Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-11-2024 12:00

General

  • Target

    2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe

  • Size

    5.0MB

  • MD5

    a682153626acdb4af25d9e8bb7603dfa

  • SHA1

    39d03991372e0657a54fb589f52d68cd1769c765

  • SHA256

    d7751d786e37e75082356edcb79f1b2d5c3927580cfed8cfee51ed64c368b517

  • SHA512

    79ea03c6e67474424499db62e9ba6b522c6c3b9c82f021dea9566c995ca1187f7867e1aeabb2e08cc53ef0860d324c75ee6908534fbf297e3cd2f8524f2abaa3

  • SSDEEP

    98304:I8qPoBhz1aRxcSUDk36SAEdhvxWa9P59Hni:I8qPe1Cxcxk3ZAEUadf

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (3237) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 11 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2368
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:4692
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2192
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2448
  • C:\Users\Admin\AppData\Local\Temp\2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe -m security
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1228
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4996
    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2160
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1352
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4256
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:700
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2660

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

      Filesize

      2.1MB

      MD5

      320d44d5366cf0a592f9cbd303c8a3da

      SHA1

      67d2052439976fd4c6fb515884551bbf6100a648

      SHA256

      3fb7ad83415da36773c3fbb0a077e716adbc3a2beccb9cb6198fe81c2dfe390a

      SHA512

      c7bab93164b4a7bfd186757a4bd38c0a554dea88f0587874aed746bcc66dce568b2c0155a5e30448f467a58cf9fdc29de4a7750c89570db0319f17cf445cf05e

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      789KB

      MD5

      e51ed40ef2c47b4bfa3c035b448e0c0a

      SHA1

      f08fc57da91869a70a2edbabc2d621562906279f

      SHA256

      015b39af1ea4d6cc045df00d92147166a43e1ad09bc13112d93d50f1cb22f8d2

      SHA512

      6c932fc6aeaf8c7384c0f78bec4af2a71e4917693d7257d2ffda0e2f8463652d657ba17ea2f6852ed66acfc8fb87b74707c8936f935d01104f4f1801819d0fbb

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      1.1MB

      MD5

      dd66ae9c87e9e5368f179c81c653f241

      SHA1

      e1bfef5a66ae136e48c88f87b3ba721fb4ed9d8e

      SHA256

      ffb1f0b836f32e87fb6eff97d9430f838e82f498bc3ae728b0166bb33383063c

      SHA512

      3f4587352fc2bcd9ec67b8cba64e17e8225dfbd252a9aa4c17b4f5715b43cabe14e288084f9a8a6e6deb0599068392bbac721f5da6e437abdf37c86615c66db7

    • C:\Program Files\7-Zip\7zFM.exe

      Filesize

      1.5MB

      MD5

      04169070cdc5e98a71872e4cff04c5ad

      SHA1

      0df5675f50de35775289b4b4c9060c5b3e630b73

      SHA256

      2f9dd9218a26a173955a896a2327846ff1987e8b00a39b356a12d3ad7b3d31c0

      SHA512

      38d9c2f65ab6000edceab4081abbf2f80c21d8aaa103962813481df348b97b525d75871fa139f66aab74ce82941b4c41b797d8afc98a0097af8675e5020b5aba

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      1.2MB

      MD5

      bb022023bdcad8ce0fd8e4e30083853f

      SHA1

      eb32138b0b0842a82cf90df7e9731ae81cd53fd7

      SHA256

      5b8d64ed2f90f6ed5d39850a7e2927a961d6cdb3b1e2360ba39ed03a5cf27899

      SHA512

      bd3357fe155ec52cc00de3a8b900c7f6023d8bbe4307581e0acd54392dddff24c375d30f30edd862a0bc31ab652ef4de5da49e77b6ad0689b091275e17309b11

    • C:\Program Files\7-Zip\Uninstall.exe

      Filesize

      582KB

      MD5

      feb294c89eb9b330abfa2ae6e8a7346d

      SHA1

      7eab277d641a547be114d9bcce8eed3da9fe89d8

      SHA256

      6186ddaf1fb091cda4e96c5be47c01e4692727d5c05e6382a12a20e3779dcdbc

      SHA512

      6533adc513097f8bfef96fe327c058273b71d53dc2e2a544b57879581bbc0ffa7eb99d95e07cab9ee766821f5ca91fc6392e6526af65e8b816d680b7ef02404f

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

      Filesize

      840KB

      MD5

      54dc88258589f4b6bad8ebf223ea8d84

      SHA1

      bd1f76b74a6587cc81e5be313a299af842e85569

      SHA256

      5fa9d8fcfbbd251343ec7e019230c1de084f665c1b0ad87ab00819754e400efa

      SHA512

      0a15971ff574dd687c4bbeb36c1a683de61cf1cd56dbc20c3bcec728e15107cac1f1393070592ae2bec87f0fc1b5841fd3e48c3c524daaa211f5497b6b088d00

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

      Filesize

      4.6MB

      MD5

      8ea342dac1b020dd69df4f7514d1481b

      SHA1

      b09156715bbb9eda1cb779c925cfa20acbd4da26

      SHA256

      24d099bbb4ddec1068c19c51f9cc265762e30ba1ec6b4838cbc9b3f20632e82d

      SHA512

      9a35a633c55e6f5bb050de4efc2b12362b80c87365d382010405b29ce7f7319c2def452c461e2b947f6d169e7b67fac4cb606d36112a4c8acb13a4e1a8198c96

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

      Filesize

      910KB

      MD5

      58552d7312608485d5a5ce94828a3ab6

      SHA1

      b2dcb8c0823391eba4a5f166f5466305aaa90ffd

      SHA256

      dd3d7f2293c72c22675ca2965b35a8a97085661ee26f6a9ba82f856447f394e1

      SHA512

      844377a1f450771e89213ff3f18b3e1d7ba3cf25cee902d8ec9350a5498ad060d2d1de4dadb06aea26101cd0ce040b20e828dd71c29cef19d5528bf1ea548054

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

      Filesize

      24.0MB

      MD5

      6e0d1fcced79fcb6c50151c39b7b463d

      SHA1

      a0a1dce8f98438b1831f87c8eaaf5d5e0a5a6387

      SHA256

      d1fbaf96fad86fd52136a57c399f9f4bab4393fa5743a8d02ae2e54e15c2cf3a

      SHA512

      dd3c40ba3c86a933c35f44a5175e8f3599ab01787aade6ede97bbcac2a91354d5f8bf036eade71ca1973276039aff072dd3fad605f1b76f105493172954f0293

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

      Filesize

      2.7MB

      MD5

      e33affd4a8af0ed120d2e1c5190f631f

      SHA1

      a024a3d894d20e1bd5099d1bb07826afa9b6a2cc

      SHA256

      41f1fecfd86e28a219a0e3d181c4b63933621636453e8484677f978f11dc4f9e

      SHA512

      71aa435478ce6992c8238446a821999bba18acfb067b838bc19aadb0800325a883543f146be7a3daac20645baf87758949e09f101790b3936ab37b45e8c6d802

    • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

      Filesize

      1.1MB

      MD5

      739bdaee84b76e8a3818f1c448b6de2d

      SHA1

      49a7ba84eee26e800487cbd8231997e6c766287c

      SHA256

      8996442d75d516c23cef09d505ae73dae514b86872dc4eadea60a75be7fa9db3

      SHA512

      5f73360303e1b4d95a9888237f291439322856b0e9c41de5d1e7732b68a79e14993573ddcb19488ea2f92db144644ae29da1caf888401acab35bb75972290739

    • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      805KB

      MD5

      e2fd88bc3b2782400589c49e948944ba

      SHA1

      9c438e8c9be37dc24a87f8eeeda683216d6b73df

      SHA256

      1152e845c821839bb1cb78149f8d2ef32ea4527b5948517af63dd1ca5eb7258b

      SHA512

      a20cacc9c3c3ad4e1947e9cde4aee696423227146f54590b32c172e8715dabfca52daafde1692da88ba3622fb57196964a3a5f293e525f304efbee65eed7e782

    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

      Filesize

      656KB

      MD5

      8bd9c91b15042dc52dfac87aab8940d9

      SHA1

      4444e721066cf3efc4e89c04b1f506feadcf1da6

      SHA256

      eafab907064a95a9a019cada74b3444ae69d8b12e93de2bae8c93eb7c0aa5418

      SHA512

      fec9bea303d360167f0991cdc6e9f8e04c4dafb100bd5239c1daa45885e244901b054f5b62bea7a001ce23acfd5bcaab05c960e53bec748ce761e566e679f64d

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

      Filesize

      4.6MB

      MD5

      ab613cddaaf2c87dfa33c37134c7f6ff

      SHA1

      e4588964d5a5c4a256058c9662a6b8d9613d6e6b

      SHA256

      5af59809f63cdf6dfabeb78270720c83c2d57e8c55ff47d2cb595d9a47c4abee

      SHA512

      7546a3ddcbaeee992781882363dbd49671d02ae88ac43a75eaab61e8f62a55a6cc5d5407d33f8e9af5e64c58d49e7fd9437a450cfd9ee3d2a58e448b74e3d1de

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

      Filesize

      4.6MB

      MD5

      9ac33e46a689212033bb92f792d12b67

      SHA1

      5ea0aeebcae976c10f0c02b7cbd8489497829e25

      SHA256

      40eba9bb7a1d2bdb78eb6f8f95fbcbf4b9e27166ac6ba18e87ffd697c3b9ee7b

      SHA512

      d0ca54ba0965b3cc157dc85647064039e7df6105f60732ab2f829da2aeabb80ad6f2253cfcd784df3cf10b5413e8fdf974a736270611cdea582b43027fd2cfa0

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

      Filesize

      1.9MB

      MD5

      9ce91af1b823f066f134a79435ed7208

      SHA1

      e73e94ddda79c278c2cf0e609b03c6eb8dd60920

      SHA256

      fb2da7273bd7d3c38e139f577da1d8bb62d5e550994ca96a8db619237dbc6e38

      SHA512

      b7e0a78a461e518d1c78e7c3f7ebe44be73b377a6d953b2e5ca87cc76a833e4cb3e3543e59c566b7232e3e4d189228399e203d67416d90870ae23602cc9ce8c1

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

      Filesize

      2.1MB

      MD5

      a6bd9f138976f3c9bd9feca37c5a94c7

      SHA1

      aaa73c48bfe0b751cbe81bf33419d03cbee9ed14

      SHA256

      f8fae813db92dd706225ca6507c6e0227b0dce765294b57cf3f3e9ee4465b633

      SHA512

      bac61e604099ef82df2a860c23469794552f098f18a3b609b77424b6080e1606420ad48a8bf287e2f4ac219bc511688819e46a93e41edf9da167ffca8432e2c7

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

      Filesize

      1.8MB

      MD5

      d6ddc4e7c83831da87580722b1912c12

      SHA1

      1015bd51c48d0574435b040698cee138c69e76ba

      SHA256

      1feedd8e1d5c25557b1bd8ac8139d17c01b6e25a249d167943ffae1bded356fd

      SHA512

      0c0044b78a224fb3a669a6d64f2bc2a794e3c18d6e92ccf08cb42593a47a05abdb6bd56d12902abfac91c96f3b31f7046b2338673f93ba6b99e8eba85896f45c

    • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

      Filesize

      1.6MB

      MD5

      3cf2a20b0c7fc67e22102c8fc0832d9d

      SHA1

      692f4471a3f1074eb2303209e2fd180f5073d76e

      SHA256

      1541184d3305e7a0b8db0036155621171a3e3b2158a2be09e1b47f97ed8a2536

      SHA512

      9257f0d9d44bec5a8fd69a4450a19354f775ae68acbfda63e018fbebd3e0305d652ad50c5c525ccd75e3f8b7a34a3388e63cf3fe9d8f8de85608118f9eedb212

    • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

      Filesize

      581KB

      MD5

      145e891f59074f41ad08a6625ad010e7

      SHA1

      03798c0f73d23fb3bf6ba5e7631fbe4d53941508

      SHA256

      8e1199ddb49a0956733d3fd221686b3dc53356c27756d28c4173bd1278d7191c

      SHA512

      d76f48773434555553676a21b405a41e65d0fdf8ccde09bf4647f0fe73194fdb4d8dd5a621b0eb81ec0bc78a8a2a8328c360849851f0e2aaa8c7caf414d9307c

    • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

      Filesize

      581KB

      MD5

      dc4cb237ace70e388ad57f9c4d152a0e

      SHA1

      10aab671ecbfbbc5bff9087edd9518e2824ab107

      SHA256

      46887fc9483ade9134bd28e145f9031b92972160213abb32dd6134b70035cac1

      SHA512

      3a14b54537b931305f47a16830fcc708e806f6849c7f7df45f9c71993e09dedb855aca7094b61433574547d4ca0eddd2411de2c6c2c55651a36c0da3973a4c10

    • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

      Filesize

      581KB

      MD5

      54a49bdbb20f037045804c6b0c203cbc

      SHA1

      7d14cf073b9f2d5f13336c43a91bd21fdf153895

      SHA256

      342f0a4d93ebd8bfd17f8d67a6881af0fd4893ee7f8dec2d1495ff6ebfcacefa

      SHA512

      edeab0ddb3409b0b4c37f52572019a3daec9e3a93cb781c4232b954550cfc11fe69af948e5551808694304cb26151568f49092053f64cd151921bc0aa53a9f2e

    • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

      Filesize

      601KB

      MD5

      9ed154eb047f4edaa32152c3b58963de

      SHA1

      1edc6f3cb8846c749dee7d2679b61e14222301c2

      SHA256

      6d5e3af82f9031b154818a1e10999fcf52cba8911f0456a9b9d0732022ff9584

      SHA512

      616c7e5a11f0a1c36d762940fba6878647a4d9630890bedf4c9368ab962155052e6a39e6ca3784281729cf5fec14bf4b2f5d0f770b01cba88accef6e7ffe4c60

    • C:\Program Files\Java\jdk-1.8\bin\jar.exe

      Filesize

      581KB

      MD5

      f1bfc6a6ace84c2e38a9e05ad402336d

      SHA1

      eb68252d2bb8accf251ed6ab5c54d0d357b7fbd9

      SHA256

      9ff6404573c06f2653b01837d307a485047a1b24f10bd512dfbba46026e913bd

      SHA512

      4be575d9e35c752ce816247730ca2ef4245544349e42a78d71de391206581cd1abf46c85396264b043af4d185357175caf70528f24b9e8c638b33d41239fa1af

    • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

      Filesize

      581KB

      MD5

      fe0e71c248afd0adce6de153d8a9f0bb

      SHA1

      8215f082618dc246fc7adb4c025b48f16d0be3c3

      SHA256

      f42931b9324ef13ff13177751e82f185b1f6c98d6a9cdeb6bdef09208df46b42

      SHA512

      7821bc195eed1db98bf5ef46660bb0cd04888697bcfe9eba9c15f8537f02fcb1f0bb66f3fce54b940eef26843fa8de66d0c815438a876fc0a487590c07335074

    • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

      Filesize

      581KB

      MD5

      1d33d1c143343a4bd475276dd553a733

      SHA1

      228e06997e40da0420c71a7339441b86d3a6f1c9

      SHA256

      15d889fae5334b1a9f296935cba4cce95ee371d1db1ad843f018c6a7e19f16bd

      SHA512

      04d8f4be99bae5fafd81f20c4eaf5345ad75bd6a389130045bc2c988019f7d3820d9be35075bba968d2fc54bc03c1c4f11574d92a89f46b2e8617468a44fefe7

    • C:\Program Files\Java\jdk-1.8\bin\java.exe

      Filesize

      841KB

      MD5

      bf356a0995ae24e06ff4f5a68fdb9b95

      SHA1

      3d49008ca7cb6cc8d803b8c6ccc4e6cc933d471b

      SHA256

      a97fbf545c871105f4ac8384a7a74bf1e035087881787df26d53f95695785043

      SHA512

      c439261a98ed281352aa1cff2366017ff053031993dcbcb9c2b108827ce2f23aa2f4bb581cc76070fbe8208de90e7b69eb9b15fad793e197f371cb348b9c685b

    • C:\Program Files\Java\jdk-1.8\bin\javac.exe

      Filesize

      581KB

      MD5

      59c85a051cb3b88c3df5100388bfb1ab

      SHA1

      3a44728b1695672bbf0299ee56c01596939f9b80

      SHA256

      7cf198b245ffa5b8604a9690ba99859307e831cef8302b2301859c823533687b

      SHA512

      1dec186a6026f1d4e8ca1a1f8935db45ef6a887c8806e751f204ac2451ff3cf1635835327ff2fb9738b71fa2cabacca220780e6b37133ebb689707bab7aa32c5

    • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

      Filesize

      581KB

      MD5

      6313de94fc4bde57e30bc566ebb99cfa

      SHA1

      1d768726fecc2814f4a20934e4d54188a2a95179

      SHA256

      9f33a31a194f1b899f9cf93fb3b54def1e999320c158e1b4d3284eb4f021b818

      SHA512

      8f27425aa1bf47024e6c7abf874b658a506fa51591bec16b05d8e301773c659a4e1e5b65946a55a5fb7500e055ffd7cc4dd2563b9cc864969dff73931c7400d6

    • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

      Filesize

      717KB

      MD5

      b8334f3105ee778a7443b562f377684e

      SHA1

      1e7bbdd30c80ff2e55123a66911803fa826fc68e

      SHA256

      5c99ea0f36e31d105fa90d6584c3eb21c5a60bce20912474d3b70ca81b0b1034

      SHA512

      8d7ee5bed54d1fa625e0b243fcebd161673a6db09605b9e1787a974627090f70bfb31253a0e6da7d026370e88a1bd6207cd198d8aa78666d3f82cf2587b7e449

    • C:\Program Files\Java\jdk-1.8\bin\javah.exe

      Filesize

      581KB

      MD5

      b1b20521dcd1c975172e949bf5d823ed

      SHA1

      65fd26c2ba60d8619f0763311eddfd2fa061a0dd

      SHA256

      05447653854310b12a8f221b001487994390cdca6a70e3621b537a6bf57fba87

      SHA512

      05d2b7bfd0bf60d8dcedce1df8dfc92ebe85057654317cafa90329e787cbffa92ce4747f9ac290cf560de5a1e5bb5882297ed8378858ce19a20610977f5b1785

    • C:\Program Files\Java\jdk-1.8\bin\javap.exe

      Filesize

      581KB

      MD5

      2dc30a5f8dbfab5cdc8f613bde247010

      SHA1

      3d763756216a0594827d45373a4d02ab0c1d42f7

      SHA256

      e161453a9cb19e9abdb9d8086d7a9e89a53220222a2335fab22b5e0be258dfe8

      SHA512

      1624a8fae0796d7394bbc4ecdc8cebcf4d370f346e823a0b0ad2dfac59bf236630022cf43615f7fbb03885336a597fb6c5366da299648fa8de9211ffe18b12bb

    • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

      Filesize

      717KB

      MD5

      a3bc8b5645c04e373690461530b45204

      SHA1

      4b8f246bc6417ac60a7f3b375ea69a0bb5c3be74

      SHA256

      044186ebc28790870656ab75c930e9a7e516b6e24b351663068681385ea1efd9

      SHA512

      26e709de57986525b47b4e265c975610cb3e1ff2612465670f77012f96ddcfe9592ba59ee364bd6afb3ee1c98f40cb3cacdab42961b4bb7ddfeec937e3b10acb

    • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

      Filesize

      841KB

      MD5

      277041a20ffa35b6e2262f3329315899

      SHA1

      ebc686fba6330e46c3a84109954cdc020bc30d90

      SHA256

      a12968b1ffed34bf4efd034e5e57342e95d7c4c0e11bca3dee7362a2c4dfcaf7

      SHA512

      864c09a91478b023afdd6e5c2e36c190ffef9f505d837c716587602031c0c70048dc50fd61a337bde2786d593ff7d5d4df13113d7544797731c2afddb5e221b3

    • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

      Filesize

      1020KB

      MD5

      4d5f61c7cccbf73fd6010dd831d797ca

      SHA1

      825c145f6287b4ef9ae3435b1c94f6146e2fbdc7

      SHA256

      e829f3424fb5bd58e1112113eae5effa340867f35be910746d733f7522556517

      SHA512

      d0793ec22264d531c4172e56b710fe4704e7e5d75eebfe832e8f22a247d98790577a39dc40b86bd65fa1dc77d14b8590a9a24ada4a9bd57dbd7dcb6cdec0eddc

    • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

      Filesize

      581KB

      MD5

      f19852268529045d838e7207aee07c8e

      SHA1

      bbccc0f9d27e99ba6e1af1a9a4ffd7690078bd02

      SHA256

      6363b2fae9b5d4e1dec2a09b13e83a8cd9949d2e6d9a6d7864fc59e1e6fe89f1

      SHA512

      5fa91ecee8a924f0908fd4ce5fb2871bab22f9e90a9da57569cf824d0e6b3364f6126604e48422cda2df9baf72463bf98f1a17baaf4b4257337aae479de6bd54

    • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

      Filesize

      581KB

      MD5

      face645dee650441cbe81066bf82ae2e

      SHA1

      77ed90f301f4f8f607669ff7a0cd2485e925ac02

      SHA256

      76171e228edc5fe86210cc20d6c6ba6b8d663624bc35f66c09127391ba7deb08

      SHA512

      46fcd05bfc3852947df33dcb9138a2bd92ade713c90c867143843caddf1b40b9d31e3261ec72b301eff66783fc351778b0bf728921c027f95418ee121f409048

    • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

      Filesize

      581KB

      MD5

      6315cbe2910c977dcb2b877cd93f468a

      SHA1

      c1fe36af7a1c8fcea4630ebe29b47c0506cac6e0

      SHA256

      0e200b9d8b6d08a7d54f11bcf30e2fc9a01ec67f576ce47b48c8b530bb455f04

      SHA512

      bf92e08e7bd87a3aa8070975f03a720b40f9106ab8192d2bff7bf1ab814ed14c2c1a6ea65a8ab7032e5ab1f5458a9bdf430a7284ffc0111fa466b8818d433471

    • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

      Filesize

      581KB

      MD5

      bc02efc0b6c504bce15c812472a5ffeb

      SHA1

      b1ded0aa162e4fe0f14a5a53d7f4f33e5a32bd3f

      SHA256

      7a88272a0d78fa7dadee57fb23b715bb8088080facaf0bb3cb0e25ced38e6c36

      SHA512

      e2dcf75f856bc5d73771973b900738900e30fe83a0db43f9466b76a1f1de398dc7b0385dd052d8a092f73c873346b2a5f1b46430dc6d4c7d338940ffee49c0f6

    • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

      Filesize

      581KB

      MD5

      22c9834c763842bf48596a85ae294d95

      SHA1

      1db50cf7ed982e62e7ebe25caed4a28dfb287195

      SHA256

      25c31e463f1d46cd26fdbb104e815d3b49051ea3fd012355cca51f962fb76c05

      SHA512

      d0661fddf39cbdcba9dbc1491047dbfd98c8bfd8487ad1597ce9d992fe72dc586643f88d844d482cf9a10cc807b6409895bd91351f38653b54c439b380f2013e

    • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

      Filesize

      581KB

      MD5

      0d24a4daa0a60c2535e2fa4df6b8430e

      SHA1

      6d13ab43f46b4859abd82bc0044607ee8a5627d3

      SHA256

      f1bbdf985e30aaf7b6d506910edd079f108ae6cad39abc7ce4fb43ab9fd6b302

      SHA512

      9609de44c45fdad2b1b4e0c1a4c305047f06caf517c05d7b3bee153579ad538286e89aba95e6a7acde38764ad20c6d94a2dadf01c1a199a9893ec374137cdbdd

    • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

      Filesize

      581KB

      MD5

      20f2a90960fdb1aa05fa83452204ed33

      SHA1

      44a95b0f389961abec2f76d17671846c402ade1e

      SHA256

      8c30aa5be8c4b041356438dcc9436a7a8bd8e29bcb04eb661fe207ddffac1655

      SHA512

      89b74f3a1a55bf8d22fdbb7321e6799a7b90291d912b9840b3856408ae2f3be4c386c74bfd40a79c79397d10ff4e5ce9024731c1c32891f8fe39e971045cdf35

    • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

      Filesize

      581KB

      MD5

      fd5573cc4a9829ff8e5a1367f7b76b19

      SHA1

      8b3219853935722511127818019937492cd1d431

      SHA256

      7900de2bc4ff7695e3f038f9b75bc34eb782a33e3a139a7faee5aca5ca006240

      SHA512

      760b5dd6bc1766bdb7b833b8d0153efe9672217bff762f1027fbb25bbc47ac20d0f061f50841141b760fefdc1568ba53b489ec874732224da3cd0b149635aaa1

    • C:\Program Files\Java\jdk-1.8\bin\jps.exe

      Filesize

      581KB

      MD5

      06ceaec99ce59dd8e627060f1f4f512c

      SHA1

      758bd992a9245dac99a7a547a3b9388380f57716

      SHA256

      e681eac67c53bdd54ab3fd77ba954b38ea2887cd5a6399f940e0958a67677ad1

      SHA512

      aff6a73aff300acfbb070a35d34fe85c7bad3e469be1f2a9d2620829d10cb9cfd1cead6e59b2cc38f6ee8e65d903223f793c0b18fc3e8399a6c760a4993295c6

    • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

      Filesize

      581KB

      MD5

      c0ee56426ccd37645497f3b82c87d4a5

      SHA1

      ebe6ae65c236bf626fb7d0d3bed43cea007d0d63

      SHA256

      e36deed09a7678ecf6f94d2c161b2565e225b6f0e407c69aeb29bdea55d71a97

      SHA512

      fc0756f200e5e566473c1b205e3f9f1e08ad8d8a8670090f5b7de1adbd73c86faf1e542320c1e710575c2a10e2c11c248e92471f5b3849f102bcde04d9cd847b

    • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

      Filesize

      581KB

      MD5

      c622296fd90f6be470e0a86b66213730

      SHA1

      0922007e1d44401b2b1f7fc41a4cb6d1123fa501

      SHA256

      c4f56cd3485704bc6777fa1f66afd8ecf0516238b08510303d1d5eb88c5dc8b3

      SHA512

      d69e7b3763541d92143fbecf0a7224e358274952a591a534943cd34b92eaff3aa8b0bd483f577f19ee926ebda3cb7772a5b9a381d845d8c5c06ada07036fd022

    • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

      Filesize

      581KB

      MD5

      8bfbb2aea24212be3d84ed91be4083f0

      SHA1

      1a6dfeff9d1460c02329bad520c2ef294bbd6c13

      SHA256

      42d87010decb87b0297f2e6aa5efbb90ea59cd22186fd563217b01798c7c3be6

      SHA512

      9c4a936d8365c2bc72a4e33bcd917ca792cdf933fc905899e3c589239c80c694b362c10e3266bbe41ec20850f5b9a088085c058562e2098621bec8bd0d56b460

    • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

      Filesize

      581KB

      MD5

      0309b544c455d17ed1032b8e7e3ef140

      SHA1

      89aecc322eb62b7531c7e20bba968e1a2d765375

      SHA256

      67c46ef8f1266bedd19d826952d11287de7a53799ced7016ec8c79e9f82af250

      SHA512

      30b24433d010ce38fa934b8d9b26a8cb555b06bcb94c7a34bf4e565eed9f239cfaddfc6ce7bb81f93db7f8c695f0ab9218a9c5ddff2c207a8743a210622b2edd

    • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

      Filesize

      581KB

      MD5

      269e4a36db46f883677621f2716827ab

      SHA1

      5f5b2f67370a6d40f7cb9d64f9a0142ef1a82573

      SHA256

      cd6586abb0fc1a82ab77ef301bac74bc694cea755a2439f55a68320b2edbe955

      SHA512

      963943d2b47c4727d542b87f2a698c34afe33c5a9cc1087d4b554e9adc0f4f6acdd30cc22ad13879305e2e3e46cae6d1a28eb606a6da2ddbc5b1a9054da515ec

    • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

      Filesize

      581KB

      MD5

      41658beb559ee4e9c53dad9e8e9a0bbf

      SHA1

      674429325a84cb69776cf7874778a4078d7247ad

      SHA256

      40b7868d03606693e4ff8fc81824efbff75df696c59a622d5df7cb2dd609f5b4

      SHA512

      f3d89c65a8538afb7e3b79dde0303474b8cb2a3d30a11846a6f62828e38d76693cad73f29a28a944914761b44c3455ac9d6bd871a3ec97d697d6288469817e3a

    • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

      Filesize

      581KB

      MD5

      db6a3bffd0e0d1f254b5d6abb4a7c1cb

      SHA1

      391a1f05a2856ae08dfdccab10a9d2dfe37da818

      SHA256

      24d1c1a0862dd8367c80772a365dfc5000d22a2ee46c0efab1050f4eef420a49

      SHA512

      ab4e75b5bc51f76fef70d14b686ea0a39a8d86ed79b0ddf2ff8b724e4af0ea2fe75b2e18f5ec4e92f849ce0dca34b93a5f214648eb12e3dee1685948cf8b53f2

    • C:\Program Files\Java\jdk-1.8\bin\klist.exe

      Filesize

      581KB

      MD5

      ed5365e503fc0f2d80a3459fb5284d3b

      SHA1

      33a499ec9b0eeb5f8399628491a655df326b0f2b

      SHA256

      97f39baea385e977aa54c93cf4a7b3a40d85e060627f80f282529e9ef34e9418

      SHA512

      1d7a8da3d55a40c4a93d1ec54f2bc788a6d13494714e839daa925b9d2f2960060c42995f7d56ddb6fede1d3d0aa6a74fb9c24b41117ccf1238e9837c40678d49

    • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

      Filesize

      581KB

      MD5

      f60243e55dabf5eab93b84796bb71db2

      SHA1

      c0f3c8182e01a72a96f5b1a8407ce3b2da10a5bf

      SHA256

      d6bf4684b125c2675e85df85cd61cc3c23fa972d3bd9005c3d5517d46d1b8ea5

      SHA512

      7e1872432ae57f48d8af656938e2598716385c40dd3f821d458366f15915859d2e7c4871e624e651f95e3968669aba2b117447dee0a5995a54c28de8cdd58cfe

    • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

      Filesize

      581KB

      MD5

      938bca7a13d33f6d8677b0bd514d76df

      SHA1

      ac92f7a78488dd0cd1b4e72d859924a465698358

      SHA256

      0c38fd480e1ae8b700577048b2818815721932af9a5f61f9d46e4f9560485f7a

      SHA512

      1cf6a3e2140fb5179ce9eab398075efe9f88d3d00f9de30241b28254163dede6835be291644393d8ac1b78b618e8cb8568246a8d117ff71f21178fb3d28b6ccb

    • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

      Filesize

      581KB

      MD5

      6f08595317573d66ede2ade78296b2a2

      SHA1

      4e4b12734518397707145a83314e1df44817f0e4

      SHA256

      6726226c1131618b1522468cb42343197917a66f891c5e39df62087af063bad1

      SHA512

      933d52790f3bb3379b3b6e25c719d76634cd3967c39bc60914553a7370913b3fb2d49d4cadc155ea4f0962f9fa1fba22dfdebb2539b3a60198defb137ce34a68

    • C:\Program Files\dotnet\dotnet.exe

      Filesize

      701KB

      MD5

      740bfcb3f2a5192a3341a3c50e38ca62

      SHA1

      bc0b5dd44a0f42f790dc2c0a8646969df1a3b46a

      SHA256

      5d3a35389290686cfb79186f904b5cd4fde151fdcd5d8380f203d9ea9cea6a17

      SHA512

      b10d0d72369e3527355b1485cbafdfcbf2886b6a0b0172fb1d3c51c602d7c2ec21991c961c7a3fc0d8fb7d78bc22dd7d307f582fcd6f9f2ce3b698e75ee85689

    • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

      Filesize

      659KB

      MD5

      8483f544fa7d6db78c284c6f6acc34e5

      SHA1

      2f1533bd637566029f4ce998385ffaa6b44b13a0

      SHA256

      a50bd2d91079e4d3cba90bf0240f6b56c8fda7f7179588dcaa186e331fa3f3fc

      SHA512

      084f2a35e32f3839ef7cb565c28447ad06497e573924bfe044823910809c81a9404d5406fafff6fe9b67198f085a2fbc4a55ef785d837dd4544708a3945ff227

    • C:\Windows\System32\FXSSVC.exe

      Filesize

      1.2MB

      MD5

      565cb3d31600c7ae8025c84e60db1c39

      SHA1

      9c4aeef3324d2277580321718b5a3dbdc09c2d6c

      SHA256

      0d05fa2f3c585f5b8877beafca2b757308cade461a1c676fcffac86547ffed86

      SHA512

      e90c16d3ff99d4e62d3682aeab6f3586c4782eafbcc3dac1f7940ad7ce03d20d9dadcb70326be65cdec9cda4311bbaddad3da81e6521240890449a09bcfb6b06

    • C:\Windows\System32\alg.exe

      Filesize

      661KB

      MD5

      2e224d1c8695b8a69324f6b101c9c3b3

      SHA1

      f03605381fdb802a45a19f74a572254caea13675

      SHA256

      d67a0295f532913355ad06ff8e41c74a2707385dd43be5e6253fc13176031ce4

      SHA512

      69e44b970c793e53e18d81bdb5d0eca1880445463d243cdbcdbbdf34b3ba1ea3176fb8e0d5b7a3f1bac3e85777ad316cb467948f5325251740caaa28d359caaf

    • C:\Windows\system32\AppVClient.exe

      Filesize

      1.3MB

      MD5

      8f3943a7e4aa3bd6fdef1905aef661e3

      SHA1

      fab6ef4bc050f46cd96c9c3931955eab6906de6b

      SHA256

      42c2a80f552449df908324e925b58f092fc4f0621667ae3bf3f920e021cc3752

      SHA512

      6ca00e4047432978c5da22884f76115f21b8de1c93da118db10f6d66434a3aa63d3bf8c1041fe712d118fc203b822fc0b11049be18d2aa237e25ff41ddebc3b6

    • C:\Windows\tasksche.exe

      Filesize

      3.4MB

      MD5

      962d4291a5dfac935ca1eff9b1e21d62

      SHA1

      4f68907deb3cbfeeb5133c44f12ae58d1c20b338

      SHA256

      82d3aabbff37889695657e40fd52e38159757b7f909426d1a4a4657f48dd3c5c

      SHA512

      6bbf39169cead50fdb9a5ce872ce73607627c05c5f5a040545f5c733ff2d45a4c33f54a4e2d33cad36b9d083110e947ba23d979ab570fc0917436b9e87c7f627

    • memory/700-86-0x0000000001820000-0x0000000001880000-memory.dmp

      Filesize

      384KB

    • memory/700-271-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/700-107-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/700-92-0x0000000001820000-0x0000000001880000-memory.dmp

      Filesize

      384KB

    • memory/1228-45-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/1228-36-0x0000000000C00000-0x0000000000C67000-memory.dmp

      Filesize

      412KB

    • memory/1228-44-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/1228-41-0x0000000000C00000-0x0000000000C67000-memory.dmp

      Filesize

      412KB

    • memory/1228-268-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/1352-72-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/1352-70-0x0000000000DD0000-0x0000000000E30000-memory.dmp

      Filesize

      384KB

    • memory/1352-116-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/1352-64-0x0000000000DD0000-0x0000000000E30000-memory.dmp

      Filesize

      384KB

    • memory/2160-269-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/2160-61-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/2160-53-0x0000000000C70000-0x0000000000CD0000-memory.dmp

      Filesize

      384KB

    • memory/2160-59-0x0000000000C70000-0x0000000000CD0000-memory.dmp

      Filesize

      384KB

    • memory/2192-13-0x0000000000540000-0x00000000005A0000-memory.dmp

      Filesize

      384KB

    • memory/2192-12-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/2192-108-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/2192-19-0x0000000000540000-0x00000000005A0000-memory.dmp

      Filesize

      384KB

    • memory/2368-63-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2368-1-0x0000000001090000-0x00000000010F7000-memory.dmp

      Filesize

      412KB

    • memory/2368-8-0x0000000001090000-0x00000000010F7000-memory.dmp

      Filesize

      412KB

    • memory/2368-6-0x0000000001090000-0x00000000010F7000-memory.dmp

      Filesize

      412KB

    • memory/2368-0-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2448-26-0x00000000006C0000-0x0000000000720000-memory.dmp

      Filesize

      384KB

    • memory/2448-34-0x00000000006C0000-0x0000000000720000-memory.dmp

      Filesize

      384KB

    • memory/2448-33-0x0000000140000000-0x00000001400A9000-memory.dmp

      Filesize

      676KB

    • memory/2660-272-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/2660-109-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/4256-84-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/4256-270-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/4256-81-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/4256-75-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB