Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-12-2024 11:53

General

  • Target

    2024-12-05_716b9d4128de9742e7a9888529d46406_wannacry.exe

  • Size

    5.0MB

  • MD5

    716b9d4128de9742e7a9888529d46406

  • SHA1

    ae6281bd3a6c013d6f0d25ea142236f0cc010145

  • SHA256

    b79d4f09dbc6e34bb6a6919a0a55d253962b34c71d83c2b69ee53cdee9d6c4a0

  • SHA512

    a8457b444589b44bd7bf07d5ce1430475b6ed44be7ad20f1667528b1da724d5929e1711c7b3bc453785dd9edcd471290e049d146bd5d927f00d14512206017d8

  • SSDEEP

    98304:GDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H2D527BWG:GDqPe1Cxcxk3ZAEUadzR8yc4H2VQBWG

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (3348) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 14 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-05_716b9d4128de9742e7a9888529d46406_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-05_716b9d4128de9742e7a9888529d46406_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:384
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:4056
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:464
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2552
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3140
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2688
    • C:\Users\Admin\AppData\Local\Temp\2024-12-05_716b9d4128de9742e7a9888529d46406_wannacry.exe
      C:\Users\Admin\AppData\Local\Temp\2024-12-05_716b9d4128de9742e7a9888529d46406_wannacry.exe -m security
      1⤵
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:2340
    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3208
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3548
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:4092
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:1828
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2528

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

      Filesize

      2.1MB

      MD5

      7def8a6c49d4d0b4cf2487a618a59bc4

      SHA1

      366927ae0623148d68760770b924a9ed6a037058

      SHA256

      939649a753eea1f7590f0c978766dea8ffda4951d4b7440e2d3d8cdb80ff49eb

      SHA512

      8a1727c91fb41b8a22e8588b847e8f6e6f32165ff0e38f0a6a101dc7fed8c9120c83e6fd1e59ee5c6924749d10097bb686e46d79f4a933fb409bbd7f4b70db43

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      789KB

      MD5

      fe1d816fe7013fb97f2c30b660fc360b

      SHA1

      95e2d775761e567ec6e5fc8f3ecf859956190d6e

      SHA256

      79a9ea180644ec91edf4efc7ee5ea8a1add347d2041a435af5d73f85ec95239b

      SHA512

      46960b9c85c7da4309a7590660936bb62e1409b861fea115b6998144e7b41ae88a8ebcfa4076585c8a2445eccd0d1b3af26c483d82c254049ad2591945d8f425

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      1.1MB

      MD5

      e327cbee722a7b77fb1e97a5114d5c66

      SHA1

      83ab5f92d00d5e7077478e8434e19e83bf5e284c

      SHA256

      dcddc9be97c5d04daf0c0f5f8f673ac02dbc0e832704237379ae37693618ca4c

      SHA512

      9c8b19e0bcc432086d083e6dabfa6b0dab5fec02b8f7996ea73dbe2ee29acd80a545443af59248aea8b0260597b8315c3aba1bccc437ef580ce23b75ba0242ba

    • C:\Program Files\7-Zip\7zFM.exe

      Filesize

      1.5MB

      MD5

      eb187aea771200295c799fd0abc86b6f

      SHA1

      88005404ef3a06743e05b842582ad6a061c3dda9

      SHA256

      e58c6235c39bdec71c84bf6d23833753e28b6816de0536d06fd7067f0a730fa3

      SHA512

      f57da4e344afb8607a1564ee256ca2c534109036cb00cf194764a627f6edd34758e569cb32aa7f949eaf2127b4e83abe8dbd1ffa2f595f8a91ac9e0361a6573e

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      1.2MB

      MD5

      7348f86540ca4fc6d2fae21f22b665a3

      SHA1

      21c5ea47f4d0b4c6cd44a4aeb3a3efbce417c630

      SHA256

      8b9f325d94f7768f20465ded156cdca43d657c397c09580506de149d8610b0ae

      SHA512

      a6917fe8b75bd71f44a79a7936962548b39c07d543d24f2e504bdb11bdc3172a6b6b1892c573316c9e49f82ac12fada58f2def9817ec261a8573c9878a613afe

    • C:\Program Files\7-Zip\Uninstall.exe

      Filesize

      582KB

      MD5

      f30d051204eb4c5b893e0c8ed0e46479

      SHA1

      c1a1d44695640d9e21522a7326f4e59f475debcc

      SHA256

      b855b6424c78dfe8a480165d6b2a41e980e94285871457ce5144526fa9e7f9c0

      SHA512

      cb1dd254758269a127b31d328eadb542a6a93cf15f253bfe7b7358f895a0907733e4bf7311be824123e90724b469687b4309b324c45d54025007dc703c54d4f6

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

      Filesize

      840KB

      MD5

      9e11e8cbe9be1d6545a72465de31a56f

      SHA1

      19c17a431d95e5ba0ca0caf219607bb3851927e8

      SHA256

      78ee1b928caa34b2dae195c272bfad513756c6a5e635f03fd9957de1e95782cd

      SHA512

      e351bac7724159b2d4063478010ebb2121aff97154b1e6a241fb59b57743567b355d865432e765cd3c272bc521d6ec67dbaaeb54acfeaa8ffbfac6b3480d9bfa

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

      Filesize

      4.6MB

      MD5

      5e7be84627a0d88122038ce66d80ef67

      SHA1

      b73689fb73596cabcf79fac11be66317beaf283c

      SHA256

      f4b49c780a39a9aa1e68fe4053a1f038d8a094dc4f7c255b1b1ccbf27f083bae

      SHA512

      f91422cdd27f26a03f288d15f765585f6d68fba37f73f7135cfd72e4886544a096fdea4fef63d6d1847bdbb8958435c8ddd75bab04f70a8b09b805df099f6245

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

      Filesize

      910KB

      MD5

      69d923c04f1d40c88ca1cfc59f42314f

      SHA1

      def2ca75b952c7975d3dab2afd44d0b3aa0def50

      SHA256

      6df2471f5a7410f146e1702a918ab2ac0bea667bb6d4c81ae0ab4985311b80d3

      SHA512

      2857050e5e968406631877aa409e6a36484f3743d687b52b76416c91c495041a7a54b7540b60ea6e87666fccfb2cb29e6ae0b9a66ef45c4c234c088a3c29941c

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

      Filesize

      24.0MB

      MD5

      e745d0d7496c3d08be47fe4aba71d7a6

      SHA1

      7b8437909a063a97c0ebc1dd055eb5132f2b3f19

      SHA256

      4399684ee8996fc81f3373d019461444ce4697db718e1fba8ff768b56bfdeca4

      SHA512

      44eee8af77e966621db7cbb7a970708b08d66be2ee43bc8575cc6b25157658d57dec0a2dc74126030069d5bf370630e639c311b83ee0f2e5bc9306abefd3adf5

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

      Filesize

      2.7MB

      MD5

      4fbea269d672d3e57d4b0f3b004e2c29

      SHA1

      2031ec4f9a611e893b6d0c7c8f7a87b832ff6315

      SHA256

      cf51c07c05aac2f555acc0ce3031cca4106c9814357ad0c7babbf10a817f33fe

      SHA512

      f82ddd943bc26795bea90b9b1732307e00f1d7ff2e19a3166d258714a25e1ab69939221d83a325e36080386370f670d35042b852dbd5582223ba400ff7b46c27

    • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

      Filesize

      1.1MB

      MD5

      fa482e8671e89624adc222e98a9d54eb

      SHA1

      d903920090c81b1242ec85946e2aff6b0372814d

      SHA256

      a11a2c97a81d8f98a4245c123672479d99fcec5b15b9b50caa2f4a765a0ca6e8

      SHA512

      35eb1a2acc76ebe15544295e7baf859db04a8f9c52f843c26f8757168ae2319d33cdfb08ffa50d9430301d99ff0d60e7da0f3a38f738baf0657c370239647392

    • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      805KB

      MD5

      16b124374021fc66c58533300a7d4bc1

      SHA1

      6edac9e0187b498c2a18add353a4328256f67a82

      SHA256

      a9f67bf6ef118e26394a14fd50534fcdfd5d10f4e143dc72b266d68b5d9ad602

      SHA512

      8aeebf279f346927131679ad7a14a6e73b079e4df44bcaa09d34755251125e87f0d31e2a6655aeb834cb972acc6bcaa3cb2f30866d84b7e74e5af4e9c4bb8e09

    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

      Filesize

      656KB

      MD5

      aa2804f215d5487ab1241dc67c1b577d

      SHA1

      28ba54b2e9c9642dacf569f9f0aa043b232a4173

      SHA256

      fabc88db79b27f6754b5ec2d5e3677447f32a3e0aa0f221e0416ce1da0b66836

      SHA512

      4b3e87d08e2778499afa15091b86361275a81c4485c6d71e9c1b6a6168b96ed1633e63d867797802c8ef5877933cba717ee19fd39fb687b86e9b44c3deca445d

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

      Filesize

      4.6MB

      MD5

      f97e7701ebe5758a61ba275b57f5fbbb

      SHA1

      7fa755c0bd80dd1daa8c762f21144c3e79e9175e

      SHA256

      93beca656b3b7fae16dfc7192a7dff708c78fe6af7d5e19d0dc5f95fc90af2ec

      SHA512

      34a8fae29b8110bd21b626ecbe9d46813cdee82f7e8e7a878aecf3e51335eccc89188431b754e01f54360e2a6483decaa7d5372ad14a21258b78921c41af9448

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

      Filesize

      4.6MB

      MD5

      56406701f4354dc88d2193ddbd7b4c04

      SHA1

      1a01cce619a40bb469e29f0bf211bbfc84109818

      SHA256

      061f3440f96ccfd96d6208eaf92f9f432d80299b405d0c41f1680d514ddffe15

      SHA512

      ae85156c9f9c591c0eb21f1ede5083e42900beedac9937efa4fc6aad40445f2847d67a45455da41161d23d81967990fb77347f153095e0c37210a9f6332bf851

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

      Filesize

      1.9MB

      MD5

      a1e0f4a4f98b849ed4038165c5725089

      SHA1

      cf9e1180f95931c9c1b5fa6833d02dafb5f0d520

      SHA256

      6baa0e2d1e322c66b35f14e37e861589be5dca4dd23e4221f96425884771cb5a

      SHA512

      ccacbc1f34510c0f27bdbb45c57084b0c9a8b97cd9cb0143239bccf92faf4c50151af8ca755f9c16e9678087469d205fb14d665a3053c4d04f058c066520d4ac

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

      Filesize

      2.1MB

      MD5

      17bddc557e487e3916d24e7de5fc56ae

      SHA1

      66ba69fefbed85ab494288837e8f6bb546d7fbdb

      SHA256

      bde6cc8b21eaccd64f536630f03382eaed868fe72a65aa81de13cfe58bc4ce9b

      SHA512

      31d986703f8786402ecf48c906bbf5869fcc27ab37ab7c907cbef622e4ed5c0329a28e3a0a544884b0c0a1e3db67ca728d5f5ebc820e707d1015ea4d04b9af59

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

      Filesize

      1.8MB

      MD5

      3e17c23ae7438ec74c7591153b8f422a

      SHA1

      e3ffedf7ec487cc5a3c296bb7596f307399a43f5

      SHA256

      a3f131f43506381c63b635bd6f76091feb780b743f43a12ab203288aca6bdba1

      SHA512

      0d852d4b6d628b045ebbcdbb082fed9030adef55601c224c8c6e91feeebf9d026503e8ebd36d9ce2bae5bc64707fb7f07ba1af715d6cdd319d048f45c86123e3

    • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

      Filesize

      1.6MB

      MD5

      340b77ec56c56d2615260aaa80b3dd24

      SHA1

      81ea8935d54fe4f62ea62273f2aa9caa7624f5a7

      SHA256

      884ee3b3af45bdb4b8a262f8f991deb4d5c667313d3344dabc52ccfdfe1f7837

      SHA512

      1d2d88346ff9bf25644ad084f46b7b65516a2226a50bd001967cd028fa28783943591bfa941345eba8f6dc6505149d861fcff360cd79ebee40db79c1f5486948

    • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

      Filesize

      581KB

      MD5

      6837ccd448d88d406308e070ac9be7df

      SHA1

      96e925417ab66ee9cf7245771bf9abbdae10a242

      SHA256

      fe9a5c8c0c8764393e9d35cdccdcc30193c1f7a54976d53e2ac123efbbfd4892

      SHA512

      db69fbac11913eeec156f6914d6dafc0159921bafa262d0e9f32b66278deb66310da601e779552edee68e7bbe3429a1c37c5fe7eb49b1f19bab7f4dc2ac6a226

    • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

      Filesize

      581KB

      MD5

      a095ab3e12e4f51443f9ce24eaa3539d

      SHA1

      4f91f5bfa016f0f1d3dfc626bcabec16d500317d

      SHA256

      5acd32c634edc5efd2c0e5b55626e6833997fc552a89105f25d37d0936e31b82

      SHA512

      6bab2b6a8f05a560590a763af147a98b73c323c1d51011b55f32708733b80564d20877d0142c8f25727b97ef671bfee4e108711980c06a4f9fb105dc0249add0

    • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

      Filesize

      581KB

      MD5

      286fe807481fab3684d2d8a1756302a3

      SHA1

      17da786d66549cbbad1c20359d804a6daa2ffc23

      SHA256

      9ccee0cd625d0011c1081dc17886f584e18c8d22d2f0c10262422825d536c26b

      SHA512

      ca18b7cadb37ebe5197626eb31024ea4d78fab39f191cba853a6dc14d2fc77c3b83a3d0b6154e0cc36c5e60008ea8844b77a94532336df0eeafca7cdb0ca5d50

    • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

      Filesize

      601KB

      MD5

      c824a6df0ce6da7414676d8f3fa2c465

      SHA1

      ca6ab5efef8ac7e2c18ecf791086a723071956e5

      SHA256

      53adb079787205ea56078ab5e1fe633f86bd5a8d5b303e9a2263946071520234

      SHA512

      01b9b03a27fddd0efadf393467eabfed7d5741f72602218dbb71a5351022218b8b73f9716ed28e563a1117a1d47c0b3fc83e68f46130c411b186e1b7a5823f42

    • C:\Program Files\Java\jdk-1.8\bin\jar.exe

      Filesize

      581KB

      MD5

      2fe9a3bb462bf50f20c006294899579c

      SHA1

      f457ae916a9b346267125ecb265b5c0fcccb2776

      SHA256

      5e8ac119310106001bef55966f57c9cad24e0c1dd445c3ade51fedb7f7e96881

      SHA512

      4b9012061df6c60f913568b1c62e623649e9d2e6aa1dbe92b699bb592c95ce14d132fbccd2c9c12a0ecc64fafa8a6e7ad1e0b3519a221335457a2ce827c87b51

    • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

      Filesize

      581KB

      MD5

      038c7babc44f2d65254d07ec5c38255e

      SHA1

      4265729dc1a12020dac64500ef0d8fcc67329b5d

      SHA256

      b4368245af8e243f4d5cb139bb8a5b63686fd0d7d58ba71717885f73a769a02c

      SHA512

      8d50875e906ac951cec66239c63179ce33104510296f7edf2bdc37177ba5eae30f9936dc063d30d5b96586c487eb99939c0929b2fddf0a57dc3ec9ea73147c1e

    • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

      Filesize

      581KB

      MD5

      dfeaa037c79f03f48d485398925908f4

      SHA1

      aecb753e198d9cc6d7ebfa105f310bae584a4f6e

      SHA256

      855aeaa68ddc1fedd5bc516ef0dfed15768babcb1d0130c9f73a8b27b230a340

      SHA512

      647199a2f871d5f0a30e65d959bd34a19e37de7c8bbbacd0a70d0b0ec12feab08bda9c272774971fcc70a021c624b907ef6fb0cdbf3bd82dff7d2d547e4ae337

    • C:\Program Files\Java\jdk-1.8\bin\java.exe

      Filesize

      841KB

      MD5

      29590a039c001c8e7b691efde84c050b

      SHA1

      5018c81ee5a07f16a0d5c188cdd6c4333b6643ca

      SHA256

      061a0b5e6837dd6f9d5c26f152b0cde253d841f40fd8d5cf0c7334e0ec61acbc

      SHA512

      ba75348c94ca89410da9e6ea4e91f749fb53986bd62f959f1346c9879e7a42ed8bd2ac539c222536a7da99e7aa6c0eecef86b80940f3b4b17240fde13dd27474

    • C:\Program Files\Java\jdk-1.8\bin\javac.exe

      Filesize

      581KB

      MD5

      857cb4021c87aff9a5026cd335b98217

      SHA1

      9f6e09cf5586c6219c6e7239cc6421e6455bdfd2

      SHA256

      d974cdd4de8cb37a72b7a83fa60e53ccb8c3467aff2acc4429b13c88dabb0b80

      SHA512

      3ec0c690897ffe650c9a961c15c501b516d6e1a4e4e4455988ee7406b4c85ee9e5a1e23a39bb9332dc326af7dc52abc659a07b45d7a8ab69f1aceb7af4f08cc1

    • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

      Filesize

      581KB

      MD5

      39d626dc9a7d9d7a22d990cef7b55c7e

      SHA1

      87bb0a01c7106c77fcf19d19b63746ae8aaec84f

      SHA256

      8de14b9a39ff0760e8913b45373f8d100ad49867bc98de0f751300993934d41c

      SHA512

      959757ceda46273458c92a2abc243f76999c426f98907cbc78f93ff9e66125f0b9022d7ad071a9a3757a45cb0f5a7027cc9d5a2572ea399131362cbcb8b83832

    • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

      Filesize

      717KB

      MD5

      29d38edb621600cdc600c36c30c96d85

      SHA1

      b85a43d2234eb3d7fa6ab0ee0ad8669498a4eb68

      SHA256

      ef4b55a8e0df22b8c575f30cfebfc95705cce8e3c283fc72e023d48c2cdcc69a

      SHA512

      91a8f4a73a3cc56a053e677f2d3746c1cc4f27bc6be7dc6fda5d7b21b460e3c29a6a5b22d5d9a0b6320c9fab0d352a21a4a0a87873e17b6d42f4fb23eefb89e6

    • C:\Program Files\Java\jdk-1.8\bin\javah.exe

      Filesize

      581KB

      MD5

      381e70dc79722114303d7dcb43b9beb0

      SHA1

      f55a6506c53e0e8b1333a4ac2d426d53ed450a7e

      SHA256

      08672c88c62ee4cb5181bc856f868294fc5e93c43744c4e1941532165ea13ac1

      SHA512

      51b5c406588ddc61df28ba702769f8a6df47fcfc9c8b37e812c52630e7e8256228f925629c8084b96402a9ff18ccaa4f413572fcd0c417cd4db076d45af1e418

    • C:\Program Files\Java\jdk-1.8\bin\javap.exe

      Filesize

      581KB

      MD5

      e1d4190580353233b40e6c6356980993

      SHA1

      22d3a1599c47c0cb40c1d4361c4a46af55d1b312

      SHA256

      7c6a8cec29ce6dec03f842e3aad7abea798dcdb3dedbee5c6cfcef9cdde5d416

      SHA512

      dedf2a0cc2118d6b06baa474c2591acde5aff1160f0edf65ec9eabfc31e42735ea684efe3b20b7c49d8ba2281e37ee0b5481a9904e2ab967335a105ca05f5ce3

    • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

      Filesize

      717KB

      MD5

      21ad44743a622c98e79b69e452d19980

      SHA1

      e156082ad9c433358a9fbd03af84a0fcbf384b83

      SHA256

      cfac74a957f2403c4aef08c7d4168fcf00c9ffa92cc6cf6f8010ef7d329907e1

      SHA512

      8f2ad4ab5025b6c3a0328e9e8a2f6220cb4a305b41c1c7d2d03c247c483ab59605c1d4375a3b529458b673d4f215d2f44aadb6fb09935563944a0548497556cc

    • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

      Filesize

      841KB

      MD5

      d5bda2a29527e282451d7d0ea961d341

      SHA1

      6f48a8ce6fc153e977a34fa104dd03a6716bd685

      SHA256

      9caa3da3e92401cd63a238093614cb24eebacb3efa201fecd08c153eb4d8dafa

      SHA512

      920754fccd6965c22017f4a63b510f8076d5c81965988b641bc26685876647cd1e3f2714f4cd888c5b51daf5c8a5bc1f2cc03ebce4c5bc9092c09e6fe47d14b2

    • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

      Filesize

      1020KB

      MD5

      ea9f3672349d2d4985d4675f3e1b94b6

      SHA1

      14593fe3aa2af75f86804cefc056405f3458b1da

      SHA256

      81cf328a738e218ebb71f92d716d3db9e5796b797169ba09ff483eb8b922a98f

      SHA512

      361b72c47d4cbeeac3f86dee894c2cc0d37f954e81eb15b0d8668019808f429e2980aa766dbdffcb1ae9f243ebe58bd30f02871fddf39bec4a27bda0b9a082ae

    • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

      Filesize

      581KB

      MD5

      578958c2468278c94e2fcd1cda33a495

      SHA1

      1fbaeb8608491bc2cdbdd6ded8129f6201739211

      SHA256

      28ef370792196e29762ed0e5467f568185ed1b78f21d4e81427681824175c0aa

      SHA512

      aa91df29f07c7b7d753a0a1f0693f35d50907e2bed5cfa74d39a54af3e8b962369bde8d4468e48a69979f16d3409a7cdfd26e288c50d0a41a0fc5c53a3b7c910

    • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

      Filesize

      581KB

      MD5

      481d94a4b2979aa559b98ea4b2f5d61b

      SHA1

      667ea67f698dac57b3015ec002a0025ce289174e

      SHA256

      451ed8d34df6efff6249e0f0f880f2c6a5d5db36f2d8eb3187eb16247457385b

      SHA512

      c4dd93804c63748454e26f34f5caf0a764ac8bf30881907b463339ae0990895c58658fa9d47e961f53bc316bafc42ed1da108634151a532c0f295b13444caab8

    • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

      Filesize

      581KB

      MD5

      5d05ce5a0160406bd3fe80d58c0319d3

      SHA1

      7dcdb6607355a1b3e6a1aeb2e4ed56e2897c053c

      SHA256

      d44b0bb8b92dd6b00e99f0c53a06ee239c74876d06122615062ad06a1ed1a763

      SHA512

      a6c55d7d8b0e45ad37a1f53af2749e502283071ebfca4f8b4fbb20cdc7f62dfe2ab45c3f72b13f8930523e1c1a83aab149c778bc808639410d5d18cc8927d1a2

    • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

      Filesize

      581KB

      MD5

      311b34e44a67faa9d990f3b1af64b9ea

      SHA1

      a5e7350b172a5079e00387fb2e32fa603b3dc043

      SHA256

      e357a0cbe3337c51983ed75cea264b2199b207742e051051f53578888124e310

      SHA512

      a4c7b954d3bd856104e7a31f436e0003e1555dcc4bce614c76a1e0e2820b08804bce9ff17db00301a70e05e7dc2e4b0d5ce6c3ef1563a81360cc941af490f900

    • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

      Filesize

      581KB

      MD5

      acff06218fe9563f59b7165fb8ea7e28

      SHA1

      df96209f5e99bda8ca80fd6d9c0e9af1111ea463

      SHA256

      af04633983883eda4384990db4b78bbb0a924208ebd7c2eef474b373cca6f7ae

      SHA512

      379175036c3c063676c197faddf5db7d07913bf4a04cf1fd967cf6665164d422316e6571fff1981d22dfbd85895b4ca29b5d9fea1fd55271961055204060ddd7

    • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

      Filesize

      581KB

      MD5

      80e978016b2517d8a12b79f990f663b6

      SHA1

      6ddb809d016587e6ffff770d3df7d891a7a8fddb

      SHA256

      85c1604ee13f897e1b20e251da7430c5ee422e33034444cd92c718729f182df7

      SHA512

      90be3f873f4017edfd5892c826aa9b3de2b44812fe038050e22ea9607c2ee0912930ade58125f97b3561a2314bf3e1133c4d2401259c9f2c528d569138509374

    • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

      Filesize

      581KB

      MD5

      5db9359790b8183c1f11e35df8b427bd

      SHA1

      26bbe249c51f943ef76b53ebdc8be0621633cb7d

      SHA256

      3dac6e8405cb5a2e0a1b035f311996e14ac1022b2047f088b7e9aee65288d041

      SHA512

      a6632407e8d1808255c0ed8d03abd092cde2494f4e022a043767c72d2fa9e6467ef6cbdac7c96feca823077f089cdbd31da4c1a4e42e523a83727393bcd53be6

    • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

      Filesize

      581KB

      MD5

      e50ab59bb5d432780431543b2ff74f59

      SHA1

      85b25122e9bf343812fc1faba83d2dd1fcc79e60

      SHA256

      6d5d43116b2b4953b03b8e75b25525e1a1f391acf38f839dbfaed09752194e38

      SHA512

      6178d2aad89c949401ba6cc4df990d6a4f37d2533187e4dc3732d56ff2552b8044b6aca502a8396e0cddb49d33d1b45dd70fe7647e9a268ae98b03eccb75fcc9

    • C:\Program Files\Java\jdk-1.8\bin\jps.exe

      Filesize

      581KB

      MD5

      a0d4a572611afe9db869cc1316968317

      SHA1

      c01a4a0fbba47b597cf405276dcbca816bbe50d1

      SHA256

      185fe7767dc10772e313413b22c0ca1a823d318eac319424cc36db59c4dfc434

      SHA512

      e69c97d0f7eace77d82dc53f2cff6645edb9642a0795c536b9f76008705ebc7da4316f2eafad69721cd57631ade68865882906d8086af29a00d6f8fd1984995f

    • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

      Filesize

      581KB

      MD5

      b744815f98486cc316f39c8c6567af13

      SHA1

      f770f27665a396db301f6c99b28f7b01a2fd0d68

      SHA256

      6ffe641c9839f5e37bb8abbb2053da14dafc2cc5464f34876e7e79bc509cdafb

      SHA512

      c9f7aaa7351eb82c634d8d2477de88bff9cff5d84c7eefbfdd4e26cb04bcd4bb56e7d6902465a2c2cf56969fed2e54b06aa5a8a04aba12a91830b96fa4bea1db

    • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

      Filesize

      581KB

      MD5

      ea9f98f27ae80cd8afaa2d770a99e519

      SHA1

      b2495602b82a21b2a89b740451fbd282129b7e76

      SHA256

      42b18a5a1a74875e3603d60e6b9d1460b90a0a94040b99bbc5b241bdfa0a9b25

      SHA512

      1ca2e41f78cff4d26c85b4e2ebda3ffeff4ebb73dc8bf76f61d5e831b8a271cfd95b20ce499ab4deb506742d287fabb042a420b44c40a9939e9c3ada615d90c7

    • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

      Filesize

      581KB

      MD5

      60c7a484daa74fb4e3e95dddb87ddbb5

      SHA1

      7bf66f7d739b82dba872815e5305deaff508f1d4

      SHA256

      738579c26fd8033216a914faaf0a54ad57c2803bfeea8ca2c5e429e9205e7787

      SHA512

      fb22a3da44f9e03a7ecd86c07035a40067ede6d8f38d2c401f925f84862b2c8b71af532ae7667f303191e7f9568c3d232942d49f2d392ef6903f8e0873907ce2

    • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

      Filesize

      581KB

      MD5

      cfc6e0814be3a701beb2f0f05f96417c

      SHA1

      15ab0fdf05549f5b09af9ec65d12f1776588833b

      SHA256

      6fadbe1c3e1fd07b5f74901b4890fb7472eee59b2031693ac31c564c628abaf9

      SHA512

      e5d01bfdb44e93187c1ac0204001ad3da7e91f4207491249faf54043b846423ee66278c2ddeae45de58d47c784b8845aacdc7fe5905dc9451452add0c8b6f917

    • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

      Filesize

      581KB

      MD5

      ebf78fe652dfb43c40f8ec58454ebece

      SHA1

      89a708a9bedf9ca336d62378606a21f18c9ec457

      SHA256

      f8ac527f3f26e37cb38fe5db6342b1731bff9879bc693658f6a591bf4c4c1514

      SHA512

      afcd6748f8f52a93a592c33b6f2d4f5f25aafbd285137db4a9eb28af0ac9d352b0dd7d94ae256464280c513dca42510801463688779f77b8bd079a24bfa41bb2

    • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

      Filesize

      581KB

      MD5

      613bae6bd4cc98171c0f3ae4ab358868

      SHA1

      ba355f53d8fa472ef63e90256f0399c08e005d9b

      SHA256

      8114bfdb7447cfec5200e17771c711abe8bd4a74c93c39a735747d4e09362081

      SHA512

      b6db0865fe5f8acd5a660ac3b26eb0abf8b9833988ff4193d14cc7b84eb7b9dfcac44eccc9d386eb9af9d44b298ae43de9293ee467b69d1b6954604bfac9ec6e

    • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

      Filesize

      581KB

      MD5

      68fa8859bc972c99c25742898d2d95dd

      SHA1

      1ef2e6c8520dbcc0259c7b9d3f14dc1d90da4e23

      SHA256

      2167dfc90e40571d0d05a429e7bad5c353f259177ae77116174ebb98cb79839d

      SHA512

      27ff39449a8394c5cd0ae6d6d9094b18643c8021b9a4c09fb63b981e702ebc385b9899ea1aec8afda2224e4382b16ff79bfa843d4ac8f6c40de100d3fd5adf44

    • C:\Program Files\Java\jdk-1.8\bin\klist.exe

      Filesize

      581KB

      MD5

      f7579b0f045d5b0f3fc3ca5208dcd7c4

      SHA1

      1d5987d094d38e7159f253e5a5ae1004434bc612

      SHA256

      3de510af5fc16698d7087bef7241d7f50568be3cbd716e02911a0edafaaf29ea

      SHA512

      81f8d0d8ae62a87b6062fb62b9231e553b7242858d173494e91e2053bfa5957c140688d8c14773b9964711ab913c154a26ecfa1aed195cd1920c96b615ac0b72

    • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

      Filesize

      581KB

      MD5

      6e61ad4d55070e197682a055010083ad

      SHA1

      d6bb2e99b521b28fa3b5b6c25cb00d1ea4a8cdc5

      SHA256

      8c8738539c83e1eb9185dcf8093973e2f2f9472e1c65656cec34305daae531be

      SHA512

      1297b70702a61afc2ef142e4edd4b993822040902630e1cc1ea61fe6b3bfcdbf763ffa9e49f5bcf0437d1df688b45f8060365233a4336a1a602f00eba9057080

    • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

      Filesize

      581KB

      MD5

      b937201376f5ff9d45538704d2fdf75f

      SHA1

      8d9bf1d260a91f47389b8182fa8e2216ba2983be

      SHA256

      b3d212745c297fd088259dc9573dd2c0c86d274048fdd2b40d178673dd7915ce

      SHA512

      3d035e0a8463dd01807d64d071efe1ac6b77e3c6d6d1e13b72617913d975a1434acc09ecec64bbf9d6cd1b76007d1c69b71bdd27e3002c15eacb123ee8e9899a

    • C:\Program Files\dotnet\dotnet.exe

      Filesize

      701KB

      MD5

      ed28a74beba90f6b34273b378ff15c18

      SHA1

      d10f9205fa4991c1e39e7b7596d376245b51da4f

      SHA256

      f3dbc2b87f0b4896373cf7fb7af56f97c927c7d54ea295f3c12205f7506c198f

      SHA512

      ef083d0c36e5f0698bacd5e5be81a00c8a2aec31fe48749e134f7b3fb573bd7217e772b4faa457dcc3469c3e298facdc05617a954339cba14fadefe5e65a50c2

    • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

      Filesize

      659KB

      MD5

      6b4dfa43674a37b56a4422992f94b71a

      SHA1

      bbf4b93ab8f9c7d8a00a94e8d647ea07ccfb2910

      SHA256

      267f55ce2114654d9617ced825d00d20096557ddf58ecf1f44ea92934cda67bb

      SHA512

      4ca572f57d6f7fae9c7f6d22a5af4612cf75c6f12cc867452c82970d6c7ca4e18dc190c41c056e80dd8f6cb85a4df7cf188f88ad82517429a9fc5e7870c03bbd

    • C:\Windows\System32\FXSSVC.exe

      Filesize

      1.2MB

      MD5

      5a6fd632f9639cc59ca08df63518b278

      SHA1

      74bb8e6e64b712a01047d910b0f0ae05782dac8d

      SHA256

      484e47040dc67be75963affea1d87fefe6bf8758b3ae04663f9657d3362ce5aa

      SHA512

      34f4f58dec4097bb23be6e9a19083f4edca448d25255daa1ce7c1c96eabae30c0144098824dbe1ed749e21c8a6edf5a4a8ae2bdaee67d3e233556ac9575ec311

    • C:\Windows\System32\alg.exe

      Filesize

      661KB

      MD5

      df8558b22f95f17a6d568b97c5c60b42

      SHA1

      9953116f5fc832b58e49ca4b4648e19520884d90

      SHA256

      db4d8f5779ef0d3151dc505ac8131d445e85eccffb35d599dc8511bd9ab8a6e0

      SHA512

      ded2e5ff43f36fd7d0f86e0435526cd39c5f015c97d609cf5a3fa923dbd9d6901f2dfb67d5bb184393644273430d26db6922311062496e8c387803cf9e5c7d30

    • C:\Windows\System32\msdtc.exe

      Filesize

      712KB

      MD5

      5d1d3462a1aacaaea3b3ec9876675d28

      SHA1

      f0e689e71d0767c4ee1bbb2246fd189d5f552600

      SHA256

      1115fa8884a043a899b86e7abdbfa3319e42a736d79f690a95581ec0171bd5b9

      SHA512

      5d3098600872ebef4ccf9b76bb79ee5bb7b99b276e72f3dc27b70fb6ae696bed8b824a46092ffa78dbc98bcad17ae82919ae69a6b8a87aaf5074c173b403cd55

    • C:\Windows\system32\AppVClient.exe

      Filesize

      1.3MB

      MD5

      ddf08343d141e7899a613a30324995ad

      SHA1

      261445022fbbaf96cd24d30ee58fb3127c669b05

      SHA256

      3f754ee0dfc231cc6e1067498e30ba562c6895b61ca9b99de1047e7880ebc0c5

      SHA512

      8b31015574c8017b37a6e21adacf8526f5f3cb72834a13876935746c463bf9ef44bb2840c7a5ed1bc3ebe5ec818a4509a635939fad05fe9e5476605e21e50176

    • C:\Windows\tasksche.exe

      Filesize

      3.4MB

      MD5

      7f7ccaa16fb15eb1c7399d422f8363e8

      SHA1

      bd44d0ab543bf814d93b719c24e90d8dd7111234

      SHA256

      2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd

      SHA512

      83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7

    • memory/384-81-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/384-105-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/384-0-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/384-6-0x0000000001080000-0x00000000010E7000-memory.dmp

      Filesize

      412KB

    • memory/384-1-0x0000000001080000-0x00000000010E7000-memory.dmp

      Filesize

      412KB

    • memory/464-109-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/464-20-0x0000000000710000-0x0000000000770000-memory.dmp

      Filesize

      384KB

    • memory/464-12-0x0000000000710000-0x0000000000770000-memory.dmp

      Filesize

      384KB

    • memory/464-11-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/1828-108-0x0000000140000000-0x00000001400B9000-memory.dmp

      Filesize

      740KB

    • memory/1828-289-0x0000000140000000-0x00000001400B9000-memory.dmp

      Filesize

      740KB

    • memory/2340-286-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2340-48-0x0000000000B60000-0x0000000000BC7000-memory.dmp

      Filesize

      412KB

    • memory/2340-53-0x0000000000B60000-0x0000000000BC7000-memory.dmp

      Filesize

      412KB

    • memory/2528-127-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/2528-290-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/2552-211-0x0000000140000000-0x00000001400A9000-memory.dmp

      Filesize

      676KB

    • memory/2552-25-0x0000000140000000-0x00000001400A9000-memory.dmp

      Filesize

      676KB

    • memory/2552-26-0x00000000006D0000-0x0000000000730000-memory.dmp

      Filesize

      384KB

    • memory/2552-34-0x00000000006D0000-0x0000000000730000-memory.dmp

      Filesize

      384KB

    • memory/2688-69-0x0000000000D70000-0x0000000000DD0000-memory.dmp

      Filesize

      384KB

    • memory/2688-47-0x0000000000D70000-0x0000000000DD0000-memory.dmp

      Filesize

      384KB

    • memory/2688-38-0x0000000000D70000-0x0000000000DD0000-memory.dmp

      Filesize

      384KB

    • memory/2688-37-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/2688-68-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/3208-62-0x0000000000760000-0x00000000007C0000-memory.dmp

      Filesize

      384KB

    • memory/3208-56-0x0000000000760000-0x00000000007C0000-memory.dmp

      Filesize

      384KB

    • memory/3208-64-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/3208-287-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/3548-288-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/3548-78-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/3548-82-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/3548-72-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/4092-85-0x00000000015E0000-0x0000000001640000-memory.dmp

      Filesize

      384KB

    • memory/4092-91-0x00000000015E0000-0x0000000001640000-memory.dmp

      Filesize

      384KB

    • memory/4092-94-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/4092-99-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB