Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 13:03

General

  • Target

    2024-12-22_8e995f2fae37aad7fd76e1a0ad183136_wannacry.exe

  • Size

    5.0MB

  • MD5

    8e995f2fae37aad7fd76e1a0ad183136

  • SHA1

    c46f47469dad3f5414b061104c45c2f646a88606

  • SHA256

    aa4e188dc622e1611a14572be6b9f78e8fd5a7c3318b0c97fd8084a7bb6f99e6

  • SHA512

    042993e54a28e12f6543a3f37fefa71e256fe1d5a8c24d526cd72ab192dbbffabc202fd4e5660feb5be69d833f1d21c79ede121208193c7ac664d3c7e833b8bb

  • SSDEEP

    98304:VDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8qAVp2HfD2aKRN2sKgmmh:VDqPe1Cxcxk3ZAEUadzR8qc4Hb2a8GI

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (3262) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 14 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-22_8e995f2fae37aad7fd76e1a0ad183136_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-22_8e995f2fae37aad7fd76e1a0ad183136_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2180
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:4840
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3596
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1968
  • C:\Users\Admin\AppData\Local\Temp\2024-12-22_8e995f2fae37aad7fd76e1a0ad183136_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp\2024-12-22_8e995f2fae37aad7fd76e1a0ad183136_wannacry.exe -m security
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:3508
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3980
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1844
    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2536
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2912
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:1848
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:1376
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1236

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

      Filesize

      2.1MB

      MD5

      8fa75cbedc292aaa4ff0c372821ad50d

      SHA1

      93beea39327dd824c0630476592831374a2eb61b

      SHA256

      0aea2ecf9a204ad882c680970df0bbebdde37f7d873e775550699224a8944b12

      SHA512

      bd8cc05787d3e1a90c6523ce5713d54d90b9a9c802c3c233765ca3063bcbea5f8d24feba8d55c8032015807fba549ae44f102bd30fa2ee39ad5962067a487c0c

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      1.4MB

      MD5

      32ca640e3973891d3ae3138ed4e772f3

      SHA1

      241143772e7b1462512940d6c496a2f620556749

      SHA256

      2591c00770239695f7d6875b622dfa917a542540ffa70be33d153e5d8262b644

      SHA512

      b4125d172e0dfd1ed794880dd53e7ea2d86fa3a93d2405bab7eb721de7aa4714fab5f4fa306821affa4175e6ee9e3ade9f816c8c4894a1b803b9c91d431a7f73

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      1.7MB

      MD5

      5649065c67a9288db892683095221786

      SHA1

      a3ba92165ce038f4159fe2a0e6f204c7520cbb76

      SHA256

      7d10000641fede8cb074f01e8b72b4cbec5a0ad391ad993898cb2d9d24760bff

      SHA512

      57bd583e3fc2880f44d4369d09f7673e9e79d3a3d5744164eb90d03e392cc0adc48bcbaa424eb9fdeff65198effcb014addce34c30c8cb561864bcb60c504c77

    • C:\Program Files\7-Zip\7zFM.exe

      Filesize

      1.5MB

      MD5

      8138a76f6da718fd588590b0144e895a

      SHA1

      f549a9cc8f307b0f1a67b0de040c890ba72918c2

      SHA256

      3f55248727684941040a4cfea4dce3518a87f03af102fa4b46dd51904c32b40b

      SHA512

      eeb29304b1d16b203196b56a2fa3a7f2136edbf94e7082914b403ecf9815f6bd37ab5f1a5acb714bf651d6c8a476d3cac9e9b64b3030534fe5d4d815444dddd3

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      1.2MB

      MD5

      6a956957023b151b81c6747472e89630

      SHA1

      797b2d1431319993aa1d38bf9b7d51887e35d55c

      SHA256

      f74a2b740ce0ce2471ca01b6443b8f1f836346149c579c83ade36d5afc0ccfb9

      SHA512

      672fdd7635f297585b97f71672c5883d0ba5da9ea3a782f58c8d0e0b9ef90598c9d0854e8e59d277a20fb36f48a4be7f4822766dcb8c01ca01ff72029b4c253e

    • C:\Program Files\7-Zip\Uninstall.exe

      Filesize

      1.2MB

      MD5

      cd04efef4846ddcecea091d16a1ed305

      SHA1

      9fbaeb2fdd1946b702f2777dc8ddb07f76714abe

      SHA256

      c1cedbcf6fb6ff800005f4d3d9e4725492aeecc573a99b05a1e7547b0df62755

      SHA512

      b4c39d241e9f1e2bed2385c503518674bf9b3ec635da278a9b561844ab06f0a7e3b3165bf89c355817b57c1d2c34809e1f04a3d9c4677bfe66d5a7dfc1407b82

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

      Filesize

      1.4MB

      MD5

      b1b32d6952eb89790e5d32692852394e

      SHA1

      be32ddb702553299704b51dbca62766d28b79f4f

      SHA256

      8e3af32f94f30ee0f38e76fcc64e8fdfff307bf7d2037dbb0d04d88ea785c90d

      SHA512

      cf07670692dd832c6fa0af23c66ecdd4c8e04d86bc37c05955852dd7a0568ba9517393e49604a8f2a9c53f57b6d2c246e36c80f115aef0ad1411b05644b53759

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

      Filesize

      4.6MB

      MD5

      b30d560d8ef4a4ae41fd7291d83bb63c

      SHA1

      df27c70d46277dc36bbf42588855fb8910d2fde6

      SHA256

      4a23ac0dc2ab0737e8eb346928be31a2058b86fb610dce2080d1b59172e58240

      SHA512

      6284cf2458fcaa91dd7256603d6db68a7382b81b3148987789067bfca59dcc9d77e5f2c37d672a4731c3bb088630b5c1e2bb9bfc343b25cf9fad9e58c16d2c10

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

      Filesize

      1.5MB

      MD5

      366d2999f689382a73d5969a8633c6ab

      SHA1

      7d40ec99f0c101b6e49e815ec2d09c4a26eefc01

      SHA256

      85ce0c1e7fc8dc004d47256d4a3ee92c4f40f90d71e534aba11f93746be1540b

      SHA512

      668262490b1eded51e5019b9ab20e064586f719f1d800752fdac2440363b1fad3c7495b238e844b40034f18b9fab5a0278a09409965d7b9b3cb4b06e0b15a32a

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

      Filesize

      24.0MB

      MD5

      8b68c936877d14e6f08d479abba06e9e

      SHA1

      7aad38047e233cf1a84942c92e7d86ff8238e0ad

      SHA256

      4719e28b2bc6510f5a45591a1af72715422200af9ba5ed3ab15d317a38f99846

      SHA512

      b44b40c22407d2656504cd70f6df6c3403bd89bc3bf0543e88b6f56c427e672df2da8d67eb368634c9a3ac05356c3e5f5d051fff32d7eb69f2765eb35f0d0cd6

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

      Filesize

      2.7MB

      MD5

      682740d55d14cc173500d579ed5ea981

      SHA1

      12be8d9fa8e380200d36909da4331c09c07d1565

      SHA256

      553bc4660c046359515f1028c6a7e2eea713b57187e8deaa9b99c2f7824c5f38

      SHA512

      5a8207d4e4150c4ccf295d6bcdd35123d60551e35e20209bed9fe233c9ff78b8d028d22275f74c49a4337af216eca8aa08ddcfb30ff980da8730eba05c14e0d6

    • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

      Filesize

      1.1MB

      MD5

      cf4f708191ee0d79dc65d6a3d1c7a923

      SHA1

      2a624a03a1a06ee32dbb853f3387d751b082a94d

      SHA256

      69bfbb52e342ab3f59a8d3da46c4ff8f16fd6a1b042c5c96328c20c1e3e6e54e

      SHA512

      c043c104a6cbf017a2e30e104eea0573e42dbfcc541afc74471d6eccb3ba74393c19b9ca41c363acb190e0b0ab715bba2dd07c2979043ddefaa7d198fb96ea5a

    • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      1.4MB

      MD5

      1f5418f7626775ffabd162a4f8d0ed9e

      SHA1

      50c25c0a9c4b9e350d869258a2c4ce795745745d

      SHA256

      b191461eff4328a343d7bc1b4765500bd939efc9407c275a21aee839baa32e42

      SHA512

      d8951f05e503d81d88bc5b925a13f6d49a7a2c08ec040c65ac4ccefbbd311d5b144c4f10257262e7158370f23c3682cb5d0526dd65ecc6835c20a2dcaa363521

    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

      Filesize

      1.3MB

      MD5

      cb0de3d5637abf43d64cad7c67f12b62

      SHA1

      2d6a4ff4744193465d496582f12dd450e9986484

      SHA256

      e47e2144d969a63c7c4c8f8760dfdd8b8e292c1caae2094a2c665bf7cbf6a845

      SHA512

      d6626b2eabc23c6184e86d7421e52c3400d74f2885b7f9d23643bcb10a1dc74af42f551f6dd4a72f6372be5334ec222d7491b37562d9503ecd2a4908bb0bbc9e

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

      Filesize

      4.6MB

      MD5

      1f4f514c8dec96526527a41feb1147a0

      SHA1

      90b4f9a26aa2361b53297d6443724365eae6a342

      SHA256

      15372cc73ed8b6204d4c3919530d7864e4451d179a9e320601fb432395d7cd66

      SHA512

      3c83d7b6ac0160fe9ef1ff4d9a16f9add50a33e847839faa2402da90d1f76fe5c0fef07dd3a87cdbbe55f9ed9d68527480ee700970058de53d0ae8ce6fa3ac8f

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

      Filesize

      4.6MB

      MD5

      6a45a50a9750d1bda01933d1c3978e36

      SHA1

      df7dec321b6144a98958063e78c8f58578ace994

      SHA256

      14cfbdcbd810390f674342390a30873d7a8f492d5caec5eac8fca7c615c57dad

      SHA512

      c3dc7de42e901e9cc55253c9a3407ac0c6a962a45dbfed0b575a1cd8f14fb36ecc0a614904011be82db73bdb2358f29d24525665cb05d17a6aa4da7ed4841088

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

      Filesize

      1.9MB

      MD5

      ad6da34c23e02c51b94c3e9c76e76fdd

      SHA1

      592c008b38bd47e08c15ee3b38ee4b01bc9d8f27

      SHA256

      328608f47ec264dbd8ba15e70e5900b68f553c4a06d2d9b4aca9610853f80b5b

      SHA512

      efdbde189ac9814f27837c7012e4068deb0d447bd1e77b69125bf88e699c901869f6e40e375b39c8f84caa873d9170828c72b6dba88c6d4e9c646134aca96a38

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

      Filesize

      2.1MB

      MD5

      281f0991633957b4fd201a6b426366cf

      SHA1

      b383b03f594fdfe81b6b2a99e21ff11b371cd2e8

      SHA256

      339f921192eb9053f4274e987d42e7008d1ff8c600a6a5598be1cac9929e0a79

      SHA512

      69cf19ce37430fe24fc4452d31b1134932b7ec4dbcaa6a9be1bbb0328ea7a1d9673fd9a6887484decc77ae01cfec587b1580e68a518d5ead39730d2e87fbe5fd

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

      Filesize

      1.8MB

      MD5

      b0a8cdf5db6f1a089322ab966ce4219f

      SHA1

      80f9543618ba2cf5d1fd0f9e87f0248ba35454e1

      SHA256

      7ba8bd35489eb6b18c1cc8a7f0145a9af666620e9b5caea4e8708b67c234b127

      SHA512

      838ba0011a424ee65cb68cf4367689d364684455cf7ae140733967c5d4600eea0011031853e7855ab3e8b15ba626066b371340cf057b279014f117e2011ac553

    • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

      Filesize

      1.6MB

      MD5

      44f028433c79b2b5eaf8f3fd3898e22f

      SHA1

      dfa1f7fd2b377bdd7537fe6cb8352d40614b1d60

      SHA256

      1a373a1a9e612ffd55c7ac5cb78d17acdde705832aeb604ea983d72ad1f2ba2c

      SHA512

      54d338092b06269b131d9a7a24edcf995b65d48a237f58621ede6c877f70c6d4015ee7ea74fd27eca3bdb2d397e21ad3a9287188b022b4ad24cba6b3466bfeec

    • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

      Filesize

      1.2MB

      MD5

      54f96e5cefd6de5685e44cdf60c718db

      SHA1

      12d2dc82b984ee6938d8770747e0c16fbeb1867d

      SHA256

      6ab3dc456ae155380c154c75793a51568fcf736024368c1b46e15f5661845ffa

      SHA512

      c0c7f53a69edf27dc05efe6099e84d5c8305586c88b87db3cec7908f64f397c122e5f5b6c8e332ab5d6521ea441b1ccc37132a099034455d670662ec3fa85f05

    • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

      Filesize

      1.2MB

      MD5

      569579aeb3ca56e519da52e22cb61f0a

      SHA1

      0417dac84b150ca6ab8d9e483097bab481ddb6b2

      SHA256

      b99d158df0c60dbce85a48ee16f049d9e890d37c54810023085330fd719b1b82

      SHA512

      9535c04e2097184e3cabca057b8243cfdc89bcb53f05003d4ac5b209021cbb2af1e6e2908a1215ce09c55e79cab56578a1774d600420ccaa47b7ea95adc07b49

    • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

      Filesize

      1.2MB

      MD5

      851fb6d8d7eeda3b3ed1495e206cd502

      SHA1

      b6a495e77d13323a0d8f523732bdf8a98b220e07

      SHA256

      d860e1c03428d32cf8ebf6924e098012404493ee8274c3c3cbff48cda18195b5

      SHA512

      10ed62b597801fd527a9fd808510d6c15dcc06caaaba8ebbc49fc586ae774c4ac671ef8af4f4c0fe2bf60998a1c6906584a56fe4189049cda004430d94fa18e3

    • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

      Filesize

      1.2MB

      MD5

      e486c0c2ffbafb7b8fb3b3cb3bd6593f

      SHA1

      49726321ceccb61daf1d9dbd72f35511e964b55b

      SHA256

      c533855d7453a15c5f897248d479b6ab021a62463de844c238081f99ced7ac74

      SHA512

      6304b735223703851e64cdc7111f84a33e918adb206216315cd8ca1d8cb249524f061dc0bef8c1e84e4e3f3b5da55b70b8db23966966098979e654f1653b42f7

    • C:\Program Files\Java\jdk-1.8\bin\jar.exe

      Filesize

      1.2MB

      MD5

      292fe002be09c66ffedec5f7026b34ed

      SHA1

      0aa08497ef37cec1558f29f7c02cba4c73448d54

      SHA256

      6c5feb59e016a3cb923e778a8a5503cb5a3cb3d644f78ee9ea24ba600ca40f80

      SHA512

      f86672c19933547b5ec4141c72c95703eb33c8ef353efaeb24927ff54ecc89f2723a25b57bc5005b2ba9384f230e7aa538cf6a2f5a76e1c3e36580c82a7a8390

    • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

      Filesize

      1.2MB

      MD5

      e4e87539760b4c115cecf4de12ce0baa

      SHA1

      f3eebbd196422144ef3bdd6e37853c6746167663

      SHA256

      6285e3fc8acdb78ea554ca8e4075fc2c913a9ab2f71ffb00fbcb100d1b2d769d

      SHA512

      9f095ccaf79b25d53c0c0a2363951eca036adf7a9a6aa1239c4fe226f51b34dea2ba864d47b76a5033c4028d075233e826b0bf08d0dfa939b534cc58544a836c

    • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

      Filesize

      1.2MB

      MD5

      06d5ded97f5872880f9d7aa781110307

      SHA1

      1c3cb3d4d80612cbece9e2770e5dfe47b0ad2bba

      SHA256

      30f4593838ff0ad427047d2411872649430f26bd473bcee7ab266d8d32a92660

      SHA512

      96a453785a392f3d8b8a52465e99e73c3343d68543de67dbdc200c8f0cfdb98c937e5b9e84bea528a1513f345976a116f49a9594577fb38a3e8a43d04e8f513d

    • C:\Program Files\Java\jdk-1.8\bin\java.exe

      Filesize

      1.4MB

      MD5

      dc8519dbf950ba015e0f02d462476b27

      SHA1

      cfee2af4128050c992ef694019e04c978f1f50c0

      SHA256

      e0e0b99798b61a8150a45b1642726f313a91abd76400cc7c290bd1ddf057ee2d

      SHA512

      76a02964ceef7b8bc91cd54cc342a77e16d675762cf2d384c238592ed48f68bb866906bbec5f0064931f7a4b11273b21a9e5b21ba83134265338dfeb1a6ab846

    • C:\Program Files\Java\jdk-1.8\bin\javac.exe

      Filesize

      1.2MB

      MD5

      17f488ee98bcbd486e6ab9139fc001bd

      SHA1

      ec6ca98832fb64adbdc72febd32fc33fd17e0fff

      SHA256

      f3224f48e20d9cc4ebe4c91aa4914267334cdbe52c432eeb49becd4778343f6e

      SHA512

      2ac46f9b4ad13c2ef06dc92f00542a18b0e688697992514574d63e3886d749d8dd4b3bd5aa0c071728815edb5f58ae54ef37b0b9616946025dd54537182447c0

    • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

      Filesize

      1.2MB

      MD5

      236b61314db31f895abe92948b00843d

      SHA1

      460ce04129d9dd80e5fab0a55a14666f5acf650e

      SHA256

      7aaa9d524d43a9169b64e9795b7df0a6e775e0498eb69211f3fea4dfe328a160

      SHA512

      704171d5ce37afdc9ea22b8ab17e9b2f4b3eaeffe83a310f048d4912675ced0447b309873624a617859dd735301da12a8f8274694ff8e1987bd313328e403e7b

    • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

      Filesize

      1.3MB

      MD5

      600dbc161129e0ab098cc6bb59a25566

      SHA1

      99c070a6c9454832e3906ed193a6f44f89e03ca3

      SHA256

      de584db0e55eed6634ae2f90795c9325991c500c9fa437373c8f1a4c3db885f0

      SHA512

      42f7dce06342834c247af3eab3e7be9888058e7af12c4d24f900f8440e6cc2f2dd29e38749e56a2f7dd6582474a8cd07f3af6ea28adf0b3abe549f2fd4f0987c

    • C:\Program Files\Java\jdk-1.8\bin\javah.exe

      Filesize

      1.2MB

      MD5

      3697e3154a9de7cfcf05d7b9074feea0

      SHA1

      1a08715456fa11a8db649ec3ca21b37ddfcb0335

      SHA256

      a0e72c66380bb48fc538af8a1132d38345f992b489f3780ce7c1e019058c0cee

      SHA512

      114faf5ac2e93f9b0c72878759dbf483ab37d48b98f751a9ce3ebac16c6694b027ac816434328102896d224c6afb2bce7b4b27f73d94e28675a6c36f57d3933f

    • C:\Program Files\Java\jdk-1.8\bin\javap.exe

      Filesize

      1.2MB

      MD5

      af038484a6e0bcb5859f66e1f8675afa

      SHA1

      d346b4fcbb13e195ef6c904bcfabb45766753cf0

      SHA256

      5cf801b769868eb10fa95ba587318c70bf874715e9808364396174f1751ff1a2

      SHA512

      bdc837d290ac8b742d7b475141f61fdc3d58cd1a4900053404b7c92dfefb15b2c5b6e2daf8cd67c01ffb4c11c035b5d95ba882d83010129722831e31044bc7d5

    • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

      Filesize

      1.3MB

      MD5

      25cbab50eb12eecce7528790f8c827cc

      SHA1

      ae9826992ebfbfcd508b88a5b2953cd9f7c024c1

      SHA256

      6c9cfed7ee81febccb4f7ffb6708d549cc301fd6f5344f77a4f00c854346ddf7

      SHA512

      887d3f16b10e3cfbddbb143145694bbbd9719e82bdf511311b3cf054666cbf2108f40d538ad320ffe62d53163eb616caeee124be2e667e3a232c4b058a42b561

    • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

      Filesize

      1.4MB

      MD5

      f8c2985aaed99b63d79d78382736adda

      SHA1

      33d78fa7b1d3af6c9eb784eb969938688a9d4a30

      SHA256

      42e4c4e868e46d09a0db9885ce4caaed37af0da94a9225c85ee5399d145bfa8e

      SHA512

      b08af413a79370ec1b17e3914083b737ceb5c3bc1d6a1fca337c7da89508dd384b3eab5f40d3e8be832ed2c46deb501f99d78c895853dde2b63d2347ad606d4e

    • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

      Filesize

      1.6MB

      MD5

      0e14194400aed789449c96b2df1effe2

      SHA1

      51dd65c7337ca7551fa51ce4b8fe30a97e278b0b

      SHA256

      2fd4dca3073622b70a80d911e52a747ba86bd7b361cf885c5bada75ffbe265ba

      SHA512

      b184c459dbe68fb178d914aa22f0d201e0e4b47aebdfaa9742ad24796a7e4331fdb583b7f5af7d91b1cc3eefd34bae3fd703d0ebc91e2e9c03192f8ec9a248cb

    • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

      Filesize

      1.2MB

      MD5

      8678ec630946cadd24cc9ebd973b55d7

      SHA1

      b60c492fed6229b84253881db0a96798494814e8

      SHA256

      3dfb2c95295e6d80fd81599f92a40d31ae31c3217f7fdf8e7b45c6be78222ec7

      SHA512

      b229f83b1d1a9009faac185dc0125c0ac66467c3008b3c4652778f16b76ad7bd744323cfa32d516c5ebe9f638787cd4aec4d48b2fe8dca57302cae2e3753db32

    • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

      Filesize

      1.2MB

      MD5

      bd6db75d0d12f706c9f40c326ef2e1f0

      SHA1

      fe530d86dfb0992a069c551cfaaf7bc066afc561

      SHA256

      8b88b91e9acaa068cf07ec212562f1a9938b6a734b713bceabb7e0799d69270a

      SHA512

      36809285815171aa42d16b915f52310f7092ac840ec913cec326c1c78d3773e047994cda0ae16ca1ee643a733ac0a1c583abfc67c2375f149a8ec7f1e5fe256c

    • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

      Filesize

      1.2MB

      MD5

      5de8f598e73dbd4b748e7ac135e502cc

      SHA1

      ea6bc3548acd90a5d9b436da73182ad6bf04ce3b

      SHA256

      577833ebf41bedac1d3e41d65fae74ac1f1113cd12c6b205f5cf532b7741e43d

      SHA512

      095f512fc1435485655d83e93f5e6f480caec2b8e48edae220f3e601de0f2f98fc70940920ab756fa14f44f554b7e12443204f66a5b0188a43c6bd3d95ed8c66

    • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

      Filesize

      1.2MB

      MD5

      4c567d51f1175671377fdee815df2046

      SHA1

      d59345b594f3a0908e49a193f651b65cd9b6152b

      SHA256

      29be63391248d1492749073c1807c9af6d0bda2ac101c783cf2be62c6bdc46e4

      SHA512

      edeb762858cc8727c91690ca30a061c304b25ce57e89b758987257be548c3374c1799b306fcce579c7c342f32ea539d0ea514fa739db4dd535e7ab6a021b8385

    • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

      Filesize

      1.2MB

      MD5

      52d55ba1d11042fbd0d8458451375e10

      SHA1

      0b03dbac3f6f0a01a8e48143c271af31908f1328

      SHA256

      8c16108670008d1568f23bcae047b4b22aa42714721ce347d04bae9301d3da63

      SHA512

      3be8ceb9405605e87f0672cefa88d83ae46a03bc165d32cbf208f16d6e4fa3350710b1141dd87834b192fb9c59e56b9ed7daf8e6757bd505d942c193c38e2f02

    • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

      Filesize

      1.2MB

      MD5

      193fe355df1216e73e60ca9de587017c

      SHA1

      7450836cc41a3df9e6aa238a5bb319c907bc691d

      SHA256

      22d54b4a76ae05f1cad683b6ea624b119e28b1c4a132faa8b6cbb453231961d9

      SHA512

      778d10bf8cc80f6a9c71fdf8620955fee8e4c30e4e9a838d0cf7f9afd3187d0ff1eed203e3faafa239cae810b756193bb59ba5568dae776602a4d897fc33384d

    • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

      Filesize

      1.2MB

      MD5

      89df28bdfc577f7a896e3f7986093603

      SHA1

      d83cbf0fbf005bd4f24456202840bc94befeb211

      SHA256

      010b133394cf1cfbe0062ffbd7cc21ce01df10b9ec15d3f7cacdf87df867a8ff

      SHA512

      494c8f7e3c00db29df11e2902de0f637af64f212ddfeff30a79ba95394f98d32c4303baa3561b41c7c284aa269c84d20c90a231b82b955c604ef1303d3abe3a1

    • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

      Filesize

      1.2MB

      MD5

      2a40441a46306129338ec16d6ed57997

      SHA1

      567991ec7c0e9027d155e45e0c2c53c1163645aa

      SHA256

      198799adc6fdd50cc1d48c9bd2a83d33de079d11cb0a36f6fd72de51fd71d25d

      SHA512

      f5f7f61e5e901368727c1083f31074259c85cd9dcb0bf61bdc9d7bb6f6fd12456b6c63f8c6a9497a6ad532aaa42c82b4ecea9cf20ee7af20f7b58fbd6f2482e6

    • C:\Program Files\Java\jdk-1.8\bin\jps.exe

      Filesize

      1.2MB

      MD5

      aaf4e1817b6030455e92efb932c56711

      SHA1

      177f5f9b5c8cdf27a5b6aece28f13fea7bdb1607

      SHA256

      da2868262832c8116539291b1e9b1d2f5380c2329aa389904cfc35a37a355054

      SHA512

      ce9981ebbd7b81edc539551d5e4cd5e5c70c98a0af409e917f44401e37932ebb2b806386ddd2f79555756c5c1b0bb192de7774f97d778bd87663e0d305451114

    • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

      Filesize

      1.2MB

      MD5

      cd09cbd0f2cce10b30481785ccdf4ab0

      SHA1

      d35a91b6d09c86b1fd835abf35f62d99846850d3

      SHA256

      d69c72f110d399a56ee964526cd2db22dc27753ae5a8de59aee969163a560ca7

      SHA512

      711765493dab8975402f59a05cbe56307071ab2c37c94142f3b4bcc797559874d33d6a1f0d5a173fbd965c6612f872130b116e1065efb03b146549b668f950aa

    • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

      Filesize

      1.2MB

      MD5

      74106310fd53961d38f468eae93e5820

      SHA1

      bf9c2d5ddb62668992eddc8220694253cbe20ed7

      SHA256

      ac8a158e7dc3593830e9ad30517fcd8833cb35392a800534a4c5eb98b014cb7c

      SHA512

      ed9dc60d5391cce83191da6651461d0fe832fca55be06b184661d58987f5b3e7ec86cefcbb49a8cbff6b51ea91f8ce79c2d5943c7321ff2ff51f5ccaf440fda3

    • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

      Filesize

      1.2MB

      MD5

      74e361a489cb9ddc0f7635c66a57221f

      SHA1

      56fbaa7ffe65dfbea852bcd1a7c46c4aaa863be2

      SHA256

      8176d2885df3c53371a735f39369504f147762412de219be37a3d5d268b28c65

      SHA512

      6f766b4e7b96d1f8ce976744cff18b89d206e0d07d81560894b8d02c896c0e39d78ce1f1d6abaa96db043662fc30286af33e5d5f0605f34d8d07a0b4e7a7a90a

    • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

      Filesize

      1.2MB

      MD5

      6346785955ceabecaf84063014a36b00

      SHA1

      9f7eb3eed6389d552aca4cd591ed5524120c47aa

      SHA256

      8d026fa59a117c0217169addf284a0b44063e88d0f17deff9f718d94a4ef3300

      SHA512

      a2aaf3b410932c1471fc613c7c26e9b859b7eaf4d8eec1906c4cf1e2278638bd222f6b599751e6ffd40ad8626902b2043800e816e57874b587bfe19e091a97a4

    • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

      Filesize

      1.2MB

      MD5

      514562de2b8831daf5a81070459abbfd

      SHA1

      9ba49863101dd78cff1af3983dce3b9fe17695f6

      SHA256

      93f82e9c37a576c00aa3a0541661dc6745f099bf538dbfb91acb8f98135a4f0a

      SHA512

      0de0c7a2bb317e6ba48a8c6ceb359af69549ddce131f9721cafebd8989e47a1e553a88882b61cfc76434e3605bdfa4efef84a44bd350d5b89f1dac816f55c1e1

    • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

      Filesize

      1.2MB

      MD5

      1ecd6e0756ba3b46c051db7289f817ad

      SHA1

      4d9ff07d5ae2eacb117676ee626fb4ae0e8f37f8

      SHA256

      bac25e78c04c8f1678ef0473adfad0f2c74c48124894512670b57f3fe37e63fe

      SHA512

      6c32308d93fe1229130bf46c07f6ebc1e240c651cabdcab63c30823d9aa9b2cb7bf0e0234c5a32fa930ee914c1d9806aa666c77fdc5c82c7e9a85c72dcfae141

    • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

      Filesize

      1.2MB

      MD5

      5c949836cc36282f99e9e6ffb1fd6c4d

      SHA1

      74a4f67822a7bda90d126eeaf1167b82808191ba

      SHA256

      bdce8a712bd87c0207979d0ed5ba05ca84ade8e9c43cc9845359c3f7613a7b9c

      SHA512

      dc292723468ae8603a137b09c3bbad0d4cd233fb191851750bc30d6d77436d916a57709db0d08499248fd864308a9723b229b004e2300febcd1d02fbedfa6e75

    • C:\Program Files\Java\jdk-1.8\bin\klist.exe

      Filesize

      1.2MB

      MD5

      eb36c56788236911346a9a29952e3327

      SHA1

      ca872529353d718221639927ac037b614a576a72

      SHA256

      4dcd4d8d38393fe0020f0fe220a462481e05d08bf73059e75fc9e1d81a0e39b3

      SHA512

      1daef79c64fd33458925bffc89a2d946f9f90411a3a7f264109e6e48d1a6df2ef05ae3387aeb973a55895161c887995016112f92941c2ef2bee6bf3ee4c744da

    • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

      Filesize

      1.2MB

      MD5

      8080ddda27962584ac2a0264ab3b0e53

      SHA1

      99f9beeef9db97388b85412767d498f1ed3a815e

      SHA256

      371a62eb32c4869a0f469b7c45ed45cd7982b8baa071d84167a55463e1201790

      SHA512

      3f0b3ca692e6dadebd1cb161942e31237c72328c4d99f2fed75bd682436ed0990a0c6fa6631735060f4199bcb0661c0cb28a8da607f0b21065474ecff9a47c84

    • C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

      Filesize

      1.2MB

      MD5

      c302a4fa4ee913f6afb0f73dbca82302

      SHA1

      8946976e1464b8d4505a596cdfd86feecc521389

      SHA256

      c8c2637eeebf94ba7c1c1e72bf7419526537e44f7ad4a502aee91fc63ef9d689

      SHA512

      b63b24b2f8f7d8f0f3a19bed28b4f021bed4704784db6a719cf1b99201e88e80db9113154f3f940635ae39df86a163f2d4105b7406c91fb16e4994c934b16bfa

    • C:\Program Files\dotnet\dotnet.exe

      Filesize

      1.3MB

      MD5

      4782bbda607efe36297454a096dbb912

      SHA1

      e44a1be3d5972e10856665de85737775efeb962d

      SHA256

      84c390dbf0900841acba100590f41d7c09d698a8abd3e31a3dd3ea88de6c985d

      SHA512

      75bac2e7d4c8351c06a42ee3972af8d3a5de66d2756d45844bac4a107cdca81020dcd07306a77a32f22c6c9fb92133e8b30fc4214c06b30a99175a91d8f2c007

    • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

      Filesize

      1.3MB

      MD5

      25756ad3d7072586f937b4ab778eeb9b

      SHA1

      0fca9daad957aae787706ec3d1d77ee5f75d3615

      SHA256

      930f36351da6003c22561a822700ccfd7b5bce68107354fe53146b855bf7ca3d

      SHA512

      35689afe9f86a5ba2b6579601c2b86577bd3be4ab92abe7b4bb2699850e580fcc495036d52e228a41c1debe9a43a52024208b741b02c6c220d452be1caf48301

    • C:\Windows\System32\FXSSVC.exe

      Filesize

      1.2MB

      MD5

      ddbda6f76139cb0b0bab9e3f64270e9f

      SHA1

      a41551610326171c110a308758e78315c84b6b61

      SHA256

      221f27f6dabd02dd0b726d5a76b225b974d39ea01922064d030179242ac030b2

      SHA512

      93c824028f657ef28d48a559fd7b0c8c9eda8a86c021d5f551726da8058a63760a5293f86308f924ccf30a045865b6130a197f1713bcc207f4370a4e8fb34042

    • C:\Windows\System32\alg.exe

      Filesize

      1.3MB

      MD5

      fd59246a0ec340befedb82083e122815

      SHA1

      0c56e939cb56e85dc1422534d6fb832b975e13c4

      SHA256

      5e2659b7cb71e74e24460751691afb27a72fc41df49552cc63ff946e0aa06832

      SHA512

      26ded48ef22538d847d01a80d309d59390ebe1d7284920adf5e1efbae0170ab2963670c8866d1b0bd2323022a52005fc23b25896c82348a9aa3f629786fb0f24

    • C:\Windows\System32\msdtc.exe

      Filesize

      1.3MB

      MD5

      11d20b496c0b9c7da8940abff23b120e

      SHA1

      65b3072447622f239ca8c61876d57469107eb23f

      SHA256

      c03512583f58a108fc93ea24c9a0f9e5b87c48ab7c2b5b38633d80ca4a5ca12e

      SHA512

      7f825ad410851ea0d64af9d22af625944969b27f60fc264ddd2f09a4d808b6fe695f3f0670b8765998a5994d824944266803cadce916ce82e2d242622ac33336

    • C:\Windows\system32\AppVClient.exe

      Filesize

      1.3MB

      MD5

      95dbb8858e688c8a6a192e82a5fb06af

      SHA1

      bb1b55465712762e81028c827e7a8996dd65f2b9

      SHA256

      87d16f50f2e98abccf4ce1e32dc718cb68e42216077025eb989c1159523ed84c

      SHA512

      f53c0f177bea34f2794bd49c46d230b929f67319417562f4a0aaf0b0e02312a140e4b5e10fa48f0db69bdd7fd0caa2d90ee6d5917fd63e01af319d895d06793d

    • C:\Windows\tasksche.exe

      Filesize

      3.4MB

      MD5

      9e9db238080f0bcd34e978f4a7a1d931

      SHA1

      01968d2066cc9c64d453eeaa97a41a62c26751b5

      SHA256

      28b87f25de255b946154fd653e4efd0a2ca589a1dc3d2e768abde601bf331ad0

      SHA512

      a6ae346a2abd9ad3b06dbb1c5acf5494458d684a82d56fe96c50d13109336a7856bbf5084355d6ad3d8cc220538b0dec2dc421daffaf5484952b68cd802df385

    • memory/1236-292-0x0000000140000000-0x000000014016F000-memory.dmp

      Filesize

      1.4MB

    • memory/1236-119-0x0000000140000000-0x000000014016F000-memory.dmp

      Filesize

      1.4MB

    • memory/1376-291-0x0000000140000000-0x0000000140159000-memory.dmp

      Filesize

      1.3MB

    • memory/1376-117-0x0000000140000000-0x0000000140159000-memory.dmp

      Filesize

      1.3MB

    • memory/1844-66-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/1844-52-0x0000000000D60000-0x0000000000DC0000-memory.dmp

      Filesize

      384KB

    • memory/1844-105-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/1844-46-0x0000000000D60000-0x0000000000DC0000-memory.dmp

      Filesize

      384KB

    • memory/1848-80-0x0000000001A30000-0x0000000001A90000-memory.dmp

      Filesize

      384KB

    • memory/1848-102-0x0000000140000000-0x000000014016F000-memory.dmp

      Filesize

      1.4MB

    • memory/1848-91-0x0000000140000000-0x000000014016F000-memory.dmp

      Filesize

      1.4MB

    • memory/1848-95-0x0000000001A30000-0x0000000001A90000-memory.dmp

      Filesize

      384KB

    • memory/1848-86-0x0000000001A30000-0x0000000001A90000-memory.dmp

      Filesize

      384KB

    • memory/1968-26-0x0000000000540000-0x00000000005A0000-memory.dmp

      Filesize

      384KB

    • memory/1968-34-0x0000000140000000-0x0000000140149000-memory.dmp

      Filesize

      1.3MB

    • memory/1968-35-0x0000000000540000-0x00000000005A0000-memory.dmp

      Filesize

      384KB

    • memory/1968-251-0x0000000140000000-0x0000000140149000-memory.dmp

      Filesize

      1.3MB

    • memory/2180-131-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2180-0-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2180-90-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/2180-7-0x00000000011A0000-0x0000000001207000-memory.dmp

      Filesize

      412KB

    • memory/2180-6-0x00000000011A0000-0x0000000001207000-memory.dmp

      Filesize

      412KB

    • memory/2180-2-0x00000000011A0000-0x0000000001207000-memory.dmp

      Filesize

      412KB

    • memory/2536-57-0x0000000000510000-0x0000000000570000-memory.dmp

      Filesize

      384KB

    • memory/2536-65-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/2536-289-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/2536-63-0x0000000000510000-0x0000000000570000-memory.dmp

      Filesize

      384KB

    • memory/2912-77-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/2912-75-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/2912-290-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/2912-69-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/3508-56-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/3508-42-0x0000000000E70000-0x0000000000ED7000-memory.dmp

      Filesize

      412KB

    • memory/3508-283-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/3508-286-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/3508-44-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/3508-37-0x0000000000E70000-0x0000000000ED7000-memory.dmp

      Filesize

      412KB

    • memory/3596-12-0x0000000000500000-0x0000000000560000-memory.dmp

      Filesize

      384KB

    • memory/3596-20-0x0000000000500000-0x0000000000560000-memory.dmp

      Filesize

      384KB

    • memory/3596-19-0x0000000000500000-0x0000000000560000-memory.dmp

      Filesize

      384KB

    • memory/3596-18-0x0000000140000000-0x000000014014A000-memory.dmp

      Filesize

      1.3MB

    • memory/3596-118-0x0000000140000000-0x000000014014A000-memory.dmp

      Filesize

      1.3MB