55397b4ecddaed33017a4add6df98e4ac3203edc7f78595024c089aa12eafc7988eff86f207ce9e8

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

      Filesize

      4.6MB

      MD5

      439f83344186737ea144abb24b92f817

      SHA1

      13c81718f6150cd1f0040cbb16ae247e4757bb4a

      SHA256

      9b876363e73c11e7f5c8ce19c88745a99416a6e18010cfc16a3d9100a72167d9

      SHA512

      446b03da437d8f3bf5902b6831e3b01229ce7280c54a0636dd5138751a05e333fc7aa859b86bed9aabe1f48e8fb366c40670e51efc82f4d436c618d5f45a0592

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

      Filesize

      4.6MB

      MD5

      a88a6330d7567cc398d22dd19def069a

      SHA1

      2eae4d4fda312a8be373a15fbf584297cda6d2ce

      SHA256

      b19124105b41abf616bddcbb5d02f79d4b5027a0dc344726ecc87219258d3ebb

      SHA512

      74fb6fa4bee947420e3aa3c666e26362f3d7adcd5f884dde0604cdc8e0cdafe419cf81232a87bad8b3e7a46c673ab090b09f6b84ac6d7e944e0c2d421b8a560d

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

      Filesize

      1.9MB

      MD5

      77ab723f0df6522bf07d6ce145374e9b

      SHA1

      57e053865b85b3d4cade94a6f4a50f2941f35376

      SHA256

      a3c8b39b2a4434bda32e37c801a59b836d8f12c8a350901d91cb67dacd3651a5

      SHA512

      666e018f4695b11f2555f6d687d65d23925f27afae7e328cff225f77c1550081e9b7427e5c486ed9cf1c9c576b1b37ce7e92b9fd39b1c2bc13bc9ba9b9a21990

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

      Filesize

      2.1MB

      MD5

      fd6e9e145f8ed778437a3cfdea93bbf9

      SHA1

      e2bcb32259f55299a4c4b5c36b52591bcf8ed086

      SHA256

      d995fd42ff7d6958d560283622a0f6e9821953875647c7a1d41f0abcd7422f66

      SHA512

      80bc38a43e52475038a18e64300c0f1f718cc9b34c7bb42cb218c3486638708f08027b8efcc8f5ab8b99ae6ac3bf524ad5828d8fc035b10a93da2d045c4d6828

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

      Filesize

      1.8MB

      MD5

      7d6851964d4e49ca2a8cf503d5346def

      SHA1

      88f0e7e294422a6ae1a6c6dc41f67a58269dc8b1

      SHA256

      db78916157c93b50f33524502e3269e04f4720147f7662f6703dd52df33183f0

      SHA512

      76413950465c656a607f29dfeadaa92f97acaa157a675a4bd4758fa8b541378cc753a28431c1f9b72bc5a3f5764559b729a4cd0f2ae840cfc6654a2c2e2db5ef

    • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

      Filesize

      1.6MB

      MD5

      89b17b4791aae043a0515c3a56b50fe2

      SHA1

      482cc41075343b84aa22ced0f05fb879d358da10

      SHA256

      11e30057e38beeefea6f3a9fa0ca1578d98e000fd947e590a0c4ac5bfec7667d

      SHA512

      ad4d4f425cbfdd1f29e691c7f67eb5c6063a663dbe1aae458e85fef24cf88aee709fdba8366b99ceaa049abb0fd707e09417ec07269abfcf4b38805cd1d53c4c

    • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

      Filesize

      1.2MB

      MD5

      c168421978e140fc1138161c5647b831

      SHA1

      580924ffe66fe60646bb5e9f8aff10beff8c483f

      SHA256

      02f083c36b47fb8a497ae2d09aabc567d4f9b569d2a00a5eaf7fdecd090fcb4b

      SHA512

      045e97854b94130395fc0f371e782dd18423f62c3e88c38a9c45d6769441b0a6cd83d48a5fbf13bce6624997eb4d319cbe1070a6a512173c02f7b0f8eaa5d02f

    • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

      Filesize

      1.2MB

      MD5

      f9d2715b440cbbda15834e00492d064b

      SHA1

      21b4e7d370f32c549e53d1a8442c63a5dcce9c81

      SHA256

      823abc93afadf808963789e4009c6bf1719cdf924ca08f871d916166f50084d5

      SHA512

      6d54fe48f0d0f4ee57f9c50304e581bdf13c029b520cb60481dc9a5383210b8a1237485c26722c15248402f8f660c5aa39e0d93d3c59d022857d06dd9977e2fd

    • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

      Filesize

      1.2MB

      MD5

      e3b93269599b3c3541c6e71bf1678e86

      SHA1

      b9f02cdd93dcca5841313afb84c86a69d89fc38b

      SHA256

      c8da59763a1711a82bcc2f7e49e5dbe73f823ebb4b0abd27d3f1284cf1f33d60

      SHA512

      9bec5548c3a7adda8099354c0822e2f2dde8fdaeaf18a380d0bbe65cda2d44b6f8f48e318ff45ecc42f2ce2af56c5bee0fd74c4366a3e56c4ef845f28b074406

    • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

      Filesize

      1.2MB

      MD5

      b4e7a32024c9e296055be4ed1b522be4

      SHA1

      3d4c04c53abc8138502274c61b0fefbb2d0ed5e2

      SHA256

      993dcf3dbd86c1389a26b425e3163c7d409f6d3aa08a2f88fbb6971f2d8ebb54

      SHA512

      67e78f051a233dd8f9558400aa1491c2311a3db6c6f33d35b53e734a83006984604aba2895d96b8b370b521883c9feebc1e87056f0efb566d7a3cec8b753695a

    • C:\Program Files\Java\jdk-1.8\bin\jar.exe

      Filesize

      1.2MB

      MD5

      860c81c4c7f0659474e6c9eb1311511c

      SHA1

      097ef4f237df49446b7540ac6c6e5e36377b4fcc

      SHA256

      c1ab36496b722cfcded1e2580541a489df593274ba2eb52308feccc96a728123

      SHA512

      bda65ab468976bfd73763c82d7ab1c5c8b88716671b989acae154c391c869a9df78f81189a72cef37b6f7dcaf9447bc4c3689c02a19fc5042862cc0d61336438

    • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

      Filesize

      1.2MB

      MD5

      2c4a472cbc6d4d8fd679349472323c76

      SHA1

      45d1000e95d8e1e38cada26049cbd2519755450a

      SHA256

      0bd3225b9f2f60e5e5434d7afe065c700a6b18ac0c4d6db17aef7634551d29fa

      SHA512

      535ae07d7a76112359e23eff5b184566ddca87ca50a5a8c01166aa60629ac3bc6d74d89a25f985cb9fee14100a8816e2ddedef3b9ba7e0349fe9afe368308c0c

    • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

      Filesize

      1.2MB

      MD5

      cc90486caec337ee76d49289c014da18

      SHA1

      471f0ca415e9e8cefdaeb4773e3e27cc97363a02

      SHA256

      b2694e78a560fad6a8afb70ab4fa80148c238e7fac9c98563c370e80449ffc7f

      SHA512

      2721d3f87c2e8320361f0f66c8ae723f9de124263ffebd417be1067a43ba6c3f0f56c047ea7eb42c5355ccbbb98558eac4291afb48c12ecbc241ab3112c302f6

    • C:\Program Files\Java\jdk-1.8\bin\java.exe

      Filesize

      1.4MB

      MD5

      60ac776c5c5eba6be4b8ff436aea59d9

      SHA1

      d85702ed8bd3c79218d593b799301e7f6c94b7c3

      SHA256

      662ffca72d1934660bb6e721c19ce1ca0740e8d8e344c25aca3f721d54a54adc

      SHA512

      7d7d7591a9fb014ed42ddbc3f3919f3cb3b29cf7f778cc5cf8dbe2391d3175823c0da22d8c171da6de6ee541690e03c2a97ec4c72e300e2c407e00b1f6daa462

    • C:\Program Files\Java\jdk-1.8\bin\javac.exe

      Filesize

      1.2MB

      MD5

      0b2a87a69fd81752b1fb98452e1abe12

      SHA1

      6305e09a3b6790e2c02b859aa17ccb2efff529e7

      SHA256

      acb206044e5bd66d6ce622b6def67a404a8ccafee0a3229643fb16f81ed8c4c9

      SHA512

      2173bd1c9415c403550225c583abf2bfa56a2e132b249fddef364dddf73126a85ce9bd64f9d90f489b1a8d876b7cc21f59f09bdba4277fe336dea9921ac12bac

    • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

      Filesize

      1.2MB

      MD5

      f4fc285c1049faa671d408d4c470ade3

      SHA1

      42e71e036d56caf3f66d6cd16c27954909ee2874

      SHA256

      4bdddadedfb0f72d18d0bff52213247efc2f6558745e4b4f2cbb68872a791d05

      SHA512

      8c4efd1125ff2f59a59cf9bf8571a4798f7cc51995bbe63a7155b337fab0f172f1fb7cb1c12352d353a28a194390e21b98197b99671c5a3492150094d2851fba

    • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

      Filesize

      1.3MB

      MD5

      759a918bb4c4a7f5882e294ce5509f55

      SHA1

      adc8c5eb3a7f81f9394d8bbc1fd74a99c13e1251

      SHA256

      264e838ae499d5811982d579bac48c79cd7c023cc237d6270f70b6fed5df572d

      SHA512

      a3a4648e70e82ead6dae47ee635216e166d768fff97eccf99219f119a506018f40c2c47b2db8c9f10f06151d82ab01bb2c5fac78f3a2677911155de965ace903

    • C:\Program Files\Java\jdk-1.8\bin\javah.exe

      Filesize

      1.2MB

      MD5

      d5de6e4aed86866aabe7e1e2e8edeea3

      SHA1

      1aef1fd6d45c6dcc9fcb2c633aa11ec6a5c22688

      SHA256

      2b3fd06832381507cb8d1fdbd95e1cf515bac5530cbc47edfc19f02038338cb2

      SHA512

      4f5af8533d0262346e59bb1fdc92d8646cab187a40807477997afaed8f17b4afe2a9f5a57362ec65340f92128f3e7be30e6336d15191d629235a8f94f78fefa8

    • C:\Program Files\Java\jdk-1.8\bin\javap.exe

      Filesize

      1.2MB

      MD5

      12028be63dee4fb7e3ba923f1f7712a2

      SHA1

      1e5a47974df17b70801b70a3933f8960a610b521

      SHA256

      bb6930e941e0dfe919d6809ad0ea207e53093dbc49333d454981abe671255241

      SHA512

      061705e63b7680efd7bdb4170db5206331c973be78fc5bfb1d5ac82f373843239f23a979963f2491169d7201e6f77005d31284d257c796957f17cd7cd6a79740

    • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

      Filesize

      1.3MB

      MD5

      5d2af3ea0d6e2f20edb4bd84bccba1ee

      SHA1

      e899bc0e98f3499924a5ea0eb1fce76c997a228b

      SHA256

      ca863fbfe6a9febd16b2360c93495523e967617c9a806d845dfbfa4228eb7b08

      SHA512

      91914ae40c47e265596d042d3849ce96e81cf0ed21638f5ff5185c000ffe165cea46b9c4c936b13e571fcb9f859b1758c0db00ad1127fd40734c901e1c7c3a67

    • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

      Filesize

      1.4MB

      MD5

      ca04d6dcb4acf8705cbbb6af3c26d209

      SHA1

      695f3f85d0d67499e03cb8d105aa911359438f3b

      SHA256

      a471551fe03368720017d7bb2816c3ffef1b8f16d8e6c6aadd4dfe8545a50869

      SHA512

      fe1bb72d6495f0da27596fc8696d849ff627447af54f2bdc0484f015b751fbd734add13ba89ca623641be3f7022e21b636202a9eeb9a54781cc77ef324640f13

    • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

      Filesize

      1.6MB

      MD5

      aae37069021a31044f7490688d75d434

      SHA1

      d8cffbcb2417d558dd67d7c250e40a8264e863fc

      SHA256

      21d2b9d706c7afd7dc6489562a51fe32179a6f5fa21fa5c7f7d3d22dd2822b0d

      SHA512

      b989526e9ce16e5a43886a244960194d5c97e6b25eb099a5752d3394240348e2741cf4ecf90417b05e7ed2180c9a99809e8f40d390874d2dd2c71a69f77c857d

    • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

      Filesize

      1.2MB

      MD5

      f0b7c65d2a8692672269ff7ff49344e1

      SHA1

      4d4fbe4b27c1e2a491aaa671a63c5a2234fcad97

      SHA256

      1ff23024a2c1cf9a24caa1ce763c73ad036d2c3982239834bc3e34c303a91375

      SHA512

      64992eab79bf89eae3fde6b2167d5dddef4799cca3b26ed9de16c1b6495b04321465e2e683e5c41d6fa50e3e51a70da576adb25cab240893bfbe221ab02885a1

    • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

      Filesize

      1.2MB

      MD5

      53406df2854b9aebaf4176f4c410917e

      SHA1

      f4427a4262857934ba8a9ddd38198361bae3927e

      SHA256

      0e9e44136c271c14e5b01afdd97e99d33ca226e4ad3eb205d7be8fa3397249f4

      SHA512

      0e7fb12acae1b46a22215b04ed064aaec3210ef3dee1605de8916a90f0ec5bb50b84413a2e260be5056e89a90cf7bc67587329f0a16c1475be27a0902fb5b934

    • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

      Filesize

      1.2MB

      MD5

      3d2eb2c50b4f5bec863610d447b85491

      SHA1

      36ee90957982aceb63c62dec390b3910e1a0a0c3

      SHA256

      3644a43ee028cc5fb165d611c3a622d5bfe98963e2ce6ee36b627384293ec5f0

      SHA512

      6029fca90624ab67290bd6becfaec7368e76ebd4783b6b9ce3baa0c175ae8514bd9df337185d915e29f99191f1a539ff1d86d759bb6a9f1a19ab7d3cc5e6723a

    • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

      Filesize

      1.2MB

      MD5

      34698f4d34bfaed3d35ce9815f023b52

      SHA1

      96477cf1c16caeeff2fc1482908a3a310cb87c48

      SHA256

      21977cb14c5bd55ebc59b70ae7ffa6dbb3f764e6042aed5171bcfffd720294ea

      SHA512

      9cda1aef39bceb43779e31deac0ef021a6744046617dbb45e4c0cb79672d13bc9a6558b48d41ffbc1e88591e66078b608db02742831480b7d1050910eb4eed68

    • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

      Filesize

      1.2MB

      MD5

      510c3ca915fbbf124f8207f5c7d27085

      SHA1

      cf32aa29c74a447cf98274f48325754ab91857bf

      SHA256

      199208be2cffb8af01aa2dc37392bfd51e8fec46e4d94505c38b8dd8f40d664d

      SHA512

      854760c004a18f6fdba5b3a2b49a34148126ad78331657c139d58cca7588c5ed821ff2bddc946fcd915086b00a34855d6e9f5de8bf0bdaea82c734eedccf1974

    • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

      Filesize

      1.2MB

      MD5

      8ff646a882fe0bfc66c02e3ad4d182b1

      SHA1

      abf3fe5c2126153a99cdcdcd5aec08381975c752

      SHA256

      a70d56f4da3dab439e4380d7d93aff5e5a6c8792b9502ec38a4f7ab88c18700d

      SHA512

      174bead95e84c8ccc3ac7f69605b82a4e6966ffdbf319842164a1a37ee5eb5db9c554d7197cf9c89a88a0e8738883ec49e155814e8f7792d89bcf51a0d510ea2

    • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

      Filesize

      1.2MB

      MD5

      82d66c98679c97b28ef1e167b3b08bfb

      SHA1

      be25f12143b727397d8f7832a93f7e06f106e14f

      SHA256

      9a195ad9ad8592edf426b60a124de95c57d143c7dc3e25713943005a91dd12d4

      SHA512

      de0b309f09535f683a39af39c1a15bdddcca5009f3550339489f0e63c60dfdbe6146ee3b768dcba80a630f41e197e1d4aa7c82e3d66ba159f07e9e5e40c32000

    • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

      Filesize

      1.2MB

      MD5

      74c03f16b1e5b296aa0e24df96a1ba6b

      SHA1

      0a0fcdfee2ca9a74460e7cfcab42a034613fb841

      SHA256

      90246d82d2728bc340f9c44ab39ab69bbcd0bdb02a43b7b019c04d2f3c80e562

      SHA512

      49da2043e19787e0afc0cf8c2095d4846ef9d945451e0e3c6e1ae0f90d37fcc6e4ceed353d256db141cb6594932ba248e393a698125619ff082096c89668b30e

    • C:\Program Files\Java\jdk-1.8\bin\jps.exe

      Filesize

      1.2MB

      MD5

      d130c2cf2ddb5c6dc682e33711f8f798

      SHA1

      71f36eee79c79e1e46e7b9971e799d86307c7704

      SHA256

      feb758d9fd26e0c189680355899041e7e4ca7f9c86726e3eddebb0cf6669bd7a

      SHA512

      d06eee5f7ef2c51598a11b710719a443b820a82ea3c972db36e75b88e148bba90547ebbce316fe0a31f07cf6302c3a7e9b2ec1c8844b427cebc8c89f0a1e1ce3

    • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

      Filesize

      1.2MB

      MD5

      d1a4c0316f683d44ef1fd86c394cf717

      SHA1

      03c6e1e2a28366ab7079f96fb5553626a1b82cae

      SHA256

      7fc8d972e197672f36c1527d74497874f454113074810e378a0fb6c92efb36ec

      SHA512

      c6ffe8d3da589487feda0e827491988f51a0b72d3843b90ec2ac85d8c428ee6107fded9443820b7fe02ed63ec001615de730f130178f508e5d31e7f4271198ce

    • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

      Filesize

      1.2MB

      MD5

      82185a03b6ff193d99cdb180ec9ba8b2

      SHA1

      9ac7141c6e3685b3b8cc9e40e4521b0b1c738ed4

      SHA256

      e0fb82414fb146f4270b47b8b34b6e24cb3ad5a3ede753cfd7ddab2a1067a65a

      SHA512

      b0cea28279cd2d5e4a811b2f61494ad0b5369ad6e24301d86767f2e5cf33522454f19fcfe10a0576b436e346343bc9d56b30d1c8188673f66d972220b41fed8e

    • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

      Filesize

      1.2MB

      MD5

      3cebc5d8f7802296f32faba131bf3fb1

      SHA1

      d10940816213d012bef9146fa452cee4243ab19b

      SHA256

      6e0d5d7a198cc9d38938f559579b925a5d4987a4307af4e4720e63114c2158e4

      SHA512

      ee6b4ccd7b0df03574463e4be35484abe24a6c21e2f3e11392ffb1ce846a1c86b043813845cc2ee5c89cad5134ceaa2ef61fe758f6d2c093424df0cd029a02ac

    • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

      Filesize

      1.2MB

      MD5

      f552369902cb7922c1df778072b8bd9a

      SHA1

      497ab0280ab86508f43c0beb212d16d5b7d827a8

      SHA256

      cb8ee83423069c4a03588f45c9701e2897686718fb73c4ccc17ad4c4d27a9f93

      SHA512

      7c00e0a67d45220d7ee83533015cb07051b923fb51233f38aecf84b1f583d26c79ec4c992be7e757ee0e422bc6ac1dda392747db1be785b90b6b7de49667de5a

    • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

      Filesize

      1.2MB

      MD5

      98fd129a429b3dd048858eb33174f881

      SHA1

      0b7248b505a994f19f04c4a002d5c14554f9ea1b

      SHA256

      ab3bfe305a2a34b52ac4c7b732b9cfedaa1b64194f719afcf160c04261197222

      SHA512

      0ac7fd68d22b9076d8db0b98d5a1f2cdc51330e8320252cbc7b5b0fb4ff105f34302c36694cb857ebe4903a3f51d94ab58241a33099836575f9a7d29edeee45c

    • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

      Filesize

      1.2MB

      MD5

      960fcfc867558b10e2dc130e1be082ce

      SHA1

      f91dace17c94abb1184b73b14b392fb1ad2992af

      SHA256

      6ad9d9b701ba8d3150ddce3620e37356fe68002172120b643f9df6e31629a20e

      SHA512

      3c57e7ad837fa5fdc246ebde7f237c148712b773f61938768685666b356084bf7647364e486c8f7e2d87c1be2dd12f163931e470f5372064519d04a378d79e46

    • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

      Filesize

      1.2MB

      MD5

      af57a8e8322346e7475cd227aa834bc1

      SHA1

      d3ce43e760dc467125c982add393c582969d7f57

      SHA256

      bef590c5566931df8a02eaef8ff0a0ae08836aa9a4738c31d290fe12afb1ee64

      SHA512

      7d147ebb9761261573856b54c0fa06babf3184874d69e7a8016471a3e2bb1be4492237ac97ff227defe0bbc33a0af4cb8e3a6887bd81fbe36dda92f9adfd527f

    • C:\Program Files\Java\jdk-1.8\bin\klist.exe

      Filesize

      1.2MB

      MD5

      8e272e2ffa63c7a84a905bce9e7690d3

      SHA1

      41997f3261aecdc0ed63b0708d712fa98c8051fb

      SHA256

      ab6800de01586fa2d42e0646855b61e505c18e3cbcb69d5c2fe09a5bad84db08

      SHA512

      e38a01836df63878a8fb4c7702b9e86cca00d1f95195400b0675d61a942e6df2ec0e79bf26376faffe764597b7d4d4f137ffae8ebb273633096f223e45386fd1

    • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

      Filesize

      1.2MB

      MD5

      a86939556271b49bbfdbb63df6bd08ff

      SHA1

      55e8308349315df8d97b63351e94f374662208d8

      SHA256

      03b00b20dea9f016feaf44a17ce8307685390c5f15344eea750d8b0ff06b7ce7

      SHA512

      ecdca7ce8b65e7099ec119164a533e937cce7f74c411c49b96c2e60e0af9ba493bdc5c7cdf0ebcef958f1d535cbfcdae860177ef33f04b313ce8839a0d29b0b3

    • C:\Program Files\dotnet\dotnet.exe

      Filesize

      1.3MB

      MD5

      84f7c0cf3bf431db871ea2b4e2e6b49e

      SHA1

      e3ae75692805e63611bcb70ad4501b724b44daa5

      SHA256

      e3ddd5dfb03a5bd54412bc916d22ba0374222329583f2988180a64e7be14ed23

      SHA512

      6fbe48ba65606ac324e2bc5d1adf5db6e14dd7c184cdc94fe57bac413181e52a6a617fa63ca00cac60c7d112e0e299ce5b6baba1071286a9419860a3b8e0ec2a

    • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

      Filesize

      1.3MB

      MD5

      f76dd7985a142ff2887b93b2bd18e8d9

      SHA1

      8d1d991727971061432f55a4bd6b2656ff7f22af

      SHA256

      6415a15408b74f0b7bdaf4183fdd81786617c4b7ea3145960e1340a2ba032b98

      SHA512

      0c5284abe1a59fbdd7a93777206091f4adec1c2a02a355d1e2b422fcfceb30183a290e20d4961979c7f9aec18a5585d2fa8c025538310cbd0963685558f65c7d

    • C:\Windows\System32\FXSSVC.exe

      Filesize

      1.2MB

      MD5

      78c4e53f865af0ad51a706a3c1dca951

      SHA1

      c8b38f041c41e0f73fcfbb51f52a85121deaba31

      SHA256

      3bba0ecf0ffa805b4b4937e7b3f1bb3de1ec1e1b25dce86011a487e4beaa3aac

      SHA512

      7f7980c0cc8dfd6baf2b89ad08a1df155e7ac62cab827bf2057c665fb90cff1ac869c66ae26948030135b79ae861d926bb80eec9a785ba9cc24279cb4591659e

    • C:\Windows\System32\alg.exe

      Filesize

      1.3MB

      MD5

      8f4b3a2c5068e2804ef3f1af5bc00dc2

      SHA1

      68740021f311c8d8483a3f9a9a9a50e815d928b1

      SHA256

      180614fb311e12a1ceadbb33863a64793c0a1ecd094625610c1b50e7dfa740ba

      SHA512

      b70be6994bbce725aa49db4db4640a7cd18ee64a66350ba74fd54239068f20c4d16585e0d29a1e54416be932f710824bec720baec69e8a99cb78674088f0ef32

    • C:\Windows\System32\msdtc.exe

      Filesize

      1.3MB

      MD5

      aeb55d5098e3fb1abad236653ebcf642

      SHA1

      5eae162019632c8961a67376836717e63f6cf35a

      SHA256

      9906c7a32e2183a03e3fb587e18e1427da8d12c7b2ceb1de4c0f9c7a741397c8

      SHA512

      ea6f205b5cc04db328a3930404478192611fd922da11de63288806b1ba4156647d17bb3dd5d427045abb497c8c7719708d35ce3184ff3ad1006a05dd09df0ce4

    • C:\Windows\system32\AppVClient.exe

      Filesize

      1.3MB

      MD5

      76fc5cb434f996a7a38701e3c46ac667

      SHA1

      de9369e8e7cbbbe10fe996f8a432398ee5ed8123

      SHA256

      66264746dfee7b185f4363e5b62a50eb400ccd31c1ceacd906ccd7ea14d6ca02

      SHA512

      639b5c577b2d40a10768c3916547fb2522ae8fac83c81250a820e9241f93812ac6eb104fee61380eda6d4e9beef086f10058e25aa6c46127f9b13c1a039bf752

    • C:\Windows\system32\msiexec.exe

      Filesize

      1.2MB

      MD5

      bdb4ef98ba5befe7c518400069cb7f1c

      SHA1

      2ed757d99c96f7b7214968f15ee048fa8c743a35

      SHA256

      366c03fe01c20d5401fc7852d7a88b98bdcb5fd6e0c16677c352717242ed0bbf

      SHA512

      39c831bd1debad5581c3a6df43479538138d60b9af24e9f955beaa80acb7b06dd46916ca2b975bf416b7c64c1611c3f91ba81aca1e5b43eeca710590f8b360bc

    • C:\Windows\tasksche.exe

      Filesize

      3.4MB

      MD5

      72a0273e5bdad2089ab90020265fcbce

      SHA1

      4a64856c9b86cc9f74fc6e74524d3cb09c3668a4

      SHA256

      45dc98a814d1bfd4ba7790b607da53678df7c99e3e1747f7ad4f56899e3805e4

      SHA512

      e02a324565dee584ba64e47936c5ab6a70d0c00e69e9767bf82d8c8195771a8270699f72ad0d64a490d22b0be32b54ce04c3df973baa8e8b65434781e848eb02

    • memory/684-55-0x0000000000C90000-0x0000000000CF0000-memory.dmp

      Filesize

      384KB

    • memory/684-49-0x0000000000C90000-0x0000000000CF0000-memory.dmp

      Filesize

      384KB

    • memory/684-57-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/684-287-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/876-77-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/876-106-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/876-71-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/876-289-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/1644-59-0x0000000000D80000-0x0000000000DE0000-memory.dmp

      Filesize

      384KB

    • memory/1644-45-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/1644-37-0x0000000000D80000-0x0000000000DE0000-memory.dmp

      Filesize

      384KB

    • memory/1644-46-0x0000000000D80000-0x0000000000DE0000-memory.dmp

      Filesize

      384KB

    • memory/1644-61-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/3092-226-0x0000000140000000-0x00000001401E8000-memory.dmp

      Filesize

      1.9MB

    • memory/3092-34-0x0000000140000000-0x00000001401E8000-memory.dmp

      Filesize

      1.9MB

    • memory/3092-32-0x0000000000690000-0x00000000006F0000-memory.dmp

      Filesize

      384KB

    • memory/3092-26-0x0000000000690000-0x00000000006F0000-memory.dmp

      Filesize

      384KB

    • memory/3508-87-0x0000000000C00000-0x0000000000C60000-memory.dmp

      Filesize

      384KB

    • memory/3508-93-0x0000000140000000-0x000000014020E000-memory.dmp

      Filesize

      2.1MB

    • memory/3508-81-0x0000000000C00000-0x0000000000C60000-memory.dmp

      Filesize

      384KB

    • memory/4368-288-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/4368-62-0x0000000000D20000-0x0000000000D87000-memory.dmp

      Filesize

      412KB

    • memory/4368-69-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/4368-67-0x0000000000D20000-0x0000000000D87000-memory.dmp

      Filesize

      412KB

    • memory/4376-107-0x0000000140000000-0x00000001401F8000-memory.dmp

      Filesize

      2.0MB

    • memory/4672-0-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/4672-104-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/4672-117-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/4672-1-0x00000000010A0000-0x0000000001107000-memory.dmp

      Filesize

      412KB

    • memory/4672-8-0x00000000010A0000-0x0000000001107000-memory.dmp

      Filesize

      412KB

    • memory/4700-109-0x0000000140000000-0x00000001401E9000-memory.dmp

      Filesize

      1.9MB

    • memory/4700-20-0x0000000140000000-0x00000001401E9000-memory.dmp

      Filesize

      1.9MB

    • memory/4700-21-0x00000000006C0000-0x0000000000720000-memory.dmp

      Filesize

      384KB

    • memory/4700-12-0x00000000006C0000-0x0000000000720000-memory.dmp

      Filesize

      384KB

    • memory/4940-290-0x0000000140000000-0x000000014020E000-memory.dmp

      Filesize

      2.1MB

    • memory/4940-128-0x0000000140000000-0x000000014020E000-memory.dmp

      Filesize

      2.1MB