Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-11-2024 18:22

General

  • Target

    2024-11-18_e7064a849c4e83c76b34a45dab791d17_wannacry.exe

  • Size

    4.1MB

  • MD5

    e7064a849c4e83c76b34a45dab791d17

  • SHA1

    5370455e6b0ad64c259ab565858528666a09684c

  • SHA256

    fb10c963f2cd2582e13dd6c44a7f1a9cc42733d0c8da04bbaa688881ead0b19f

  • SHA512

    ea0a8f38f9493818eafa19b48f5c611386467b526d4eb1b36bc4352e12f961f66ac78cae13982d02784dffc9dd6ae86ab82d37165559da04e69a2c3ca9181a25

  • SSDEEP

    98304:jDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H4bx4uR:jDqPe1Cxcxk3ZAEUadzR8yc4H42

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (3163) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-18_e7064a849c4e83c76b34a45dab791d17_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-18_e7064a849c4e83c76b34a45dab791d17_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:3880
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:4200
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:216
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4672
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:5084
    • C:\Users\Admin\AppData\Local\Temp\2024-11-18_e7064a849c4e83c76b34a45dab791d17_wannacry.exe
      C:\Users\Admin\AppData\Local\Temp\2024-11-18_e7064a849c4e83c76b34a45dab791d17_wannacry.exe -m security
      1⤵
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:2284
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2944
    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3388
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:1704
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1940

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

      Filesize

      2.1MB

      MD5

      6bcc1de82cb8ba658f69ab605693e1c3

      SHA1

      7b87a545e086723cadb4683472efdc03ca9ebb18

      SHA256

      9326d11c159327a5b5752b3861fc4106be6ea26a719dac94e09b265637482557

      SHA512

      2f018c7bd1bcd43d387543bd3fa0f015d9a88adfe524bf8ef2e67ad08505c6ad2a3725204b6ebbd98a9f01bc51a99f25d9f26fa7c4ed17195e659be7c9a29c4b

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      789KB

      MD5

      41de49279cea5f8b964a5f8583cefee3

      SHA1

      a1e52a09641cfd30f4bbbfca1499740f7fc16f67

      SHA256

      88cffc8f1f93b1927a0626f6286bb3000eb9655d3b9a592e44ac0d0c38124fb0

      SHA512

      438f340481697ab21aac4a58391979815d860e69fb84ff1a16871248dfc50571d9aef86d39adfadef51a9d118f05f8668ac14f1bd3d6bad66c4055e7a4737d9b

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      1.1MB

      MD5

      a5cfb7d98a33f0b02611f35bae03cc3b

      SHA1

      4432eb2820cca17672182fc132a80476e57a9359

      SHA256

      563e3fc56f0d7df96952479c7fbd8b47e265631588f38d9a226d63531c49b06a

      SHA512

      17fca89382803b5affbf5a0c55ecead4741a9639b9ea0245c9beba4264105710ad4b32a2ac544433cd668114d70d351c546c0c52783964aa82367c6d2419be2a

    • C:\Program Files\7-Zip\7zFM.exe

      Filesize

      1.5MB

      MD5

      ae9a11fb1deda07e6f825319c748f9de

      SHA1

      efa386e9996b040b88981170791d80097aa8b791

      SHA256

      da3f9c4e92b5e64041b2f80946dbf6e75fe6801ad2333cd5e395044ed975d873

      SHA512

      7591de46ac463cbc4ea873330e8984902150a7f1345a91e824bb461a0669f0b809efc95336de8d3521ba833768f83e576ce158df3de9bfae419894978fade9ef

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      1.2MB

      MD5

      eb6ba3c0d21cb9a3b8a0cd29566a1bba

      SHA1

      7a7c7bf9bb8ad5fb2ffcbe840d53bd1ab413a96e

      SHA256

      e86fc50eedf0f8bc50addd5af700902d44fbcbc08e946ed5faa98e26bf558576

      SHA512

      5d6fe21ba003975186b99b3f56500977d74d74403aa828518ab876ebb2a43da896efa910942f12d21f580e07cf274ab55beeed589e6e092dc93467caa1cff09b

    • C:\Program Files\7-Zip\Uninstall.exe

      Filesize

      582KB

      MD5

      3039fce6b86dd9051d138f3c75e3359d

      SHA1

      6834f634c52c440173a83ceec22bbe979440c9f9

      SHA256

      94038fd11be7789518486c9ef8f7a1b07cb645c794de38c49d744eccca1f5b56

      SHA512

      5a5530b2016d102a9a0c3f61eca39c0caa0af2a627ab4488e2a8a9d5a98fdb1acaa33632231a794fa2d77abc15b2e6e9f2b85f2eaa9b624d510361669d532aaf

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

      Filesize

      840KB

      MD5

      f5fdc16b9b161f6b234c12b87e5b0391

      SHA1

      9408ed6fe318e646a6fc1a435cf4eab79d59932f

      SHA256

      1f4193e500be8df89ee6f2941ef4244e8eda52a61f7d80e1e4014cef7eee430b

      SHA512

      07e0f39795cc1c5f633d70bd68f6311c6b50254666889e8ab86d12ebb73f4ed5080ae52cdd1dafaa0ce7caf4443f8539f7b8fd8783350b33922a623444321528

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

      Filesize

      4.6MB

      MD5

      946ef83cfd58b642f97a970396b6915a

      SHA1

      c83c85314b7f23752e327b2e2fc78409251b3e5e

      SHA256

      b344300884f7b1127e6d67004c05d1f8a02b1779b7c99868a28a5f57f9bda08c

      SHA512

      6829fdbf5ce7c59b2a46f15fe925d4ff6d28a436703fc4d7e3054396c58fcc585b41b3fe08f3f2ab39d47ed1d65c70fba3f7c77a0efe9fc92eef57f9130f7e1d

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

      Filesize

      910KB

      MD5

      b6ad68f82373f5462640ead6b44f544a

      SHA1

      39e650b7ba0c2b871c6967f88d52478410b8e552

      SHA256

      0a4738f399f09ce06fd1b634fc725eca1971ff7a3b60cec80450466de4bfc9d9

      SHA512

      ae4d7a15d0856dd8f32d1c63844dea977c35ea4e5539e1b04e18f021ebb1012dc88f3b64016deb5bcda6ec6b2bf1d0242d8574c06443f82583010ee4d3d166a3

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

      Filesize

      24.0MB

      MD5

      6a82aeffff498b9d3bb8482783767c1b

      SHA1

      9328616782df7aaabb2ad0d360b4c7f4da905f69

      SHA256

      4032b8f1e13bcc618b7b04433284d39a37e12c3ce74b941003a0342d6af43ece

      SHA512

      f4d27f38992fa6e30b3c44fe8bbd89acfb84cc49dcd8d272c1f7b0d459fd25a9befb0893eba2ea5a8732aadece07fa4ab01d05497ab839e29c14fa01bd441f5d

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

      Filesize

      2.7MB

      MD5

      076ceaf44a0b213151c3f8bafe5164c7

      SHA1

      cf61fcb1e802059bc07b4a02904a06d3ea27a9ce

      SHA256

      964344eb9be5dd5ff067c0b57abd3304bc8fb7cd7d519c65d1785a04af30bfb2

      SHA512

      c0d185aca77619d7fadfd4bcae99fc857dc249563404256e2b120f341a0a8c60be1ad12eb51aa1e04c3ccaed5450c75ad652076dd38649fdc58daa88abd8b1a6

    • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

      Filesize

      1.1MB

      MD5

      9c4a478a390d8fb34cd5e92e0e46bcd4

      SHA1

      4a7a80a070491d14b74369062777064ef967e2cf

      SHA256

      da24a61806d0995536376aa5e260fe498b0e77e0592295719dfe61a674121a2d

      SHA512

      531542708ff94d7ca989c305eefd3fb4908d737e323138a105b2d2d85dda85dfa4eeed4a16c6297ac19004338186e2db6d17ea28850906a5a9bbb754c03f8c7b

    • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      805KB

      MD5

      83dbe5dd8e1995eaaf9f17b19ded82f1

      SHA1

      5a3923795442d860430f2cae0cc926a76f3eb59d

      SHA256

      12965eca0298593d107f5654b93450d1ecc12ea26eb377e27269e3b9ef5a4a86

      SHA512

      56e4125dd2cbedeafdf507ba12217e0b11332057996b48c54e9a4ba7fca6c66c4c44df110b6857a20d2393d2faf60d11eb5c089ea47afcd8efcd1e05f479a01e

    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

      Filesize

      656KB

      MD5

      68835bea1cf51a734ccf37ee429460fa

      SHA1

      65d902f207952e51097d0a743a9be98667d1cbfa

      SHA256

      6615f8bd2ea94bb12e0b8a7ae28942bd8a9f32e71e5939b758dd061ba2c5c6ba

      SHA512

      f01e044bb5ab18dc3caaca08e833e1f140d2bd7a53da58fb5652b7ec9df971d512841e42074b37193bbae3eaa34f0aceb32864328c686de158d09ea68d7c3dfd

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

      Filesize

      4.6MB

      MD5

      f1e82615a5678242259b73768cdd1df1

      SHA1

      652be1f7063d98e6db7b6d2a1e1561595743f233

      SHA256

      1056a173bf4473ca3ed99ffac82c658d3809e57f347fa27d3ea7d60a581ee615

      SHA512

      5a74e84abb4888eae4bcf790d5aae1e630d1adf1e5ff68dccfbd95158abd78ede557a7561c2be90fe5a9a25b612b6aa3fac04c3f1d0eea625455e01bcf04d553

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

      Filesize

      4.6MB

      MD5

      df1291faa666e886ddb7366528c2a52f

      SHA1

      61a25af44983af1e68768583ad6b96607d3ba036

      SHA256

      a2be4edb270aad7c3a994dd2d908f02f5ea54d98fad61fdedd076ffaf7a3f6e4

      SHA512

      306028d8c56923c7b83b09b343d19287d845bd49e23000b90288a89baf108f1d0219b767ccc056f073cf37f8d7e652fcc5a76d81769f424656a7c3542daf622b

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

      Filesize

      1.9MB

      MD5

      067d8a17ed99222fc13c5a86b288f5ec

      SHA1

      cb3b1d8cb476d8a9d6fb753a037a67c5dc95572a

      SHA256

      ecd887669e1b9376e2e53431d98307caf84004511286e5cc499033363be2dd50

      SHA512

      843c519a9d230aebf3991c2bd44102674a20879a5cad7c5f13f6029e0bed0479425f28825dda7da3c4cda70d331aa777eacc50db9c6f1a01ed20caa0f1d85f3b

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

      Filesize

      2.1MB

      MD5

      e69e33a6ba0317c1e7ef88188b288629

      SHA1

      e1fe289968fde037b899ce044eee96c6e6a91c52

      SHA256

      ac3735e80a65b89c36d74929f9be346678ed42f6c1f68d9ae4c6c00aa33a1a78

      SHA512

      fbf3584b7de1c0d8396c29d41e090cab5f57c63e72a76ada45e49e6277d74e079aa707eb4e20661b7dcef530306f458e4aa6a2a73b66087053ede0264173a7e6

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

      Filesize

      1.8MB

      MD5

      49f32ff13570067e786c104c48bddfb7

      SHA1

      a4f1758af864f82aaf2ae1df3acc9eba2bf72136

      SHA256

      28d4128bb2ad0592382ca107aedd4d310ec7d6be444ae7524ff7cb936a275809

      SHA512

      183e5a9772701d797b3ef8898e495276cb2de5791081698e6694bc07b12bf20db26900c212c2e239793481365048d0513afe7e1f8b6e204bfdb0f127e240190c

    • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

      Filesize

      1.6MB

      MD5

      5e0e74b4ae55d0355af26f355f23d37c

      SHA1

      87bc4919ce1d3084d2bad06c1832d9bfcd1f4fb6

      SHA256

      4b8d594c76582cb307930e58861bae8893faacdddde47aa5c54121855fda2ee3

      SHA512

      d539df89c3a28bf011131a87bb50be409553f8a97f55bee6a568fa970fffe061c182cb260f5e799e55ec42b63a5225f9889e975489af7c92d35d27c6dab80181

    • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

      Filesize

      581KB

      MD5

      8ec0cb7732ef6bf30948cd1a568c145a

      SHA1

      a2e3547fb2b1f750cb056da250d66d2d35cb09ed

      SHA256

      1066a39c8bb799122e36731f7043fcb8e5fa09df17e54182092ae4ddc26574c7

      SHA512

      c648eca332e106be829bb57590397d5ff474f339b12fe48838b9e4a924eeb9cbee88b47fe590570a12a17c1d00ee22d615e980c10fd15915a9c2cf7f2636bb14

    • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

      Filesize

      581KB

      MD5

      39c102cb9b82df6132d793d3f6e9a7a1

      SHA1

      ddde7219ff5b5b87cfe0e6b88d24cc7933a5e265

      SHA256

      1f85deec99454db04b3a1de2e11121afb75b06db221c4aa48e9e49f648581e47

      SHA512

      b9cce4a13cef45ab309800d2df6c6c3233519a5ac3c9eb46f5ff4424255d16334ea3c82596453a1af46c3928187b3c9797c939019f6294c9ed1524fa4eeb10ef

    • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

      Filesize

      581KB

      MD5

      5232b791dc9ac704ae0d567d3b2ab134

      SHA1

      83565a884b184576106b7f6ccb6e830bbd59ccba

      SHA256

      afd5b2616163a09821f09fde44672bac01ab71d79850d6943932263f8a37917b

      SHA512

      383ae530b7e17b5c004a2818f8e6e9c42ea4d5cbade60e35a03f50f7867b61c2a2ca21afca440f77a9a67c9c37d8b50056c40f3eaabd2b9059746a28d1d62f23

    • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

      Filesize

      601KB

      MD5

      d76fdcc7f7a5fc1ef56f710ea7de3c31

      SHA1

      610c12205b2b5a5698c03bc5afcba5d2941c7602

      SHA256

      d6a1493dd8ebc46d0547441acd36c18168fa1ae082858e36daeda6913ad8946c

      SHA512

      2edd24fa73250364f664f3223cdbcadc14186c0af7dfffc197954a2750ce51c9184de1ba2275c82cbb180b36d7db8649f052015bfd3a7983a16bfec91d349b6f

    • C:\Program Files\Java\jdk-1.8\bin\jar.exe

      Filesize

      581KB

      MD5

      8c126674e201dc8558b5d5f7df8d5713

      SHA1

      89b69424342680d81876b1c2fb3d9115eeced9a2

      SHA256

      256f3635920faef27fd0201d07b8d5c129e3ef6170ed66698515ee46c1fdad4f

      SHA512

      ee9012e30c0e707f2dff0f710dc916cf2127aa448b1cd35e54ffb96829156c741a2b4564f3e0beed229df045b0fd0972151a123dc3723aa80d659f3155e208eb

    • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

      Filesize

      581KB

      MD5

      a6e7e72b75b91e46efdc96f05e72dd67

      SHA1

      18f9b53903669b680a9470666a017789ce72c885

      SHA256

      8d3a882cda6e2d842e74931db862c1e00be920b9b2052c6577ade43bb23992dd

      SHA512

      f8e8276d7246dc74246186acf32d2481d0097730ffcd84e703667c9b592338a1367fe5a7b9f1f1cd71bec4f1cc3626e6d144fd286f2cce53791af2be7ad867c9

    • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

      Filesize

      581KB

      MD5

      c319789a3fdb020f62bd6c484b0db071

      SHA1

      85fd91fbd8c93c8312ab0d5824ff59b4b755d04d

      SHA256

      16482244efc4b0a964b9a7006abeb5095c459c44409a9b8e895538bc3eb28f15

      SHA512

      8843f919d04f4b0df95b15d1ce4fbef1ae6c3abd09ab5d28022e140919ee29e926b290031246675ddfc9f5fc0b219a52cba8b7e94485b9ade7bded99e4c3f11b

    • C:\Program Files\Java\jdk-1.8\bin\java.exe

      Filesize

      841KB

      MD5

      ffd97884453a2b972360b7bb82ee35fb

      SHA1

      0cc4b7e1a29a898c5cdf1324568651e806023692

      SHA256

      00ed4d634aa58e1fe0ba6d102086e5382e1ccb8c6a38745a41fa64661b0707b6

      SHA512

      2e19c1ec4b987b9330869e6de5c52d5d05defdb70e59bbd47b926a5b78e38b675bd52ec1b15b708d86f53f350d8b3f99a76d93051c1d150e5d7236f17740764d

    • C:\Program Files\Java\jdk-1.8\bin\javac.exe

      Filesize

      581KB

      MD5

      507a5a8c58d1f3c3294e94ea4f770b8d

      SHA1

      bedcb1e38ae8ca5e59729ed39250c3490507a280

      SHA256

      a72097b7f242e8afc51e4ecf4f4552c3183e25444fc602bbf7af1f82ff5560c8

      SHA512

      0bdc930d42dca02e69801281187bed773a5ade603b510b272dc47a110c790aee4be986767b8bd919d90490ca56906a553cfdd30549edfc1bb1c14c611b857b13

    • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

      Filesize

      581KB

      MD5

      5ab1a2b7063709d2b3822e544d3a3d94

      SHA1

      b375311110cb1b707120f4d7b21275c2666064cc

      SHA256

      72a35a0011942d1f2f2c50d9c480a9f9b77ed2b6bbb4837fb859501bb73bfca5

      SHA512

      f54c0f1368fa6812ba81c72a1cb899be071165cf548bc7e16309ef8cfd3cf3f7a9d7a346d544cfecb2c362b064478e38249cabe7cca2d456962f03cd72c1d960

    • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

      Filesize

      717KB

      MD5

      eb168089eb6aabb1b8552922a2474cd0

      SHA1

      efb3233467d49ff6dfdd7b7bca710c1416dc8ccf

      SHA256

      58272c789f0966e2125230b30fe5d7096695d8ad54f40bc433322410e6f1aeca

      SHA512

      a46dbc1e0792fb656d609b078dfbb79c7889eb9e8ed5eae52ff4b3d0fdc25f136ce0418d530daf2851cef5fe08fcb3340393b0ae0b4eec462b10906e9183d450

    • C:\Program Files\Java\jdk-1.8\bin\javah.exe

      Filesize

      581KB

      MD5

      519d371a36cfffba6e99c27e63709cab

      SHA1

      40713e49ee5975fe9dc197fa212fad1170cffd6a

      SHA256

      43f8cf1390c66044bc442ba230901d17c652698470b20ce1d53f787caed86c43

      SHA512

      8a72f04ccb043a144592aeb7b07d7aa4e692a3833c586c5b1b720f35d7db08e8b0f61d0a52ff8234fa4d27cc777baeb1ab4fff1c27dfd6cc8d93e126efc96c93

    • C:\Program Files\Java\jdk-1.8\bin\javap.exe

      Filesize

      581KB

      MD5

      4ba63cacb00d80ecfbded7579744d37a

      SHA1

      5b73a5d6a071d93b16fd2602c398d610c879bcbf

      SHA256

      e3bbc15bb8998b1d344f92fb300f87faace5b65d5d819bc44706ef5c4dd94616

      SHA512

      2501e1ad8fe01bc389144da0afb705eefdbc18d864c8135e942de036a63832c277d1d54511e4be2e08f1af0e35ab670eb869deaa35bf6405d57f155bf70c394d

    • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

      Filesize

      717KB

      MD5

      583c96aeed8a72004d350d3c04772a22

      SHA1

      49b2072ac08794d840798c92687aecdb333502d8

      SHA256

      ee2d76c2145fe800f255485f549ba4f1e9950bb2df665d7f2475024573e0fef1

      SHA512

      74e0db0bcf19f4990f6ffcbe6a0bd8a6840bc0b937d135c6e718858ccdfb7f852a276b245b5e91b6689696215a4bf366b70f3480135c8c484b028684b2b35675

    • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

      Filesize

      841KB

      MD5

      c016d283bfcaf588213f7d828de632ed

      SHA1

      83970fb2e0176e7793fda871371c8ebba9161b56

      SHA256

      f198a24048bf7ac24732502b06ebbb2f859dbf58d91fcd3e4b43697db69ffc2c

      SHA512

      071ec3d639367e89c2979ac1fbcca723949a10c71753f022cdc3d3c863bc6ebd93627661fe7d4998b266d17f415d2d32e0dcc1b18d89ac4178318797a30dd145

    • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

      Filesize

      1020KB

      MD5

      e768a7277b8142525c282bf1c0609ada

      SHA1

      ee2ea412b15a89d068561eb76309930b1bd4d577

      SHA256

      7b844408c9283942dc1b50c58f0460c3bac807d362e3f7637bbbc557136fe181

      SHA512

      e751308308ad87bbdaf3cc4beb20698d1a436f5324027fc487dcb8783730ed39a2cb45c7def1725a680bf219e4543f780cdd4ffe42ee06bfd93677d5ab3cc11e

    • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

      Filesize

      581KB

      MD5

      557d16a116d4fd751dee1969076fa741

      SHA1

      e40fd749d6cc1aad8d14f38370544e64f64a5457

      SHA256

      9de53c908bbec7994b31204a18e2742b4224551bc00264ec12ae1baded3ecc87

      SHA512

      e3edb95ab3cfbbaf6f995ce419aa77654e89cb3779c364ed9500dab06d6fe813b6b67b1ce577327f11bc3ce88d626ce42eb47be0847ef71b0da3e5cfbffbf9a6

    • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

      Filesize

      581KB

      MD5

      0a3bd51284a2282fc4095e5c023c0b2b

      SHA1

      bb8c250e77cd9f589f008ae19ab8e5e5bfeb6698

      SHA256

      5c86b1e7166edad7d70b6d8a02dda7c33412d8e97f96c5abc86fec1c7db171dd

      SHA512

      f425baf2b2f59e14b538a24c123d9f33bd4e3f117540625a87ac6dd68f5cb150ee06083ca26841b853eddedb613cefd971aeaee7a1f47af856029934bdb2ae9f

    • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

      Filesize

      581KB

      MD5

      1e8bbbc635db550a3c9d72f0b0804669

      SHA1

      92de5fc3a5b562a19e464ba1f7872622800bf0df

      SHA256

      bfd5de8abb7f813b219e574c945342f394dc909c41166328d232b543956d0ae7

      SHA512

      a887603a9732c4cf21a196f43518640a5d5b6bc981b6002c253a6b3f7aa737d35633b3d9fe171d6688832f93d26014e00b18745c07c85132a5136761e3c5291d

    • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

      Filesize

      581KB

      MD5

      fdfda2a32cfbfc02a2da3c9450945561

      SHA1

      f2994b4c94b8ea363634a6938839c767978ee1d1

      SHA256

      a47ef309fa71c1e0687fca26c5f633025110c1593d7fb5c91ecc4b8dd21d16ef

      SHA512

      cd851f6e2aa67f1bf4ce7dd670f817119b2f3bb4b5895e1529f206a182f9a8942c33faa72371710305fabc1c97567c5849aee24d17d5697fe2c924907a24d374

    • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

      Filesize

      581KB

      MD5

      9d639f71434829943d802bd5b8314804

      SHA1

      59a02c55389ba2920d42dee2a1ff19c3159c8676

      SHA256

      a882fe7824e6b3ef762867be080ae727ea53dff041bd278d38ecb3b8387b1083

      SHA512

      939bdebb56de048c72ecc7e9d9a1f653aa688f00d258be917c34d310cc0fc2e768cc95b3c730acdc5a0b09d4ba88de8d884204d9ed6209652623b97544522a1f

    • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

      Filesize

      581KB

      MD5

      f96b7fb9bafa95de712e07fceabd3286

      SHA1

      e6b8873672ff7d643f53e9c6ee0252a254db5ca8

      SHA256

      c0970ed264c011103c2acd49ee52116250924bd3a9c502106ec6fc5c4ef1e7fe

      SHA512

      14d2880c7f1dfc69f9c28ee18cba9634dba71b81236f4b11822114a1d479d3c7d89544c686f3ee69270c7724d1ec1237f9b0c2f3b87e0b9f48bfbd46ef77c223

    • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

      Filesize

      581KB

      MD5

      89627d50ddb3b5d949cddf83e16d047e

      SHA1

      6d471c8bc0fbfaafd03ab47eda655812b50d6eb0

      SHA256

      d5c9ff1cf82f6b57e9913c7e418010cef0be63a589d8fa9e53f244c85c92d585

      SHA512

      bed022bd0d3f98929b6caf94dd21ddcadfc0e41b3ba4a87ee175168774d45f4706691977cbfaa01c951a13034e63602adbbdefe39a3a31fceefbf589d4f25827

    • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

      Filesize

      581KB

      MD5

      14cfe60d10ac18ef4eb3a32eab5d8824

      SHA1

      285b41ef9cc2074456d338bd2ddd62c570a6c398

      SHA256

      e294598ddceddeb14fd8fa5fa67a40fb59d955f16fcdb3753d498c4ff18cf758

      SHA512

      3e5e3f26c9725e92e8a6156ca23b4dd10de9f9575c9810497e36a06b00718710068906d4649356ec0e6adc60afdc07879f79f38404bdda68b28278a15a4918e2

    • C:\Program Files\Java\jdk-1.8\bin\jps.exe

      Filesize

      581KB

      MD5

      8946a675dd18fb0b7ab4b2ec2039684c

      SHA1

      4a6cf98f5042f8841a1acbea61026b8aa307ae0f

      SHA256

      3698d3851793ad2a081d595d15c5f564c9cd63ed79a8cf43a8fd3f67f0bc97c6

      SHA512

      bbd7528af180414fbdd220e04c94bf0d4c898b5ac7403de8f14eaab92fa1a0a536763556510b154b05367f96812d0340369721c10a7c2384c54b8166f0b3901a

    • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

      Filesize

      581KB

      MD5

      80bdc3b813b42e3b0e05b4e20cdfec66

      SHA1

      27ae106470e910535a9e5cea46a8622f76fbf9ad

      SHA256

      5f31e3905515a99b72e8db68b10ae8b953ca6ded94e50819597c8d9b8c00f875

      SHA512

      d029d8267925c236bb4841b803c97846fa5e1003a282bd54e41971fa28f8c08676a321e276e8ca02a08ca662a201f0fefa7dc00330c7868110c3030c2e864f41

    • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

      Filesize

      581KB

      MD5

      70a39ac5d064fd80b0a7b32af321ddc1

      SHA1

      52410ae57a2f003c1c5300efc3994049410a65c8

      SHA256

      5c60195fc925248ddc9709c23146fa8f6cc16512a92e95b3e85c22e355ce3024

      SHA512

      ef3e7e9126a7358fbac23871f35cff3a5191a9e605b2f8dead9b3d60d4f5cd39d8195bca21b6acaa773f3009ec2d692965f3a7619eea8d95af3a1efbf0124aaf

    • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

      Filesize

      581KB

      MD5

      d805e6d0d7aec287baebc349038a68e0

      SHA1

      2e72c3314a6618d3d349ec14c0c2d66f434dab63

      SHA256

      3d8aba52bc3b9353d2c183e47c07ba44cb9cc9789239e0cb9823065a196ea19b

      SHA512

      4faff45607f7b7f475ca8dcc45621c754d4b54c7eda9b72b4425842acbd45981c21e76ce3ced151f71a26705b086a4c303580e055c8144b7f9263ea27352eec3

    • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

      Filesize

      581KB

      MD5

      4c0e7169879f4ea528b61cfcbdd88989

      SHA1

      3a947149445bc1c5c31d0169b719dd471a8c5ab6

      SHA256

      72c5e377055376ccf48b159e6e15d557114ecfef1588bb085b1733c17c60e3a5

      SHA512

      0ff22bbdfaff517bf03dfc977f5b3987423ee40555bb62da6ea36581493301b970aabf12ee68fa5969490234e22df80fccadbf3849cb2cf83fe15f3023689cf3

    • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

      Filesize

      581KB

      MD5

      8320a6c6029f4b2be117caa0be6aa942

      SHA1

      dabe878634a75594994bf5e25c8fa7eaa49624e3

      SHA256

      93e3e3e5eec84583ccf7f8380e8da8881e08c41803fa65ddeeca90f1bec2549d

      SHA512

      96ad9d9c2a7cd87534e7e886639b25e01eac294260e817b55e6a70e58eef0e0efa68ecb5c0ac729de84d44fbbc3119db7e49b961c9719a3cc618a9c17c978590

    • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

      Filesize

      581KB

      MD5

      77cd9c69d577bb15d701bc5925ced25a

      SHA1

      75f92cea9543768eef43350e1bb11578a06393ec

      SHA256

      e884e63692a15d9421fbbf453d576f2fcccdceb2084be54ae9e9c359fdc85630

      SHA512

      caa94fd3e513ce493cd4f899f72506a92ebfa73b4b1c4a18d8a79f694e8893b479e793c3d2e7e5c02baa2779f616175618044e50d3ad14bb7196bd36b2abf8bc

    • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

      Filesize

      581KB

      MD5

      e553fd03bfb911bfcf4cf7b9bdd4aa1c

      SHA1

      1d373c37aeac3798eb66c0691ed2816e998e4518

      SHA256

      df558940912a38081b035aa62b926e5f98cba32aedae44178fd66308b93737ef

      SHA512

      a17983203d24d37bad75ac0100a28bffb80b8eea28a77b544991bd3fe8803694da0a372e85c52669ee7dd0dcbb86e804809ddc278c12600f13bff4d138eb46d9

    • C:\Program Files\Java\jdk-1.8\bin\klist.exe

      Filesize

      581KB

      MD5

      81621b54fdcdb7f8ef891418298bd677

      SHA1

      764f53602c293059a857a6d6ff92d9765dc57312

      SHA256

      c6871c2ce3b6e22f9e20c25e6d20eccd1d4b29f6e6f7b41b34904a7636deee15

      SHA512

      33f9e84482dbfc5be507ca00677be122f7e878faff5255a387deb189559f00b5518b183d9c93e375df6c05979ca78966541a36c81edce2a4dc297d0ee06fe041

    • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

      Filesize

      581KB

      MD5

      fbbb64711cfa0e117c5e7567de27e59a

      SHA1

      565946214d97ea7360d9e28d3e30257f8e0ad80f

      SHA256

      93264160141f0b34cb7485888cfea10fceb12ee4a49568eaa59f967734add85c

      SHA512

      13da21f1bdf198723b158086956af37a9d4f814a7a1caeaa63e64fb3a460a119cd8620bc859f76e401cb86d6ae8632f57f59f7f1856487a3e9fecf7c36915359

    • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

      Filesize

      581KB

      MD5

      2544e8e9c345236f2b5fab86e04a8257

      SHA1

      e5c73bd1ad9b38c511148170ad09ef7cb31e8506

      SHA256

      edd031f339e06a01005edbb6145061b540eb36ecce66fb091ecfbb3ea5bedc4b

      SHA512

      f5c4e9a86c58b5c586cbf45fa94e6b1dbd937e3c894979ae18852bf7a413fd3dd2cab6c4a95fa2d2afdc9367de0d9579bbf7dcc32d936e174db8c0a4453c3b10

    • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

      Filesize

      581KB

      MD5

      c6599ba389bd1b20c94315cc30c83c3e

      SHA1

      15d993a15d1ae5fd55d0a555449ed8245c66122b

      SHA256

      c231a9655f9df4768ebd13f2a4fd3cab5cacd8019212da00b98569b8a631f8e7

      SHA512

      6aa65ebc0dfba859fd2094134d213d46d15f43f63577207d0fbfb041f933c06df7122e8589609909b3fb77fd0ba28abcd4d09d4cba91078b7f76934d9a6cf3c4

    • C:\Program Files\dotnet\dotnet.exe

      Filesize

      701KB

      MD5

      aa952b9c32479d29e47e19abc75e78db

      SHA1

      8a8ca05dd5914ac199e4e828e5cd94d6a96f07c2

      SHA256

      e6512eaef57b74cbeba4dda6c0d354ca79738fb844c26f611a61344b79ff5092

      SHA512

      072b09023f7cd032802c0118c5c7369b342aa21809fb258774083c237979520e4e921c2ae4aa0dee75a3f2483b421833004c21bc311bed69e98f7c6edfebfc55

    • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

      Filesize

      659KB

      MD5

      95e7451b967bb60430802955b04dbcf4

      SHA1

      a05868b6d8c86ed74ca79534794b6bea384529d6

      SHA256

      4a4af31ff8f682fdcfa8f0f7cb305222c6e633782e10533d9ba988b34c20468d

      SHA512

      def8e61b931729fecfc748c442cfe8e633f991add51bd809a292be2a700cd90bb6649da50da0f1bd0fbf69d76e5e80fb265d2df6c3949b4557996c5eaaf9217f

    • C:\Windows\System32\FXSSVC.exe

      Filesize

      1.2MB

      MD5

      04211727b90a8af0b7edc42c54e9614a

      SHA1

      972444d4bccf9d3e82181bc2ddeaba759e1d262d

      SHA256

      d76d7578927d0e288e67c4d5fccb4dbe929b0eed89597c0527dc067e3c55adac

      SHA512

      90b9309de349032ec82e4630423a3fdfee137c5db7e03ac2ac0ca7d836218b8c450cd153ec7b8c661e1ef1776e082b75b51259444ee401fc612869f6de578aa1

    • C:\Windows\System32\alg.exe

      Filesize

      661KB

      MD5

      8cca9f60e1fef6ca595e5e6f45672b9f

      SHA1

      12587f4ec3d002f5126f5f07fa39c00615e2ccd3

      SHA256

      8595c8540763393cdbdab5e45a6e467f0ba1981b1ba0734e531d94b2d01ff57f

      SHA512

      324f4ea89ac93c6c3f69f7f39d156e401b713b3aeca5653a3265963e1a014cfd199d94df4875870a61ada86c9f630a8b4ecc89d7e4f2e22601821e3474275cec

    • C:\Windows\system32\AppVClient.exe

      Filesize

      1.3MB

      MD5

      222d16bd60303214d1253a516d835f9d

      SHA1

      fda606c144b6ded545559535a34b8753f4e2402d

      SHA256

      b2c384d156c125e9d919615e778f3f0f52ba950dbcf2518e5c2a8fe755eb7e4e

      SHA512

      b81d56b1656a010b4d74edfdad8126101c7e9184f92f9385227081c04dfb0f665e17d8a88eaeb3d163882b4262df02d4185db472f81738255747a90ee93bfce4

    • C:\Windows\tasksche.exe

      Filesize

      3.4MB

      MD5

      7f7ccaa16fb15eb1c7399d422f8363e8

      SHA1

      bd44d0ab543bf814d93b719c24e90d8dd7111234

      SHA256

      2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd

      SHA512

      83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7

    • memory/216-18-0x0000000000740000-0x00000000007A0000-memory.dmp

      Filesize

      384KB

    • memory/216-13-0x0000000000740000-0x00000000007A0000-memory.dmp

      Filesize

      384KB

    • memory/216-94-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/216-11-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/1704-86-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/1704-89-0x0000000001A40000-0x0000000001AA0000-memory.dmp

      Filesize

      384KB

    • memory/1704-78-0x0000000001A40000-0x0000000001AA0000-memory.dmp

      Filesize

      384KB

    • memory/1704-84-0x0000000001A40000-0x0000000001AA0000-memory.dmp

      Filesize

      384KB

    • memory/1704-91-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/1940-262-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/1940-93-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/1940-95-0x00000000007B0000-0x0000000000810000-memory.dmp

      Filesize

      384KB

    • memory/2284-42-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2284-34-0x0000000000C70000-0x0000000000CD7000-memory.dmp

      Filesize

      412KB

    • memory/2284-237-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2284-257-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2284-39-0x0000000000C70000-0x0000000000CD7000-memory.dmp

      Filesize

      412KB

    • memory/2284-41-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2944-52-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/2944-54-0x0000000000530000-0x0000000000590000-memory.dmp

      Filesize

      384KB

    • memory/2944-56-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/2944-44-0x0000000000530000-0x0000000000590000-memory.dmp

      Filesize

      384KB

    • memory/2944-50-0x0000000000530000-0x0000000000590000-memory.dmp

      Filesize

      384KB

    • memory/3388-59-0x0000000000C30000-0x0000000000C90000-memory.dmp

      Filesize

      384KB

    • memory/3388-261-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/3388-65-0x0000000000C30000-0x0000000000C90000-memory.dmp

      Filesize

      384KB

    • memory/3388-67-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/3880-0-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/3880-76-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/3880-6-0x0000000000D50000-0x0000000000DB7000-memory.dmp

      Filesize

      412KB

    • memory/3880-1-0x0000000000D50000-0x0000000000DB7000-memory.dmp

      Filesize

      412KB

    • memory/4672-24-0x0000000000580000-0x00000000005E0000-memory.dmp

      Filesize

      384KB

    • memory/4672-30-0x0000000000580000-0x00000000005E0000-memory.dmp

      Filesize

      384KB

    • memory/4672-32-0x0000000140000000-0x00000001400A9000-memory.dmp

      Filesize

      676KB

    • memory/4672-116-0x0000000140000000-0x00000001400A9000-memory.dmp

      Filesize

      676KB