Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-01-2025 09:31

General

  • Target

    2025-01-01_63d71088662bf0d08b3e35045acf73d1_wannacry.exe

  • Size

    4.1MB

  • MD5

    63d71088662bf0d08b3e35045acf73d1

  • SHA1

    934e412d80ad21609773534ea340ae9b4434c1f9

  • SHA256

    d890d18330633c58ed654ad28cf81660c6a318cb1b86ec3398264ce869c0974a

  • SHA512

    d5cd71fdc32b9d2b8659106f647bb26a3a59b59c758ddb2888e9fd561e2a9072c4d1cc253ea97f17c57b23cec948b221614590afab020aae99d367c932b668c2

  • SSDEEP

    98304:4DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hvbx4uR:4DqPe1Cxcxk3ZAEUadzR8yc4Hv2

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

  • Wannacry family
  • Contacts a large (3251) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-01_63d71088662bf0d08b3e35045acf73d1_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-01_63d71088662bf0d08b3e35045acf73d1_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:1128
    • C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      2⤵
      • Executes dropped EXE
      PID:836
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3408
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4468
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4436
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2996
    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4492
    • C:\Users\Admin\AppData\Local\Temp\2025-01-01_63d71088662bf0d08b3e35045acf73d1_wannacry.exe
      C:\Users\Admin\AppData\Local\Temp\2025-01-01_63d71088662bf0d08b3e35045acf73d1_wannacry.exe -m security
      1⤵
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:3620
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4680
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:4724
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3504
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:1672

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

      Filesize

      2.1MB

      MD5

      e4cb6feac4d5011094f2f397dd082933

      SHA1

      28d57200f6d65369ebee84db0f7a93e02e720782

      SHA256

      2cee211ca9645c1feb135877292a7bea2347fddeb961315722a6480fe5003cb4

      SHA512

      d8ae04672e3b8a021ab79f9a1d7b0412701695a1f587fe2b580c37681ada905bb2fdf3dca166046e836e604c69e6e6ef66e4106cda24b993f8f5cfd2fd4e2d33

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      789KB

      MD5

      a22be8de1d8323a552a97e9a6851839e

      SHA1

      d267ab7ad1436d5fe025a793734f0f673b832f8f

      SHA256

      ffd8556de4c5ff3e5756ac33464962b1a37d25b92a5ba9bc9e66281e6b14e24b

      SHA512

      ee26eff92b3aaf0c44b76e06191dda50d8dbf7086ed4eef005b1d146b7b63d15ecad40e1e5ed12dd7de39b34cdabfc6c263ec289b7427caf0c5abb8b520194aa

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      1.1MB

      MD5

      29cb9592612a6c7f5544b80017aa9259

      SHA1

      6cae6416dc1b2d28e7e5b2e1fa63644b1e5e9a4b

      SHA256

      c3f0c927ff0549590f9f7fc160faa389eed4ae69e36ed7cb65e54a1a401c503b

      SHA512

      a1089475af69e883964ab296e5be26a958aca8ad99af4272c2e0f33c2ccb4f9eaa6b219481e0bd59ddd7e2dc6fbf0bb501d80e2c7897f7dc3f7a91d8b17343c3

    • C:\Program Files\7-Zip\7zFM.exe

      Filesize

      1.5MB

      MD5

      941848002e4c7c2a1974d33dffee7663

      SHA1

      1d60c72fb14825e3e71ab6f025e60ea5687261f5

      SHA256

      f5f870e8adcac464a22c9f515efdd12648e9d71fea47cde2fc6da2797a3729d9

      SHA512

      d3b1ca2dda41d27d4a146a5708a0977953f67bbd3a0deaddc0eb81dc92ac5ce9f740680fad21e8edabcbe87b35b4983b1c001526cf5acb0d6b83f148941c1aec

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      1.2MB

      MD5

      a8f006ebcc0ac0a592d062f4b1c077f3

      SHA1

      b65647d2f3dfcfdcdc7e0653245676d0571dd449

      SHA256

      12f501a253997fcb7cc61d06290447ab37fa52b58f8dbc14a54599116843c5a1

      SHA512

      61a2e12b427e33388397e7679c03e1fb0dfd332c29de65b1c1d36f6ce4bf1a3e96dbf10cc7910cedcfcc7bfa5846fef445d02b47c685cf7cdeed2a200e4d25a1

    • C:\Program Files\7-Zip\Uninstall.exe

      Filesize

      582KB

      MD5

      7d5260086a3d4ab595a9bf129df36c27

      SHA1

      0c7e7bf3f98bebb3d47b5322a655eaee7b53d684

      SHA256

      613d421d8a87c6f6afff6f144de26b549989acfef6d8ade2270077d5992baa4b

      SHA512

      02f4d603196544392b5c50896c6fa58a1f78ff26ec60fb4dde7dee20d2647f1fb59a39038ce6b975aa25c3ff289ce81ae99b8df74935d770b7b9ad6672d0a79d

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

      Filesize

      840KB

      MD5

      ad5aaa90d912abbd0dadd8051e75c8d5

      SHA1

      2335eac1fcbc1f3963a40514a665d8728a6091c0

      SHA256

      2279ccdd770d4205a26d6ddd3e1aaa8342a2d5ece3c9dd3ebbf482503d5684ca

      SHA512

      af935e8f7f92b52892b75efd9eaec993e3fc1b5b635142654f7acb086e64463adc44353112a917e420cd51694bbe4ae84fd900aa302154ff30b83898a93bbf6d

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

      Filesize

      4.6MB

      MD5

      f50fdce5d75fe9397ad99a565f24acf9

      SHA1

      8c6cb5692403d3608eb1e4dc02a57651bbbb3752

      SHA256

      214f2b1d921159338cddff8368bddc6464687312eb9e2316e7a0ae610e7cc139

      SHA512

      fe0a49711716212222e26f4e00124f4f0b4d5c546b58d25cca367f28812e1f5fa9b2d6132b8a1d1ee1e0d3d64aca0a5d3456572539b8a982be93d949a9d9bbce

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

      Filesize

      910KB

      MD5

      40dad708fb258e60b772e911bdc8ae92

      SHA1

      1cc2717a939884e61dc976a87665f15507690153

      SHA256

      cb7cc1050202181c0a8db9e80be3b8a4a00ade1fe3e932bb2e6521dd8892eb26

      SHA512

      6f6af0c2587ce0d8356bdcbafd1f5ff0030ce764ab1efb9b236cc5d9c787c8633bf0e40ff4a1f68b882028e2415df3dc0861aef2f18b3dc7b1c354733942e167

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

      Filesize

      24.0MB

      MD5

      b6ffe7272c5b0071922c42c84c659081

      SHA1

      46ba01375f5b285d368877e28dbf480ef108447c

      SHA256

      782b8462afc329317b2df26676966e5ba79b9a46b39e223abf575d78faaacabf

      SHA512

      29d84ab35c85410b1b8a000b121f7ae777d37db870a6f683f2b4d9f7df6a592de7cedf60c1171b62428e6791dd4332aba0c84935603f7ee9161831c32b5cba60

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

      Filesize

      2.7MB

      MD5

      9378538619f0a3895b6424579a4240ad

      SHA1

      2c024ed69df1e9e6ed19362d48412fb29523e931

      SHA256

      c2b511c516a51cecfa8ccd5acfb12cd6f8620a73cbe9448049d35dfe49defba2

      SHA512

      397845784aea2896f1a61635afb5401c9ebfe80f673f237fe99cedb5322bbad6abc921974299857b1cec9b5ed3c924076054ad9765aae3fa6ab77ca9040fbad8

    • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

      Filesize

      1.1MB

      MD5

      860c1990619b0faeacd13ee97dfc529a

      SHA1

      4c290d92bdd687f907c9d247dc336befca3df860

      SHA256

      54f47940859114891a14cc49c56ccd716d7f63b3fa085f744bfc25bb80d3307b

      SHA512

      bc125b403999fa443f597ee56264a1999c8a745cd64424a545a91cb08be42b4035852ed09425e0b3c3096226fcc63fa7a3d1367314fea4ddcf43b2e2908ccf63

    • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      805KB

      MD5

      e09a986a72011de01630e51f60957b06

      SHA1

      53b1c41f0b545c995ee0122b9fb81a2b979ca8c3

      SHA256

      43eeee93ec5d892e3ed7419406f64ab2e4d9d9298b51c3aa9e60482510d9f721

      SHA512

      eeb8f25d04b55ffcae76e52545116e6e50ed08a34f24aa9648bfe87e613fef39ba1d475fb9a9f2642c99c195dc6ffad7aa4a6a3eadf2ab42a2d85c03affa9f37

    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

      Filesize

      656KB

      MD5

      f7e69b6afc5c15af0d9bfb8292414beb

      SHA1

      e4988df60c5a3607019c14785fdff2305fe1623f

      SHA256

      57c09f34a39c9587d988f243863852801610475ecf8f0a39fcaac037bd557d09

      SHA512

      7842897cd8f3ad2bdd56d51c3732b1f32148e8371b8b681c57d5186e51f52f43affd6fb43dab275dbee4190db7c9ba904272655e03ede26c070bb324f0354e5b

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

      Filesize

      4.6MB

      MD5

      265f594acf1d861f8340c1445152661d

      SHA1

      495b94a63c52985464908e5d1304f75f5435f996

      SHA256

      645365cf0b2bfd9a080837f3b42b000ced7aff20abf5d40adc63b6b6a3ca8e87

      SHA512

      92217f79b057bbe741b40f7910f9a7442e9a7fae1e471edae02e151ed5724380a7e2f91831b78612532010522315b3270b0b00484f1605c4b4a12f39a15f2f6f

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

      Filesize

      4.6MB

      MD5

      4ba03206de9bd27fc17c99c2ebd78415

      SHA1

      a46007bcc06a319da606eddc8a629c6a2c4972c9

      SHA256

      6e41521fcdbe794ec81b12ce355829cc9af2e4209fdc801d29e6eb1015334412

      SHA512

      d002f6b41b70d1d5dd03390747e6ee9dee87e269856e1df1659774714531599b9f4736fae3af18db551e067efd6ce1e7da17d40d5e884f594d53726f1f4a98fe

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

      Filesize

      1.9MB

      MD5

      3cde12654e056b950641ef1a7d6960fd

      SHA1

      c7886f4df10c9ab6d947d03fb16bf4e031caea6e

      SHA256

      85ae81a5c097308e93dd8641d34a30d77cca442c391b1675f8c637a94558d150

      SHA512

      2d83e2920e2cab9c9f62d7c51219903e0569bfebcf90db688ecbbcbf51a5bcd69fb0089ff14c50c4c823a49130fd27c09f2514a00de651cd2611716596de3240

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

      Filesize

      2.1MB

      MD5

      d65f72998747196e777dfcc60eafa40a

      SHA1

      25d88774917a87575f794c6054cb08f578031beb

      SHA256

      0ce8ff536ccf92c1e99f0d886c240c23bd5ef829dceefa08134a7ed189f237df

      SHA512

      8bb6d82fa9a826826114003749a96b669337c525f58c3c00f1ec79895c0bc02f3e3195b1f87cd0ea5d0c14eb02a943953a1cc60823f2d8467d24596aa8566e23

    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

      Filesize

      1.8MB

      MD5

      71d5e7bda9ff115c15480394faa18c51

      SHA1

      00fb9b473729771cde4430adab0ea17d127edc7a

      SHA256

      e1c59b30c576e4494d1441d6d625f41f9c925151dec4f5b88418ca43693e938d

      SHA512

      75290f6c9f1713c8f3eabdedb9ee48e5da8b4dd3c80b15e082c7df8c52943df476af13fb06e00f861e82635facc963b27db0af4f44e928c2392394d11f745e5a

    • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

      Filesize

      1.6MB

      MD5

      bea9b10c66f971a3f8c13aa5934c3dc6

      SHA1

      38e21ca0228c505a9413033f42e81889515979fc

      SHA256

      2347813d846806f4aa6b926a1cec26373d70aab5abdc566853a24f3d07dfb1b7

      SHA512

      87485668be5d4fabc15e53d02d0a9b9bcae683fb6d1f027c28d3c267f216db35e7ca2a6045fda1eef02ab794f684d672112d88d2c898c1f5c070f8fa2e1f6460

    • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

      Filesize

      581KB

      MD5

      902b2d49fc5dc3ca885ddc895c8f3c29

      SHA1

      da8f71631237f76b2c58a1cdfdf357da0521c87f

      SHA256

      15323de738a2c443a85083aad7c2421666d8d70123c021135c554419e0e1322b

      SHA512

      560d1489d190ad0552d46d0bdcc571c4cfd9968e0d4d221800477d63f883128f59f53641bda8f076c512d1a7783b1b7458a1e633bc9bbccf88717b8fa7dfa353

    • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

      Filesize

      581KB

      MD5

      098852621e836c22102efb61c0968b64

      SHA1

      952cd86bd4347446307dae7b866bceee1f8ead40

      SHA256

      8aca7d3f60bb3fcdb9aa79958a2973719507568680aa8c86c79047124f021f2e

      SHA512

      3f20b94c1076886b484bf69d0e1e06e4b1c08ef6c49ff6a80791fbee73e227fb0b28343f6025c0f06a06b84ca391b0bccaec3101d68846de50b5e12a57ae6912

    • C:\Program Files\Java\jdk-1.8\bin\idlj.exe

      Filesize

      581KB

      MD5

      09df224a2dbbb1edc460b9d26eb0685d

      SHA1

      157de14c625eb2a381cf9fc487d99c9bca67b1a1

      SHA256

      3be286df397a485e82d6f5373d06a52ffe87d446eeaf5155849a9414b7822e43

      SHA512

      4700dde9fb1328c1620ed57c771f834edac484c960601a54e26396b6862159dd4b4dc51c88f9618e6d12b6d123efc2b29291a3bc8813c2cc8592ff8ac2f11d2d

    • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

      Filesize

      601KB

      MD5

      ece88e7239ff26f3db9e9a5799a82626

      SHA1

      5bd5a19820db2798bd8a3a0cde49f3351ada737a

      SHA256

      760dcdcab57c090e1ebb194cfd2cb59d5b275d25298e46c0b198344c74122eef

      SHA512

      62df933c8dd55a82a59cf613680a49e4cfd68a9af0df8d05f5fb3202bcc51d45d17373600a044f8c5190c7324799948972d043b48748107247504777f4837a98

    • C:\Program Files\Java\jdk-1.8\bin\jar.exe

      Filesize

      581KB

      MD5

      1675471cdfc56442e24b7c944f2bd15d

      SHA1

      2abeacd9886fa4adfa47fab46942795f97f236df

      SHA256

      115b0dcbb713368d58b35c72e63ae37802850f1516a49810de4eb73d2c70566e

      SHA512

      dc3708323b3179742b4679642c95d9bd8ce72e566f2a9de54e152d18fa755c98be72483338ffc4cfa5477bdbaa50fff24b68a6ecadc6a1700a482e6c1c80a2e7

    • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

      Filesize

      581KB

      MD5

      a73dd645384a05153e9f062ee8bc061a

      SHA1

      790cfa71716220596325365ea7ee5ba824b54d18

      SHA256

      e0662269a02e280c7fbd0fddb66873fed40aeab1e440577d9912ebb69f79628f

      SHA512

      f92641d5392b2dd686a4c38093358229c8d140a2dff0ca109736c9a13accb4a2d936c894ed51213cc6f9a30ef1c43b0c73a4c3c8bbbc8a0854b63e6934da00a3

    • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

      Filesize

      581KB

      MD5

      12807388341d798b821f6a7047da827d

      SHA1

      d23b5f6777dc016c0c215624f552cb9ecc68a9b3

      SHA256

      041c062689f00a9a882658d9180d1836ce995b735c4112d7a823c419db7c4214

      SHA512

      526dca586759ed82a15d0b11a99b5d9cd1637122f0f28c37ec280b38a847313eded01e5adace0baede93d4de01dbb30e8ec362e1bf1f9487aee8f691672f0a65

    • C:\Program Files\Java\jdk-1.8\bin\java.exe

      Filesize

      841KB

      MD5

      7eba02a4abefe317689f2aac2cf0da99

      SHA1

      0569eae77c465a0119eb0a348adfbb22653e415b

      SHA256

      60f30c013fcf9b2f345a1c78f4e1e8b0cf61b237cd55ce9bccd3562b04500777

      SHA512

      dd06e701d67b1bf559bd7664911e6a689ff4e1b2b1634751055814913f38ddc692365e9d9c48b0f4c3ff69f5d3538db5a5a5493eb33f739e231e356a8acadfaa

    • C:\Program Files\Java\jdk-1.8\bin\javac.exe

      Filesize

      581KB

      MD5

      13412d2cb338f4ce661ddb062be59355

      SHA1

      cd199eefab5452304781a3e8cdbdf777fdea8337

      SHA256

      fe14b870e30568ef41b9b9fc99b71eeb276fc8a3280f66a34a622399d1d7e522

      SHA512

      45d3bb6823892e4aceb9dfc8137746a0c5e0702dc9947302891d5280e5400a955962f89da3f19817c755e64773e868809797ed15b931099e57293583c6e3f42b

    • C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

      Filesize

      581KB

      MD5

      40433b9216d50636a4b675b7cffbdc15

      SHA1

      9db11fe19eef85b8f7b0406d8dccef81db821493

      SHA256

      a1a942c1d477218f214fc1b028d9035f1dc2c631a08720ac89f3c6bcdc335cde

      SHA512

      05c87c77befa25eea5a6f106565ceec003f8c5302ae3ea51e8e3c79ce435c0f7d5837ecb296ca2c771ff344182a83c44303692b18e6803bd09218aeb3264991e

    • C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

      Filesize

      717KB

      MD5

      100cb49a243e25dd2c11308aa4b2c569

      SHA1

      ffa2d576784b2e4732bececc8112c571a7cf1de1

      SHA256

      81cd170470198ea1428e1d4c6d0128c9337cef864718b1b3e0f9f40ffbe170db

      SHA512

      f7beea306ea90b8954e37bb57fd60810deb61b4dc41035d484c9fd7dc4b09725c64c9b790de2613c6251de194afa642d6a81c6304448755225cb7863828e2960

    • C:\Program Files\Java\jdk-1.8\bin\javah.exe

      Filesize

      581KB

      MD5

      70d298d19a8d0d1339d415c056128979

      SHA1

      2f5942b8431a3c754ed6fbba44bb5a1717b320ed

      SHA256

      4b4a48838d962980ed6e55765c6f7b6ae268847df37139ed61edb7d505c73af2

      SHA512

      d7b73a0f15ad6b6765d0801d497f47bdf96801c9b5bc9d38d086dc53ef8b592148b4e290459ac628d69b754e1928d88fafe707d82d58e1cc30434f74a2fcf4c8

    • C:\Program Files\Java\jdk-1.8\bin\javap.exe

      Filesize

      581KB

      MD5

      7506bcb5a52b19755abe09b8c5ba1e38

      SHA1

      6808623fdfd3995eb24d030eccb9326e33cbefcd

      SHA256

      8949b9f87c3bda19ebd569ca765be5d3dd752bf1936037823182a8701aafc853

      SHA512

      645d4cf8ec0868d66e16bc431ba3bbd8ad47cffec412a52a846714e5fc925bb44f8f7460805f50392331762ca8f58403add98583b2304951f82af7192133b6dc

    • C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

      Filesize

      717KB

      MD5

      a7c73fa545c4dca387753ef292e17dd7

      SHA1

      a9f59b730a32746c84c79ef04843ad9834e3d361

      SHA256

      0850b81ee750c649834a84e3c61f94b48a5e4d3faf6324fdce3282de25ba7c25

      SHA512

      2e5304815de5633f45013bd9dc09d241b50591e2cddf9d48d38c9a397b0beba8bdac4c7b231ecf58b481b9dbc28264c6226e080795db6dae62e1854d06593339

    • C:\Program Files\Java\jdk-1.8\bin\javaw.exe

      Filesize

      841KB

      MD5

      bdaa94e9f157592d7fecb9e692863793

      SHA1

      cb44120fd7fa502de0cd5a8b06a554a12689d91c

      SHA256

      f81ae83c1a74d6568a50661e212f6873b7bf9c52b0f0b4ada059e87b92116765

      SHA512

      6b6c1a8a780c91bab5c572741d5ae5c9dab3f0c0f917ed6ff53b3be949add562935792dde83714802587622e49e4591307aacf8ed2fa9692e2e6cf459209d56f

    • C:\Program Files\Java\jdk-1.8\bin\javaws.exe

      Filesize

      1020KB

      MD5

      2193b4f724372419c45bbea7a7c8ee0f

      SHA1

      5a7adff8a7b8c3e743b164fcf4c944a2e4b03f6d

      SHA256

      96debcc8cb60bf02fc401e651e727e1bd369c8b1de79f2b60e5d4c960c8d6f1e

      SHA512

      cff30a8769e0ae384a9c6c307c19b4bccafb940e38808a8ae970d0f389756433f3419a111c1ba5428bb87364c4060dbbdf49e1c33295379440a264bd984485d1

    • C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

      Filesize

      581KB

      MD5

      88024670389ab8e66c476c507aaf08de

      SHA1

      81b75ece5ebc39cbd228a6ba35ace7bdf1f8cbe7

      SHA256

      df9c3427d9e9602644ab6d9ebdc3d0c64ab5750b931f507505627cb05c1de2c0

      SHA512

      3d3ae7da77a6e4996a3ee8d5fd8bab388bfe8125877b3a70e2ab28e9e66b7b26e4dcfd73b8adf93b93af5c49d5317a55c68651b6412fe65a3ca4c9dfa54ab3ed

    • C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

      Filesize

      581KB

      MD5

      18b0583ba44c873bde1cb2eb94897ca6

      SHA1

      00366b17c0297989858b67607b8e7dc29894962d

      SHA256

      480fe9fd950981d2d8b6395ec99dd337f6df44b972b3a3aecce1e02ec35346ee

      SHA512

      c0539d73bff8bfb5ba2a4ff54c5dc179f33ac452e6e66d2adf863040b23cab0fc235617d0cf929d72f3cb41654c303e2c17dd8d8bcbf6a0d936225c18248103d

    • C:\Program Files\Java\jdk-1.8\bin\jdb.exe

      Filesize

      581KB

      MD5

      12fda5581a2fdf807350d6986815b49e

      SHA1

      bcc7819c4056c5f5e951add6cfe404e499f4864b

      SHA256

      dd76147a490fb46964cc9039a9e0928b1ab1a1a12fc29920b8a86dd10adaa445

      SHA512

      485a774d02a9ba57932976f0170268584061995954f893ac2894347798d78d6545faf5012266e1e3a22cb9de0840dfdc92dd27b7ea030ff25b441cdcdaa706aa

    • C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

      Filesize

      581KB

      MD5

      2147d488248d4d80ed921e7e09a5969e

      SHA1

      cfea951eb3a50d4d361b1eb8567bb923656eafc1

      SHA256

      54265f97fdac258aa26dedba1a9da7546522bbb134623e80ef99a26e5c6b829e

      SHA512

      a72939a605b372473318936ac0c0f58e0ac897e81ebe52a49ccf5138b3a3881d86db7445859df92ede8a734283dcfa756e31a7938c6e0c1ac552b3dd776ec469

    • C:\Program Files\Java\jdk-1.8\bin\jhat.exe

      Filesize

      581KB

      MD5

      58eeabca02ad90f664c3529af20cbccb

      SHA1

      aa1c46d70b26b29247036d03680ac301f80f8836

      SHA256

      059b4897b98a4e3975e420422567359a6da09a8faf10108c39b3ca30ba49effc

      SHA512

      9ea409317a36006e1e96b9cc805f40c00f1e6fb1520ae8d156b275602e84f6bc0f8544e22d4a16f3743c3b27d67209a72459000feb71fb1ec9ec6e23ad835643

    • C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

      Filesize

      581KB

      MD5

      7d8e0259ccad226b0cd9d706dcf02115

      SHA1

      a8a7b67cf5fcb84c3e5482eec133da39aa9b1b30

      SHA256

      57e124cde0d2ad41b54e330396b4fc1ee1c917c25a33616f3602748226d50d54

      SHA512

      3088a1a14b6fb6290f2a4feae8b9bdedc9807571fd9b36b368868f932e3479b63dc7db3cd858888a2bca708578c120dad185b9aa64ecce0831031c32f3df8f26

    • C:\Program Files\Java\jdk-1.8\bin\jjs.exe

      Filesize

      581KB

      MD5

      5658c10c6302774efd9f85694115e769

      SHA1

      b54dd2edea0fe1852de85753b0f607834d85ed94

      SHA256

      6b1b3f91b536b9fc1d32418139fd3233eb5369a5d05d6fe237232b35174ecb41

      SHA512

      762e29aab003cc7e9a9d20247a711fb670539df74ba165ea918619ce47989e4bef9b833fbe7866b8ea6bb79289a4dae0ddefed10a397cb5f88702570bfd7f483

    • C:\Program Files\Java\jdk-1.8\bin\jmap.exe

      Filesize

      581KB

      MD5

      a058f9abd146a68b8a596301eb2cd681

      SHA1

      7a6c00af2e76d964b3ef7b69df6936a8cecf2371

      SHA256

      3290da577ff1b66c741109d955297b4b0e0f02ad9d42f5eeda34557c7126f91b

      SHA512

      4cb1514ecdd5683be763a042c73f50bd3f8b2e614d6ae4a2de74f4541f6c6e15765d6917b18e8fcfad70596aec825da5d308e5a88645cd37b7c40f6a9777ba1b

    • C:\Program Files\Java\jdk-1.8\bin\jps.exe

      Filesize

      581KB

      MD5

      41976346f857a9c13ce4df6d7dab91be

      SHA1

      bacdeb5429e466beda56a269284b87a6f41c3b6d

      SHA256

      f2ad5d9d3736d2181d1d1b79eb5caff1605d9938e923e8798fcf9cbe2e66c6fb

      SHA512

      383dc21f6b1c51f026245d8fd2a7073941aa7b53ee610a68e60601eec69008c1a1380091f8b6168098f30fdee6f8d0d5cf67fafe0d52f1256a77e5e8239b95fe

    • C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

      Filesize

      581KB

      MD5

      b6aaedb5314dbc21893c89721f72430f

      SHA1

      031d04859a078a3ccea483d699ea9548dc36631b

      SHA256

      243d0a9b00eef730e95d62d3ae8eeaf43155733234e6cfdf8a616b16acac0d61

      SHA512

      3d0697143d09ddfbfe336f560be0964de28a11d0ca21d039ee445649e7a0915995b0161585d3f31cd7802f47ee03f61456499a161c0954446167b4625e26029e

    • C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

      Filesize

      581KB

      MD5

      24feb96dc73880e19f89ea788e12aeae

      SHA1

      80c9bb39f836508a6a320c20099a086eb1d2ea35

      SHA256

      16ea3ae9f1f6daa60f021a1dd8a1da510a4786d1b20ccdfdd7f3342a703c508c

      SHA512

      c311b35258b84c3bd36cc13e0b87e70e7ea10e2c36b661c948010b4377bfc843a07f32a19e28c51fcc680d61d96d21b31cb61f4ddf209f9b38394f7c0ca71fa6

    • C:\Program Files\Java\jdk-1.8\bin\jstack.exe

      Filesize

      581KB

      MD5

      4906ac3b717e78e8bbee35d9dae5a7b8

      SHA1

      3dabdf64fca652910a3424aed010e475d8464371

      SHA256

      64983558f88c941f2f1cfdfd3ab3af3299653469097fb83bbcf7c2550f4f39d2

      SHA512

      9e43c0712f395d95f3213aa809ec4bc335f28b62c43e3c32c7a964d97b0e2efa77da8ac76d092bda82d59597bb8ba75cfa6b632319f777a7d1671360c7c38677

    • C:\Program Files\Java\jdk-1.8\bin\jstat.exe

      Filesize

      581KB

      MD5

      00be5e2cf186f6a6b5d839b4622fa7ea

      SHA1

      4b83c2e634a5a09b5c5b6f0cd0d1b88eb36feae2

      SHA256

      0748cd494b8b54433c750eefd4712e602b1dd149d230ed332f9cad48eaf9da1c

      SHA512

      19a806cefdc4b96bafc70be7c31687e7fb3070c476b8b264ad5fd396b76a7d1b381e1cc71290bc1381bcdb84d150a0dd15d28318536c9c1b9b8e63ebc7c7ad43

    • C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

      Filesize

      581KB

      MD5

      6b1ab5b5ff60e16861b157b2f6d21c02

      SHA1

      faa6cae4ea44f43552efa55513c07154bba89d9f

      SHA256

      21afa257ecca87f57d72300ed251495f93461e0a1f823b278d2cc3a308d0cb59

      SHA512

      eb8c5f76b61e31fc6e623929f58152a3fa5a897d856da234c51f0ccf22e8fac9835e21b35b88fb1a264d135d7edc4baa32a001bf10047857c02d202f3470752a

    • C:\Program Files\Java\jdk-1.8\bin\keytool.exe

      Filesize

      581KB

      MD5

      2002226eeaf85c24a300afc368862d03

      SHA1

      30c72e72f481d85c2e2dfb730ca2c8bc8b9d05a1

      SHA256

      369809652fbc9aec0716b19348825a249337ba36f944d635c6803067dd1b40d1

      SHA512

      cf64fd7737e61bea5ee791dfb23eed7a7d155c2a1a5fc33d618941f2e1418bf11b1698ff43f8e3b4798636c5173e034a32b3c33888a9f856175f25e4e82f91bd

    • C:\Program Files\Java\jdk-1.8\bin\kinit.exe

      Filesize

      581KB

      MD5

      9f95361b56298c69d6945cf61e5582df

      SHA1

      e5ed70ba3fcda0920d98ce076415d0114987073e

      SHA256

      df322833acadcd7c746b554960559cc80e57975123e1782399802adff9b29e61

      SHA512

      e4200199aa24c911af7e05be58a0bb2947f0491ed80c2f8e347da6663b3c9c97b90fface325011b94e674988af3b2c8b0d9cea241541d7f47023a5865d4428fe

    • C:\Program Files\Java\jdk-1.8\bin\klist.exe

      Filesize

      581KB

      MD5

      3fb6a4180d687cc003fa296a4a36087b

      SHA1

      b08ea57f968873e6d9067e8b27e597edbaaaaba7

      SHA256

      bfe437001794846393e05357ecec6e3dd7f93d7d0adab009d98d7d48e364312b

      SHA512

      174d6b56b5ad74187371c1a58bc4ccbe88cc1e93b722574b29de131f6701a4bbbe1b3fff9821c25ecfde2913c31d2474bc44d851fe1bb712b4a01c0d1efed112

    • C:\Program Files\Java\jdk-1.8\bin\ktab.exe

      Filesize

      581KB

      MD5

      bc390d6c5f39a5415eb19de38113c8eb

      SHA1

      cd35eb7c3c4ea64d4527d627d64bc1b41eb2c92e

      SHA256

      e2ea1d3cb63dc49ed3ad6e7df9092c64408e8c615d2146d732b3d885823a75f8

      SHA512

      be2bfd2e078ed5042e64ceb053769946577132e1e5734e75451ee0483f838cec720bc69200044eaafc369f7ee552b592c371ce4f6073912793e558a453938d09

    • C:\Program Files\dotnet\dotnet.exe

      Filesize

      701KB

      MD5

      fac8f0526e0b45265f4488ba645f2fed

      SHA1

      30b004693e1cae7e2942c772f46030aca4a748f8

      SHA256

      cfaf4419b717e48526d7dfce605b6cb5f684f19ab2f860d9aba71d955afdec8c

      SHA512

      c4e8cab3449945e08a6407a159a46e0712b9ed14638a4cb794b3ddeefd12470654455bc4764ee23bc4bcb5703bf29a850fc0e04467026b4e79bf9676b97bb7df

    • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

      Filesize

      659KB

      MD5

      dea11b56e9977ebd940baf15bd7e0686

      SHA1

      d69d5c1fbceca401b1245ddb663fc5c4d0928fd2

      SHA256

      2c50639f60cfafc45cac5b2a27bc0bbf9c20249a14320c4473dd0b3094f88173

      SHA512

      68e5b7b6516895b74110436aa68837e3047cc53e586b9b8a2d172ea7127015c93c7c424e7bf50013e8a958f2ba53ecf90dbd763cb192d506dd7a2d1a4d984625

    • C:\Windows\System32\FXSSVC.exe

      Filesize

      1.2MB

      MD5

      777de125103d699ec2a42b4eaa3a5bca

      SHA1

      187e5862c57d00d85c81408e4de2c062980cd280

      SHA256

      23d5d5d52a4fe1f7700c86a69d2e02cfe588975e2d299a6ecba7b743ea3fc2bd

      SHA512

      505c304a0ba5e6805836b7bb454a1b9c3380e9d31e5b4d79dbbb5ea709016814a1e3a67f5cbc0a2071c4767cc26b469af7a4d8fac4e7f0755c7be55e326d0af7

    • C:\Windows\System32\alg.exe

      Filesize

      661KB

      MD5

      39355fa5a98a022ea81d9c8deafc4392

      SHA1

      9df5637811d97601463b50b688ea67a6b0b7a4af

      SHA256

      d002eecfe988ef01042148f1abef9be2f5267ec25b3c70935b8bd80dfc998719

      SHA512

      99242382a5fcd3ce1e60a11f0af5dba4088cefd91c86db543d248b98e1a26f76cb81f3ac2310d1471f7059531bf1f3f08ee113a465e04f83751313c5dcea3c59

    • C:\Windows\System32\msdtc.exe

      Filesize

      712KB

      MD5

      cfe93d8ceee644483b785b9108ef0528

      SHA1

      288649de69f566eaa6a428e47243c33bedc65c5b

      SHA256

      63946aa3f65c334a8ed891272ddd305871f889abc270a55f23a881cf62867d65

      SHA512

      1316553401a8ec3389afd84a40f493b13c2e5ae9f8303690d085893a87615063a499a1718c50eb60fb0037876fc5a07df9ddf7cc79bd66dd68079b5880491442

    • C:\Windows\system32\AppVClient.exe

      Filesize

      1.3MB

      MD5

      1c39386facff3ac915009c0db0d77d4a

      SHA1

      7f7158a5fa1aca3ee5dae387d4b27f6f42e4f5fe

      SHA256

      86945061ee1de3e131c2d2bf5183781d7e4579af46af72bb7a01b9ce1381cafb

      SHA512

      71427716af1741b390eb1552fc642e47d490f73211b2c8dd7767c343247b3895067367e8351dbd8123ffb8621bd55759675fd98239bcf41f21ff24fdd0f256eb

    • C:\Windows\system32\msiexec.exe

      Filesize

      635KB

      MD5

      d3fbb7adb3f98b3a6d9b19f711f73a17

      SHA1

      778ac1093b21f36eda7ec2e01049701a593baf3f

      SHA256

      ab2645c165a4351b3f0607c6d1612deabeaf0058db719d4acc343e66644d3fa4

      SHA512

      875b3a1a55a9dce6e602b11412c5c7fb56ffa8c02f7853221eb549fbdafd57b928ee3b202263b7926387844dde68fffce882c749dbebeb82c70e71ce76aa692e

    • C:\Windows\tasksche.exe

      Filesize

      3.4MB

      MD5

      7f7ccaa16fb15eb1c7399d422f8363e8

      SHA1

      bd44d0ab543bf814d93b719c24e90d8dd7111234

      SHA256

      2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd

      SHA512

      83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7

    • memory/1128-0-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/1128-112-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/1128-8-0x00000000011B0000-0x0000000001217000-memory.dmp

      Filesize

      412KB

    • memory/1128-1-0x00000000011B0000-0x0000000001217000-memory.dmp

      Filesize

      412KB

    • memory/1672-173-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/2996-39-0x0000000000840000-0x00000000008A0000-memory.dmp

      Filesize

      384KB

    • memory/2996-38-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/2996-69-0x0000000000840000-0x00000000008A0000-memory.dmp

      Filesize

      384KB

    • memory/2996-45-0x0000000000840000-0x00000000008A0000-memory.dmp

      Filesize

      384KB

    • memory/2996-68-0x0000000140000000-0x0000000140135000-memory.dmp

      Filesize

      1.2MB

    • memory/3408-12-0x0000000000630000-0x0000000000690000-memory.dmp

      Filesize

      384KB

    • memory/3408-249-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/3408-21-0x0000000000630000-0x0000000000690000-memory.dmp

      Filesize

      384KB

    • memory/3408-20-0x0000000140000000-0x00000001400AA000-memory.dmp

      Filesize

      680KB

    • memory/3504-188-0x0000000140000000-0x00000001400B9000-memory.dmp

      Filesize

      740KB

    • memory/3620-58-0x0000000000F80000-0x0000000000FE7000-memory.dmp

      Filesize

      412KB

    • memory/3620-63-0x0000000000F80000-0x0000000000FE7000-memory.dmp

      Filesize

      412KB

    • memory/3620-172-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/3620-286-0x0000000000400000-0x0000000000AFA000-memory.dmp

      Filesize

      7.0MB

    • memory/4468-35-0x00000000006B0000-0x0000000000710000-memory.dmp

      Filesize

      384KB

    • memory/4468-26-0x00000000006B0000-0x0000000000710000-memory.dmp

      Filesize

      384KB

    • memory/4468-34-0x0000000140000000-0x00000001400A9000-memory.dmp

      Filesize

      676KB

    • memory/4492-57-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/4492-55-0x00000000007E0000-0x0000000000840000-memory.dmp

      Filesize

      384KB

    • memory/4492-49-0x00000000007E0000-0x0000000000840000-memory.dmp

      Filesize

      384KB

    • memory/4492-285-0x0000000140000000-0x0000000140234000-memory.dmp

      Filesize

      2.2MB

    • memory/4680-177-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/4680-287-0x0000000140000000-0x000000014022B000-memory.dmp

      Filesize

      2.2MB

    • memory/4680-77-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/4680-71-0x00000000001A0000-0x0000000000200000-memory.dmp

      Filesize

      384KB

    • memory/4724-87-0x0000000000CD0000-0x0000000000D30000-memory.dmp

      Filesize

      384KB

    • memory/4724-93-0x0000000140000000-0x00000001400CF000-memory.dmp

      Filesize

      828KB

    • memory/4724-81-0x0000000000CD0000-0x0000000000D30000-memory.dmp

      Filesize

      384KB