Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2024 10:44

General

  • Target

    2024-12-08_5a190ff11155c36ec4d91c89af0508d8_wannacry.exe

  • Size

    5.0MB

  • MD5

    5a190ff11155c36ec4d91c89af0508d8

  • SHA1

    68aa7c2debb13f3546384ae4a032e07b6738d3bd

  • SHA256

    54a2fbf6042ca6ba7a56039a4858521d531da0ae044c5cdfcbdfc89372203e43

  • SHA512

    867f932c5251962553642b3f9e212055d999d6c6e9e046d88563a5e54834ff7eb527fad879f7873be9f4f9983f9b00b2500249a561693ee99514d9f97c13c76d

  • SSDEEP

    49152:BnsEMSPbcBVQej/NAARdhnvoAH/Dmg27RnWGj:lfPoBhzNAEdhvpH/D527BWG

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (3233) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 19 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-08_5a190ff11155c36ec4d91c89af0508d8_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-08_5a190ff11155c36ec4d91c89af0508d8_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2856
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4000
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4372
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2560
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:584
    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4532
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5112
    • C:\Users\Admin\AppData\Local\Temp\2024-12-08_5a190ff11155c36ec4d91c89af0508d8_wannacry.exe
      C:\Users\Admin\AppData\Local\Temp\2024-12-08_5a190ff11155c36ec4d91c89af0508d8_wannacry.exe -m security
      1⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:2236
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:664
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3804

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

      Filesize

      2.1MB

      MD5

      0e34e200416818e3f4ad3218bd9a166a

      SHA1

      d2ad0c0cb5f7a15f40f64344b0a092cdb53eb0d3

      SHA256

      3019655d79ca29052f7fd694b902a092608112bf2ad58eebe19e081d931276db

      SHA512

      1de7bf0634199d6a7595d12f3f8d3674524147c4cf2d42684166c24e30e88b3d84f46b8ca1c9742c1871b817af9f528ee72cabcfbc95f662bbc1edd2acc052f1

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      1.4MB

      MD5

      9454d39ccaa72bf34a2805d19df6ff58

      SHA1

      307d3a4df8dc36c7a0174b28cf5dfd1680b6e0e3

      SHA256

      e06ab755b7c5780f03d2606ad12ac944c1df5a49a82cfa0d08fa590022e65ae4

      SHA512

      04b150f72d6b379df544d16ea478d995073a0b998aad5407cb041dd0103f27c68d9a9db4905240069d6a052b5c3a44cf6b04f659727653443fcbe7590f3d149a

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      1.7MB

      MD5

      6f000397ea0f684b60485a0c6dd4f993

      SHA1

      1b5d402efdfbd24a092d2db169fdc3c4aca94e69

      SHA256

      3a17ecc870ade645dfdb920a236e67420f13511f61bf6221934692ea1184dea6

      SHA512

      808b8d1098b6a17085cfded38afba824fad8333b4216df2f2441ce8d061c4917dca181eafa895f35150eeda0ae443c2c2ee778263e6dd6fdc7c03fd45f0754ce

    • C:\Program Files\7-Zip\7zFM.exe

      Filesize

      1.5MB

      MD5

      a1c4ef4749257d0ea7780adc3a4f7ae1

      SHA1

      e24e539076d380de64bfb83c1c8b689641434896

      SHA256

      c3925c73a10653bc6f5e6eac057df7ce8ade806977fe00a8d40b2a148a3fbd6c

      SHA512

      4966419bf595ee19aa836fc229a7dbd9ee3102cf76bba069b53a4e0aeca344db10fa4124f415cfad2958c667ff27c4ca52e66ea20010e62d6b72e2d670fc1bc8

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      1.2MB

      MD5

      c881d6c47dd67f02fc3904e4b1363bb6

      SHA1

      29ec959ae67547e1fd272a41236646b577f00301

      SHA256

      8adb2d7776cdec8b2f0ad4e402ed3abb8a3790f4821539b0a7f86df559cdfacc

      SHA512

      1a24d89c6ab44601e3cd8f296e61d6a47e9fd6b21a206251cb82c24f165a79082fccf51e23b24407418e61be09ede10ef695dbe68d96a1f638dbc5dec1bcf9a1

    • C:\Program Files\7-Zip\Uninstall.exe

      Filesize

      1.2MB

      MD5

      29719dd79866818ad0afe1fb143deb19

      SHA1

      0c28a42504eef7df18531a58cb4089cc20d10b76

      SHA256

      9e23bb55a0ee5d555fed71c52df45e85a7195e25ea2f0e12ba3fe780b8018d5e

      SHA512

      65512434874b1dd8950a04de59a84801a359d1158c43ccc70703679b51a39e5220f6f50c0350b946595834672f2bba5330af9912a7f9138c3b90467e917434dc

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

      Filesize

      1.4MB

      MD5

      6b434efc641a062e0f96031d27c36000

      SHA1

      90b0456c3600fdb1725a1f6b556c95c168ef5210

      SHA256

      6fe1659b7c80ea4053108961ea00c400f8358f8a47fca78a4373290ee265cbd0

      SHA512

      720add4e6d69ef6db8371071e1e21e34a9a44beb9c136db40f030fa0ab3d71bc10d5b2ccfc29b1c6f998ac0d52ec35ba2bce26793d1bfd46afd04cc9ca7273a6

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

      Filesize

      4.6MB

      MD5

      3aee450504369305c03e51748201ea06

      SHA1

      1308bba03d7b052c24b5d4518aee0099f1b32741

      SHA256

      23f736109d144344532bcc8cfd12d75e09524ed686f9014079a52a195c17a33d

      SHA512

      142240968b090fc574feab5acfdfb226e75c0161cb00c99a8b286cbf91358d639eb536d6afc46cd0ae2b3a40bcd962083dfff0b0876fbb8b810a18121ae895cf

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

      Filesize

      1.5MB

      MD5

      26cbfe6459adce39a7efbb884f8fc9a1

      SHA1

      c922c3f797c658c3b202ce9f957e6b47a9188fd2

      SHA256

      de662b7d13887ab48c08c40b79df89689d3fe6e033a94772a14630c38226c203

      SHA512

      8675010f897994f92981eee34ccb422937ff5a739a402982d0569ebec8b508863a6d49e1193d21b966e3685bd48bff65e6d28f048b8c919f21a382634d42ca39

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

      Filesize

      24.0MB

      MD5

      b2cc44dc98d0b06f0dbb020f327dcc65

      SHA1

      8cb3777dc45dce931dd45380345f91838939751a

      SHA256

      386bc7b14e48000a7c91490cb22659eced3ce4dbaecb16beaafe04382320c6cb

      SHA512

      e3e908b9f93219c4d1d6956d5c371eb29a68bff0d79960d970c72e8c595f582760e672464da97e139f7e41ed8a3078b81837e89b9076b4f12f89b3ff35d14dc6

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

      Filesize

      2.7MB

      MD5

      d69a1adfa4f0884d6945d9c8e7433a03

      SHA1

      d4543112a873b7a51c6b490c4d729017884d0ccc

      SHA256

      9330cfa44d4240f889fd72d239a5181ac340968aba68da589fc5ec19552bee3a

      SHA512

      2b5bdc20623ffb9a7762cf78ac346ab8a3b819ac178bd219c74bbc24613d6f5955c8d1686f8cf33ea80effabd6181c5a1bbd8f15f9ab43360d9c6acdfe52d16a

    • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

      Filesize

      1.1MB

      MD5

      0b6aba4ac8c1e9562e4733511f4e9977

      SHA1

      dc796855af24f844aa920254955df8043c328888

      SHA256

      a3857ca11f0d211d5d285cba5dc09d534d90e3898e84ea56a42729593d551079

      SHA512

      ea0984eebb90a00a1e3a1f1044fbffe8166024e54ba665b46e010d9dce9832cd6f3242344d050efc81b2ffe201f1b74c03f8017c20354f16d532b5070e2ee2dc

    • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      1.4MB

      MD5

      61d0b7d33eb94f964b28ae2a2e109f11

      SHA1

      52eff6094ea46d18a3aad67dfc2b07c3745427cc

      SHA256

      a42bdd50b4ba2da912fa1a82e41de6fbf4f846072501c8bfb67b17cae127fe14

      SHA512

      963c6fd3533c12b28909a092e78207435ba0abeac648d2a29255e75118004a97551aaf3ba813294f867449a17b1cc61e7ee5e3968b2fe4efc8f1c80f49ff9184

    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

      Filesize

      1.3MB

      MD5

      be4359a48ce68834758ea135713b5a70

      SHA1

      188b7b2dc0249797a63842db6c73ebd5c708645b

      SHA256

      0505ac5b33d47dbc23397776ff192750de6ccfedf61f792bbcf1a1b7f6fe6953

      SHA512

      19a1dabb6c4009d970f483c5b861614542b85384088c18ef02460380875143542e4b1276c90318c16ba191c25d14b5e0b202a6ca8d0f94316097b4a6430a632e

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

      Filesize

      4.6MB

      MD5

      83d862bf8dc2ba70fd14f2a1b371c248

      SHA1

      a30800b879f1872be4079304f56b1d0811f54e0b

      SHA256

      1d72b8537b139e186c5c9225a17122db75fa78f1e267a8b9c5fa98ee300fe9cb

      SHA512

      867aadf3099f11422496ae0b80202bfcbabeef348215e8a4775dd0c1befa7daab8f0b068560958d026aeca181684c1880c82b2c956fc91c9dedd85ec24700b16

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

      Filesize

      4.6MB

      MD5

      7b1ce3c185c6511b2d5125ae383665c2

      SHA1

      0a4183b96b83e45061e39ddebd508277a09ff270

      SHA256

      9c9596d681b9c18027d5ee9f31ae7386cbca69c63cdc64c0753df0dba5459241

      SHA512

      803e8b9459b716fc14dae0901c90f1985fce2bee1fa713e9b0e678258399b0da60358673b13dfd403846ecc5523d07a5a31fb8c08bac88188725f87b5da76aee

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

      Filesize

      1.9MB

      MD5

      611e80ba8d3898ed0b4274697fb48980

      SHA1

      887f0b0a073b73f53e394c653fb911dd1419ec59

      SHA256

      4e2f32e6d2e68bc216a52cd2fc7db815348fb9390c07f27e309e4f79fdf9e885

      SHA512

      967ea5adaa800dd9a8923b811c6603bbaed4b5e3cb2c24a74ea0e99f6d280b10f1a2f3ebd564bbebd8c404b86294f7038a04456d89b4adb9a599a00de16e24af

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

      Filesize

      2.1MB

      MD5

      d4f16217789d6df58bbe3dc61b610e5e

      SHA1

      e596829598461bf661043b19b59355a400a8c603

      SHA256

      3e9f42b56137cdcf77e94942150ad9e11003b7452784bc6efaf92809f0fb33ec

      SHA512

      20da9470b9ea5ce0fef89724d8eb3df4acefed9f63cbf177db9f8c8d72acb5f1bf72c1b7cb0466bcf30a36f92cc2ca272b577477409e70ae2ff279fe6bdc1999

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

      Filesize

      1.8MB

      MD5

      f788e2ec236b364ebbd2d49dab610b79

      SHA1

      2d495d2c01325363a1ab34bc038c4dd8cd12ab2f

      SHA256

      a99c0661aad481ce85d605ec4208d675b3953db19d22e6484c0696d40879f8df

      SHA512

      0cc7e1719c50bdc768f5e454e14dbb59640d76eeb12c4eb242599370a4326de900e13edcac6d5120d8d44e5d25aee1bc7218385200acce57366837433d44df0d

    • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

      Filesize

      1.6MB

      MD5

      041bcef5cb68fa5dc90906831ca53b38

      SHA1

      6743b1a160597097ca7b2850f9265c4cc4f3a486

      SHA256

      34020fdf5c43fa3812bb52d2fd088a5529df76d756b9709ed95c9b4f9dedc2bf

      SHA512

      42e44190bb23373340c1aa48ffb5a21c754b311104cb447c2244dac32793dd9637014058d783756abad1caf6436c436365f46417652bc6d300ce1600ff2bb316

    • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

      Filesize

      1.2MB

      MD5

      3909ebd3e5430f672d802700dd73537f

      SHA1

      08c98ede98d9be50e62bfd2c5aa0c9bb73a034ba

      SHA256

      615870315bdddd9042567fa8161568a30fc1a2ee999c900ec9a05e2c651ff3cc

      SHA512

      423ef8d8824a0ba7cc35f8440add31b83db55e737646675e8116c7e194a4c7144d1a1d85d3ee5f80e6de16af2e7863ca7f006140f94b88fffa11620d70ac889a

    • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

      Filesize

      1.2MB

      MD5

      904b640657fef4dd7a823d514046d935

      SHA1

      c4a4a460702c27f77f54676f8c23935942713486

      SHA256

      c26d362fe50187019830f13a2fbaea5af41e8793fe42bb687812324ebbc8537b

      SHA512

      3d7bcab02b61be6507ad8844252b2e775e744e2794528808dba0e0794248fe9dec8987e9abcce0557ce3a5717f56068420e62bbeb04ab4ce6657fc870154c8c5

    • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

      Filesize

      1.2MB

      MD5

      83cf600ec02fd4917e515567c8aabfbb

      SHA1

      e9ea51277445a5cc4923e7db887f2ce46816c758

      SHA256

      99af7043f205c29e276d74c398ececa955887b9214afd83dab88675f22873f38

      SHA512

      24255ad768dda29e4312af180895121bcd7c6cae4e7dc73c4dd12bfb4952c7d60061049b0492788e23f06e7fdc32a61419b65794c1979c5a59aa596165944f83

    • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

      Filesize

      1.2MB

      MD5

      cdd35265197bca5187d628774833e923

      SHA1

      63d59c886d137a9a5dd6961ec1e7418271b827b1

      SHA256

      3b26ffa462da9deb003fa24764d53e001f8471bad3d9358184cc46fd763eca88

      SHA512

      3ffc7d57718bd20d7cb8b1a57ad3a12e1c37665ecaf8686510c4126751d644bbb1d73737ee08579992414adde83cb66071ab4ae43c91203d23a04a726abc5b40

    • C:\Program Files\Java\jdk-1.8\bin\jar.exe

      Filesize

      1.2MB

      MD5

      254e6206cbf6a7a141aa27ec18c01c95

      SHA1

      ddbd68e18837edf73482c76f711c218b0e91b233

      SHA256

      18f3fca8a58167bb1bd6515dd25e6ca6902c3f01175ca4aa19115b3de6fb76a1

      SHA512

      580b51ff3ec685eee95e7e2869cdafcb13037574a0d979423c815fc83a5ce02032c9677decce946b2da6b5559f79a2420f604f9a76a4f66549ea84c7843a4f4e

    • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

      Filesize

      1.2MB

      MD5

      896f07390ad84ae23cd8b50bcead9af9

      SHA1

      97e4da7f56856f2b4266ca252add2a710d57008d

      SHA256

      8a01e4c519bc9e7209fcd135d06ed74c85d7ffe41ba3d439df5a2e6da49300c5

      SHA512

      8e25cab7d9184d2fcb3e752e8d7b331c0e785b82333cfcab1ca7db57bfc1eb6aa4e4841b6719e9820c43e86f2146a8272d4a419839c3c0b3ecf3ba041dbd3fc6

    • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

      Filesize

      1.2MB

      MD5

      d1bc886f1abc787409d5ab43842e2136

      SHA1

      f07e9bcfd7837ea5aeb1d00aea94290e16264592

      SHA256

      93610faaf33372ebe29cdfaa0976bdea2d7605ff67891b664949439706e24f7e

      SHA512

      5037452d3f420ae1d72358ca1d34d1e935939eb9b91048ff944b973f6a5dc05a5b834dfe9526f4ef0b30bf2256d6fbcb69ade64da911973affb8721417748f60

    • C:\Program Files\Java\jdk-1.8\bin\java.exe

      Filesize

      1.4MB

      MD5

      c3a1e2a5c6da7edd8a3c0f97c1168823

      SHA1

      e65f51a5528443ba861976a6d513afb024859772

      SHA256

      54ac63342ecda834796729d601918279dac40c22234f0cbc982ea635c596920d

      SHA512

      7160a27b2208db72182c303a732ba9b065b1015265b00c119f757048b87db488aa8ec42dc9e70a759b69bf07ed3f4d92d0527ed1c2078ddc00886e96619d27c4

    • C:\Program Files\Java\jdk-1.8\bin\javac.exe

      Filesize

      1.2MB

      MD5

      8bd72ba643e0558a25feddec9ac0363c

      SHA1

      636352633a8695a6a242ad20c03f7bb56e798a49

      SHA256

      b4f078a10c6843e8849e2e54eb403b88307b131a133c5b0d59773363e10e9374

      SHA512

      1ee8ef0a66e8f5875f8dcf497061353c767fc9eda71775ae5409e51664d4e3b1f8ab9da8747675106607d615c41f19043223407f1b5377f4b0a97b213a384e81

    • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

      Filesize

      1.2MB

      MD5

      d84e9498b55ed0c55bda8b12d4334b46

      SHA1

      e1a9ecc5bf38ae51d12cf86ada61c5cc6c357ab0

      SHA256

      17f4a84393def95bea8897d6601c5e7678554a4bbfe6562e27ad90b96764f105

      SHA512

      ffe89821c93c24b8809b0a8f59061f809c49e30533ef774debda8b599a18d6cf59e215eac1c514d9336cc72818c58b6824177ac84b5f23927fba634cdcbf0f64

    • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

      Filesize

      1.3MB

      MD5

      321a1e06da78e637cb50e82a12c2833b

      SHA1

      ceedd66bb562609fe8bfb224f5d9499873bf65d4

      SHA256

      217ea21f0d1fbd96f9597bb544575a5b8c5c661f8326c8107ac6cf19d08bfe52

      SHA512

      bb3e8c5d0dff9a9ac411af71c21522304398f1720d350a06f2ee68ff437d89a1aa29b7f4f96383813dd7b6416e361f3a1f8aa6ef7ea698943aed097b1c978f39

    • C:\Program Files\Java\jdk-1.8\bin\javah.exe

      Filesize

      1.2MB

      MD5

      be4db638bcd94e3b8717706bf01400fa

      SHA1

      f086a92d32e9ac97916f52cdd7c101aee8b62ffc

      SHA256

      3c6a7d06bdcbab96fb727ad883eb02011e18591d4441663735614903fcd5ec9d

      SHA512

      3226adcb64d7e73b763a236c200263d0402b25c1d7f1009c20beec58b8f2644a9201bf2000ecb89d351484464121893d5cd1552b37380ade276aed816a5ebeef

    • C:\Program Files\Java\jdk-1.8\bin\javap.exe

      Filesize

      1.2MB

      MD5

      feafc81876b60c9e130b6c7c36b3637f

      SHA1

      afa3d91ad490c1a39c2aab0123ebd6ebe1f0ee0f

      SHA256

      615718721993d7dcac821722b241729bde9ef12bb075831c611f09136017e225

      SHA512

      19f16c7f587afbc79b8e53a9758713e8cd583148619d70690cf1ea36d0fe457c65087102847bb94d228e0d28e8d300a255b01d4d2dbd8dbafeda580bc6449979

    • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

      Filesize

      1.3MB

      MD5

      8130526f83c25f565c26469f80903429

      SHA1

      7d48bebfbdce09c549fcee523db6154375d2cb53

      SHA256

      3a126b3dd9d5e7aa37307873a13bf2cc220d0cd5991c6779492c371cebec8544

      SHA512

      4ba9befca16a6b4bf18c7709d7f9219d19177badd1a5072b05a2e4f6714b29f13934b6061a4f8a31c412bdb8463614345f762e8da45aa31fea8b185d2838b620

    • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

      Filesize

      1.4MB

      MD5

      724a16582682ed1a51060a0325042603

      SHA1

      b2365aa63d004a897bd87a6a35963a5505c7623d

      SHA256

      1d4030ad8eb870d3d6dbecdab08e13667ddbbb6cc6d430161423fbf6dc310a20

      SHA512

      14817d2875fc60c208ca7c4df21b4766ef0091bd731192a371b253f1e57e399bf913096544072cacbb41e31635f25fd4556ae44a13a4e30398e30defe94856a7

    • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

      Filesize

      1.6MB

      MD5

      b337f592f257e982852e5dd51da592c1

      SHA1

      d612b6db2fc7aa7d58bcf2f0c28a2a4c7e81186a

      SHA256

      e8956bee6d37ebe5387c0be13ef13893e5e912d6571fcb4aa76fe2e9745a2b70

      SHA512

      69552d4e4c040d91b06a68d74d48ac4d8e655ec4ef898236f75a82e702b0a769f5df9d4da04cf2f30b94826197a4528890be0a71163d35348ece56e0b15011e6

    • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

      Filesize

      1.2MB

      MD5

      687cf8459044cc2c1f3b11d7323967ea

      SHA1

      c1c96cf528d273818f5f1eedf826352ed262b88e

      SHA256

      a280400a9d120f609e2c2c97c4f00309a675d843e830dcff389f14799591d955

      SHA512

      6618fe74cd29e931dacadb456c1dc0be010c692c688a6ebf52cb73ee37205bcdb54a487384b98efcb6a658994ab1de0c4bdea4cfd176cd88840de1d7434de84c

    • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

      Filesize

      1.2MB

      MD5

      fcf3efcc58fb1336d03fc37affc5e45f

      SHA1

      8a89be9ff15612f52bc36e402e5a7c80a021bdbc

      SHA256

      8fa75e3d49ecbb5504215bb38a26d5e49f231a810ae1eedefac44fca925a722c

      SHA512

      f283f32267b9a613ebba068a0ce0d2916e42e3f0e5417733b4b8e070613393f939c0b4e3afd1f0a359f5edbb5b26d3f9aea2056705f78583b5cf83a34f545518

    • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

      Filesize

      1.2MB

      MD5

      92521b1f6a17e6099dfa2e686ed503b6

      SHA1

      bd2d863a29f1493f46342ee83e9b3249604fcf89

      SHA256

      67259309a4850615cd3c3c270e0f91fa9482cd24e9925623553ab1e5d5773b07

      SHA512

      c04f7cc90b92714b3019e14e091b1845246632fa52636a67158208cd86dc1dbab7fa99a9bc8319b35d830628f6532a6549c47a864a3a115711106c09859f46fe

    • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

      Filesize

      1.2MB

      MD5

      f822f96674b1de57d43c92b3305e4d1d

      SHA1

      91d53cbda4e2699ff35b5f71a31a3ce05f3492c0

      SHA256

      1f2c17059f90793bd545d3ef72b14bbeb798d5f0cd2557ef85a14fc23fe41a06

      SHA512

      91ef88a31e9c4ec708fa5d8c5efa7bdbe70ff881b9c952665cb642b1447b561871d8ccdd04281e3d24b381b5e31da04dd7e5c35e21599b113ef7862787bbe8c8

    • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

      Filesize

      1.2MB

      MD5

      f90a5211968815dde767de95b9475da5

      SHA1

      b6389eb64f35a42692939dd342f13ec4de99f27a

      SHA256

      ae740b357d558e0295bc7f46999bc1bd583c02d190c31295dfdfc5c07623c574

      SHA512

      5fe29883f4d97294d32bd36d898002e09565fb6c9d4d3a23de2a1f494346297164206976a4098b0d9bf80fe49599cb27b7ad2a0d7f96420d4e4390bfa289d7ea

    • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

      Filesize

      1.2MB

      MD5

      290b62cc027f4a97b56c53815737a804

      SHA1

      f2d513d0ae45c31f93e4457d4c33500a2b75d9f2

      SHA256

      4cc33b20adc2dfe27a4b4ad9e25eab6f19187a8e3823718326dbfc105b28595d

      SHA512

      fccab24d1fbfa970fc0474e01f5786923f4d4c8746bd25c3c1ed375b22eb4cb97f9d411a3d6eb02b3cd6a819e3a186654ad1e18fead4ad30e243a5bc129caef9

    • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

      Filesize

      1.2MB

      MD5

      613d688c6acb44f5d8ccfaf1500509ea

      SHA1

      76fe9d6d327fadc8ad4bade2c5ecf73f75aab96c

      SHA256

      cc46db9f5789dfc3c57daf0167fb767b1f4b516b957d14017b2d9a44d63801d1

      SHA512

      282a3ac71f1eeffaea55ae88a4b5b5c8626a60713975c48981e04276710a228ac9562b83790ce110c5a753a2db48914918d54054791d10119e9e7713bc50bfeb

    • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

      Filesize

      1.2MB

      MD5

      22cae9b4e615d442716d6c3b788603e8

      SHA1

      79b3bd9f12ee05690f6c58b8a766ed5516c3516b

      SHA256

      1a72b84090d6cb73befbb0b71c79cb84bae6b09e354fecb5e0c6fee0ee0afc7b

      SHA512

      e7338a53514b27323c6560cfa1b9886c84a4c04e45d212ea2db73de288f6d093aac76c103b096cd73d24a339a033e0ef3d8275a056de4385e5668e9b17edf02e

    • C:\Program Files\Java\jdk-1.8\bin\jps.exe

      Filesize

      1.2MB

      MD5

      67cd74a4ff327d2dc44ffbc2e20e5881

      SHA1

      62e3c4f3e14ad65b23311d1a921e98f93224aaa5

      SHA256

      b845e75ec24b1483b9a199d9acd5ac5f28702a157d0db659a8befd75cee779d2

      SHA512

      1d14b3ce7f8452b8c8d7b662f9a4095657e5850b231978d90f56771c14a0784c452ec6d9640792836136aaf3940c5811cc26589f406f9fc67bd7653f2a1f09bd

    • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

      Filesize

      1.2MB

      MD5

      7f3f4a02e08cd70952614968b7d4c0a3

      SHA1

      fd47a198789028020e4ffee168c7dccc45410358

      SHA256

      46a7ee8b1a46227609ed7d8c30f1c17eb3e78165a6f949ec144bc7c93e797e2e

      SHA512

      0e3fe92578835591e80928e84ca3da0fe0bbb2cea253c04f79ae4a9f16d6536ca1b861de08a6017ef3b5918185cf1344fe44ec414b5e3b3a3e39a925001d9bc7

    • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

      Filesize

      1.2MB

      MD5

      a26494f8bfb3112acd0f6b2c6505013d

      SHA1

      49307c6f695a35298a5aa26abe90eb3a6d8961d6

      SHA256

      a1a0975373a6054063c9433d6b4cda6f30c1dfc951b8837fd006fba321645c66

      SHA512

      4ce1957ad697e81a71088572ced756a162716c0a99ab0f5e6f339a968f8f879fe1d6872bbc361fb36ceb2792741ce98dd04bc79b98f6b336524d47bd8a9e51b5

    • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

      Filesize

      1.2MB

      MD5

      92690eb1e58cfa2601d174f506e78394

      SHA1

      b2f2d42975a7f7c76b7d906a05fe41424b494eb5

      SHA256

      06e28173ec5ee3452dd1c72bc1f984c0d5e4da4d680424c1cf625ea84c6313d3

      SHA512

      087568f0dd8c9ae73fe0a8917ea04e028b965dc475de72cec7dee5166937c314997e8f268f1de014256be49735aaf5b6d9654e1a1e8f82358fba8f04e7f28291

    • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

      Filesize

      1.2MB

      MD5

      51b03952a0b10356950a7e94d1da4b91

      SHA1

      ec55fb4cdba8ddab134e57253c0447bbf2de280f

      SHA256

      4b8c05a099ece18dd47cd4b371c29bef57c1e4c6403c8e5732b84acd136705b2

      SHA512

      a1e6ed145bb596536648c32beef6c3a124e19d6e202bf8eef0d813d59496a557d5b80a1f48bb33873e75b0c147ade9172829542b80098a7790a0cb0771495d6b

    • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

      Filesize

      1.2MB

      MD5

      9cf5df1b5e296a098ce5ca90247f5a60

      SHA1

      2a8472d449b622e869eeecbfd14e1967eb52610e

      SHA256

      6afabfbc99e43303ad67a153712765217c3dab1e03d410be5458bece135ce6ef

      SHA512

      77aa24474d1fe064eadc325bd80381ff71e09d5d71bebdf7b88483bd99db0b33c41eefe026630300658a3ba92662a4d4aadb3bd57c87e737895c2e9399b9be99

    • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

      Filesize

      1.2MB

      MD5

      1d849e85e82c06b39eda8705446f1377

      SHA1

      711654776d3583a02e34deadffbb1ef39725ff90

      SHA256

      3ce6032b51529f66e39536eb2b15f23f30d616afc0b187fb3b2b06bc9a63550e

      SHA512

      21ec12aca95a8c4898e2828f75d296f5d175acd774114911c7df0203c87fcd99af4a76ab257d75ecadf6059d8a38ad82d4d6d9379d8b08564748ce7a0970187f

    • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

      Filesize

      1.2MB

      MD5

      3c9719f3f7dbdde2017a729816ea5b1f

      SHA1

      2c44421685df0d1e6a0805e2b879f059a5693cf3

      SHA256

      c3f4177d1c3df55633922a56b36764e27a8c26cd8b52d98b8fe8ec5722cdf489

      SHA512

      70bc22e91185eb0b518a265c81e4e0b608b7ab0bd7cfeb5a9cf27a683448ae2c498b703b2eabbd6d745f86e8761b633146a0edca68ab91411696e209e85b664a

    • C:\Program Files\Java\jdk-1.8\bin\klist.exe

      Filesize

      1.2MB

      MD5

      a379b77c4f5cdb06d2ac28e74dc8f602

      SHA1

      d7766b1f4a1ab6169a3a6ecd2af4d12dfec34fe7

      SHA256

      45534d28c46c6dea8fd00d3c135d2afeb32a2a2da211068970db603daa0edc35

      SHA512

      817b62fa14c35c1a716daed1b3934104cd5c3457f90ea3bdba2aa7845ddaa562ddeedd7cea36ca80e81698e238f0aebee0fabc069c61b853b01791f82068b52a

    • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

      Filesize

      1.2MB

      MD5

      196289865e4a4443818f5765795522f3

      SHA1

      910ac10f5c5d5e4bbd488ed539870fdf4f146762

      SHA256

      dd3d9558c412e34fff9ee0eb4714543d98fd7166bfcdf5cd95006751a08e5b3d

      SHA512

      e7ab5c42b37e86b1a138ffcd61e741986fd6ef941696513cdba03a2292dbde5a1ff22eac8ac7b9bc60c5f2db463e81fbc9df681c983efb8765d83398c317ecc2

    • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

      Filesize

      1.2MB

      MD5

      79620e770bcc0b3d7e33d347b3a0b7a2

      SHA1

      a223127f81c8c763a745919e26cca7a111f51a9a

      SHA256

      917dd6e6366b8cf806fcdcff41fab228ea307d61e95413fe217d0e9749143a54

      SHA512

      7a99cc7283ffb0678f4f2fea11748f28a07e23289bb481b8d7b28f22903f7f2999e4a70ffea5c5fe1b1851fe1f03f2e4494b2442b347183886986cd8b9a59778

    • C:\Program Files\Java\jdk-1.8\bin\orbd.exe

      Filesize

      1.2MB

      MD5

      76d8c97a504cf20cf0e8c3f13921b8be

      SHA1

      9bf2f2a2c99993cf3c4a637f1c7a375d48fc983f

      SHA256

      e3a6c77df990b41530a40d67c02d7804e26f28adfccff1414e67ebac50263c8d

      SHA512

      30a89fb861099c9c73919382a8a88fcf69010f913e09c137f7fa77ad0b077f599ed9ce7edfe0b6af2ed9af9cfdda53bf8ced995b297bf7f9aa0395af242899d5

    • C:\Program Files\dotnet\dotnet.exe

      Filesize

      1.3MB

      MD5

      565d144a3edc33dd80ef2820f4d755c1

      SHA1

      fbbd66433b15e0687e98351ceb1db820f5a088e0

      SHA256

      c033c501350e4b6a22e4ceafa4873677e6066f400959d812cd18abd69a1a174c

      SHA512

      a6b88175f3bfc6b6e5629c68b53a342f3f686d80dff41c0d62c33c73a096091e012e3c4d2501168122ae13b6dd4352767a28ec71bacb125ccfa10e6fddf7f1c3

    • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

      Filesize

      1.3MB

      MD5

      6352c73672f6b0ca71a79fb28f25b060

      SHA1

      1425f5e8f3048d5097fc81b804e28d02793e5109

      SHA256

      7af58b9e041004acb1adced44fe2b0d130ca8970ccba055b0d72dc82a379a26e

      SHA512

      b7b873b9359d1545b574f9a122f4b0ffd520fc44c947817d2b0279c55cd2758e4a4fd405e891d8bef282607261c027e864b55990761633c6acb8b208f663129c

    • C:\Windows\System32\FXSSVC.exe

      Filesize

      1.2MB

      MD5

      0d73a39a00aeb210fceb981248106f66

      SHA1

      d1045fad6e831e67f330c28fd39d365f5e90d113

      SHA256

      14da58513ab23c95248ee65ff69f3d0d0e5d9fb9c5eacc29f8aa6ce28f85fb01

      SHA512

      e3971e74fdb893965dd87d536dd424613b783ba9d182b72b0031b7ec327e3f259ec49702f295ff8a96b61867554db7f73969b6421ac24a9cee76c79942df91ac

    • C:\Windows\System32\alg.exe

      Filesize

      1.3MB

      MD5

      7b1d78be11a43be802074d4c93699681

      SHA1

      42818f72560d91441d2f1f87d1588b7e31dfd36f

      SHA256

      b6940242991de4ff50b4ab3e32c7bff4f0af3d866e76176ff8125ad70cf2d562

      SHA512

      9bed17992756eaa1ece5670af3efe6c5625cd3a1122464ccfa2798a32c3a978d7b2ba77f5021fa1607b4fc56c05a5f1ecdec39a846c309afc9cb2d6ef8462fa3

    • C:\Windows\System32\msdtc.exe

      Filesize

      1.3MB

      MD5

      b503afed6c6289ba9eae6e943e19a5f2

      SHA1

      4fda4b623f481847eb5726fe2e8f636cfb3e537d

      SHA256

      c4e16dd3873946f6c94bff421a73257dbf7c8ef294e84370a1831283a727ecba

      SHA512

      40b2d24091885fc6c89bc1b0646fcafe2f944d3225a7f5ac24f148a57740165787f9f4c18a18053f2ebc463bbaf5a95419fd41e3c4a8c12493763ba0c6ddc2c2

    • C:\Windows\system32\AppVClient.exe

      Filesize

      1.3MB

      MD5

      5f41e6ea940ac435e85fc673f1b61a6c

      SHA1

      cd9d5fc8348400e7631f1ca073974c114401040b

      SHA256

      b7f4f8ad690bb445f73f0af71d9caab79a35d9db1c2348484699814fd7ca792d

      SHA512

      f8c026ed206e5f896650503e0e74837e33f50222bc4ef564e8150eeaea17e1878d9a06d3ad07b46c843509dffcdf70b53618bd8cac9a45e5c48a6e850af7af7d

    • memory/584-40-0x0000000000940000-0x00000000009A0000-memory.dmp

      Filesize

      384KB

    • memory/584-38-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/584-60-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/584-61-0x0000000000940000-0x00000000009A0000-memory.dmp

      Filesize

      384KB

    • memory/584-45-0x0000000000940000-0x00000000009A0000-memory.dmp

      Filesize

      384KB

    • memory/664-86-0x0000000001A60000-0x0000000001AC0000-memory.dmp

      Filesize

      384KB

    • memory/664-97-0x0000000140000000-0x000000014020E000-memory.dmp

      Filesize

      2.1MB

    • memory/664-92-0x0000000001A60000-0x0000000001AC0000-memory.dmp

      Filesize

      384KB

    • memory/664-85-0x0000000140000000-0x000000014020E000-memory.dmp

      Filesize

      2.1MB

    • memory/2236-274-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2236-83-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2236-79-0x0000000000E30000-0x0000000000E97000-memory.dmp

      Filesize

      412KB

    • memory/2236-74-0x0000000000E30000-0x0000000000E97000-memory.dmp

      Filesize

      412KB

    • memory/2856-1-0x0000000001050000-0x00000000010B7000-memory.dmp

      Filesize

      412KB

    • memory/2856-8-0x0000000001050000-0x00000000010B7000-memory.dmp

      Filesize

      412KB

    • memory/2856-81-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2856-0-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2856-118-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/3804-115-0x0000000140000000-0x000000014020E000-memory.dmp

      Filesize

      2.1MB

    • memory/3804-275-0x0000000140000000-0x000000014020E000-memory.dmp

      Filesize

      2.1MB

    • memory/4000-19-0x0000000000720000-0x0000000000780000-memory.dmp

      Filesize

      384KB

    • memory/4000-20-0x0000000000720000-0x0000000000780000-memory.dmp

      Filesize

      384KB

    • memory/4000-18-0x0000000140000000-0x00000001401E9000-memory.dmp

      Filesize

      1.9MB

    • memory/4000-12-0x0000000000720000-0x0000000000780000-memory.dmp

      Filesize

      384KB

    • memory/4000-84-0x0000000140000000-0x00000001401E9000-memory.dmp

      Filesize

      1.9MB

    • memory/4372-26-0x0000000140000000-0x00000001401E8000-memory.dmp

      Filesize

      1.9MB

    • memory/4372-35-0x00000000006B0000-0x0000000000710000-memory.dmp

      Filesize

      384KB

    • memory/4372-27-0x00000000006B0000-0x0000000000710000-memory.dmp

      Filesize

      384KB

    • memory/4372-201-0x0000000140000000-0x00000001401E8000-memory.dmp

      Filesize

      1.9MB

    • memory/4532-272-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/4532-49-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/4532-56-0x0000000000C50000-0x0000000000CB0000-memory.dmp

      Filesize

      384KB

    • memory/4532-50-0x0000000000C50000-0x0000000000CB0000-memory.dmp

      Filesize

      384KB

    • memory/5112-273-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/5112-71-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/5112-70-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/5112-64-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB