Resubmissions

10/05/2024, 17:13

240510-vrrk4sgd7t 10

10/05/2024, 17:09

240510-vphv7abd29 10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 17:13

General

  • Target

    High Priority/criticalupdate01.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>QAX+pGIzCilAG/rkGuVikjnI27mks6Y1MP17XGimIUSVn3yTgYi+D5NLM/lDlJJS2LmJntI73nq8QRMVvOiLNxtvwABJyRZpMRUiosoxNDBlgU2mh/85Gyi2e9IWzgPuNyEFTwsh5nmt6340Ysj3DgE/8LtN+WXJ8TkIjC9ppVoalXcLXKXzWAph8zQfu7opb/bGRJjQBiCz5TJMmlwKq0NCQ0KMjepOtJFPGnoQLH+RtlcSE3GOZ13qBr4oL+epOqZS4cxHDeVBK3sHolSgvCKoaevllcYAt4h6s9u2S2qe2LX0uVoa01ybkQcRE2dsrQfqbGPVpkVP7xE28JJFNA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1352) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\High Priority\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\High Priority\criticalupdate01.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3128

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak

          Filesize

          16B

          MD5

          ced91f18870484118e937160e595e6aa

          SHA1

          1138dd5d1d738581f714c984777f568ca3bdf4dc

          SHA256

          aba404edcaed024c363ff7015f34b83bdd5d64e3e6576181c95347ca62197eaa

          SHA512

          01c51be89e5ad73df16a3bf4cda24c62da0ed4b50fed3266205a582553688393be3c447aa94440137fc6e8673bd85ce96b783aa2abd006736eeaeefd81938785

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

          Filesize

          50KB

          MD5

          c2238772f9959e58476f9be85f8f2b9f

          SHA1

          3e5e46a09feea22a3f5703d64c3412862a918b0e

          SHA256

          088eb356f05cd3dda67f728bd84ccfa8cf560336ba9cfbcb07516313492a7780

          SHA512

          e528e637182dd5fb0a634a8d6f1ba1e0107588e5ae48048b82f28925731c20e261093bebcea404b700589536ea1408a96aa3710f608eee28c5af6e23e074ce8c

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png

          Filesize

          1KB

          MD5

          9a14601942efff019a3f0be298253010

          SHA1

          d41611f52f32a5499a2475e0f11b2c30faed6c0d

          SHA256

          0a0b2a4d9a8f8980e53e67da844d3fbf5487d97f8211efabe8375c80e1636585

          SHA512

          3d493757cad48c781095667cf0e285c9f4e9d69dc494b0a6bc3bbbb637e695a8ff099a4c72d2d79ab30acf978abefac637d3a2198a8ac57bf6333fb05a3d13fa

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png

          Filesize

          3KB

          MD5

          9369bb43635884980b0e36b42d793548

          SHA1

          f92896296866bf1aa2f0af6a2ed73221819f6df9

          SHA256

          68f9e40f1856811fa1dd8caa3e8e8c96dd5b93d4ff1110e276d3fdac3b1f9a78

          SHA512

          dae59d876b76c7b001d72636cfde37dade3df797d60eff6a639f820ffe7c1cc512823f3860bf3f12d3ecf4a601d7797a7e35449c42775990d447cf127e97e3cf

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg

          Filesize

          720B

          MD5

          e0214fc71024e60a29405378f8dddbcc

          SHA1

          ab1e28ebb195abf62f97f23922a2fcee2c161167

          SHA256

          dbbb1714146fd35647aac5a89e4ac34ab3c85b1ffd0bb46273746d313e39912c

          SHA512

          1f060d33a04f2b74b040089a616c415d3473d97978e798bb7f5b2767e7332c92e5f0068bcb5f35b912055bf1cd14b8a507427e829a112e316c3c1561569acdff

        • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

          Filesize

          1KB

          MD5

          3f4377fac0937e40a25a64dd43783790

          SHA1

          08417140988c81f42f8a9616d93c234ccb040693

          SHA256

          21f6a5498977d2429924874f11bb4180235dc2c37e58f86ebb8f77d541657f3e

          SHA512

          da42bac2c8328fd97e425cee6eb98e64b64c5ec74eed27bbc9fec502929be61de2d9485059f45817ebdcbefb4d2aa4f98e04b80d71449af831f8673d62ad6f50

        • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

          Filesize

          160B

          MD5

          823a08b9787cd0682ea827df02ab8eed

          SHA1

          bb52aa9af57d088217046a7adfb437c2fe80d26d

          SHA256

          84ad7e25792c4ae0cbe3a684336b2ae87940222ade3f7fb9c66f963a29726d0a

          SHA512

          b93559af2dbf0f2051a35449e86f528ebe3e7164bc3a6e85b1683fe138484c2aba2b2363f0885309dde6ab09ab1ae6034c2445dfb7f8612f26c54af3cc18024b

        • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

          Filesize

          192B

          MD5

          8d396bb23ba96e78f7989a30e8703a92

          SHA1

          a5885634e507285b7b439b525b6faee263628159

          SHA256

          2c9a32853276716513ad727a40490f81e91af21c801cfd0ed562115372374e30

          SHA512

          586775a2993a8917390497418bdb0848f5ce27c592fe0f27bf55545623d4d53fcd5a6738d3f5bf7fba4428586c26a2cc0f0879699d1474fa6319d776dd3aec4f

        • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

          Filesize

          192B

          MD5

          12374839880220e10c11c740029fd013

          SHA1

          b70fd5d43db94d57aa0697f63f6b760bcd82cd5e

          SHA256

          453e7e269b1871028c0be702efdabfaa7d8ca85bc812217278e7af1f854294c8

          SHA512

          5295bedecfda5a3452182c51fd40fe3b359f64ca591c2338af5ba4c8a0a6db3c8a04449073d5f1f13bfb24f1fb312316cf46c38fa8c025859246752ae8385e10

        • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

          Filesize

          1KB

          MD5

          9c62d3d813df8c152e5fc505dd8ce52e

          SHA1

          549c4a00cfa1da883add7144c4b79e723fb58b26

          SHA256

          f1d52b34237015a970dbf18ebc2f3de1df77c15154871cab9981960bcbf5b082

          SHA512

          c0d139f84309ef7cba38b213fb100bdaecbba2e2b241bbbc67e9613587bda3fac18239ec78b1c29dfbcda3342ebf0f93500e4516baf51ca9fb3b5c087eaf6674

        • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

          Filesize

          31KB

          MD5

          6c0ad21039027d7f33d693d7477ac860

          SHA1

          34a68f21b5c668c112531fc2b11930a7a89590d3

          SHA256

          73d2bbdd12c94641b731a8c426631dda5ef85184fd1625a69e896f482b6bc0fa

          SHA512

          cc38f4fc7a1d1a2cc69b8eef50ac064985d3676e768a16dd3ec1256fe1774d0d94a14a520c7da40cd14967c2d9f4fb8432409389e398f09e13f887b78ec265f0

        • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

          Filesize

          34KB

          MD5

          3e3ed38e3789497993e86e32c1289668

          SHA1

          daa12afcc723e7ab581a0d8f3c8c233093ea976b

          SHA256

          a75f860e6696cbd59446559b7b2127793356c227096975c4f1d2e09181046658

          SHA512

          4df3d76bea94d294419af0ef113b1c009d580ef0d5077fbb49633a67388f4cbd946cc190ac89abb65380664c846e5b92b97297432a5b7f2974a03d1e611c2d83

        • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

          Filesize

          2KB

          MD5

          02b61aea97a3ccf8a47cd6f8ff22d271

          SHA1

          793a9a9b076e2f1b326ed1126dd6ac26dd0cc007

          SHA256

          695f4e6d8bace1e7f14cd52f14bebecde13f692372676b9c4bb1f7f50d42fe4e

          SHA512

          65776393906eb680acb3a0c2cef3e7ee6bb10ab538fafd6ca556ae5e686ba1b8cfa90d9a41a89b9e35da658eeaa9b6ff61d2fe0e3cf19afe535cca67fad32941

        • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

          Filesize

          3KB

          MD5

          8fb1641442be6731c05f4a2422410617

          SHA1

          45979e69016d7c7907b6d83892ca4ccde2a2704e

          SHA256

          ea1eaeb385bf0edcbb0588196ab7c93c4011ae5eaeeac9f75b8543fd70ce8364

          SHA512

          4143f6f5cc398d4b05a65e722a44d290a58444e97be697ae7b5ead2c64ed94986a12ab5cbbe9119fb66b701ceb8893728455ed663319f80ae98c1a8fe689297b

        • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

          Filesize

          2KB

          MD5

          f5a6cc7718958f2c0b9a5cab282d2337

          SHA1

          e4d4041a7fb83485b16342d7c0bf702d362f6904

          SHA256

          3e971111bf8e021aaf3490cebf83ddfe76f30b60d8a375bde3689678c4d8aa9d

          SHA512

          4986be94bfec75d3865d94610bf61984b075b4f93c59f8eb521e806264fdfe0771f425990ca126bb1da708ca5ec403fc2ab2edf7e7e2e7148863ed75d6da849c

        • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

          Filesize

          5KB

          MD5

          2062146e09be4101a1caae65246bb918

          SHA1

          60da7503b2feccd7ad68a4dbb0bd1108632bdeb1

          SHA256

          bf3516ad8b30a495455241541e62de018fd345a46e797a5d99a99886df91a200

          SHA512

          f890f6aeecebd4c101819b2a7ec68ce988ffb79b5ea866fa08b6865deedd5920d4b717116da9565d5a7b20419ce90ef902050a0dbfbb59562bd25aa2cdde0432

        • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

          Filesize

          1KB

          MD5

          7519b2bc824719e694d301a69789c138

          SHA1

          6b356926766c518494d1dd495e0de2226defc358

          SHA256

          3c564b2344e00cc76dcadf21210c43399d30ccb041c96a01b9971dcf0338f42c

          SHA512

          7994b72f58bc08d6bb25a7274e1ad216d7ae833012c848448875f08c3bad42f56cd142b30fed205d1cf3656ca1186dd4e337ab9440f8a3ca5a7db09657d1af33

        • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

          Filesize

          10KB

          MD5

          50b5a233d7000863b2d073fd899173fe

          SHA1

          6c904c56a735c31b0f0dc62dbe0ec21953606473

          SHA256

          8256d194bd69ce9bddcf9e307367379e7400d2b3d705982210cdd6c8dc651116

          SHA512

          d4da98fee77a4a6aeb9edb36ac20593eba810b50d00cba4a7b189d06a811fa1a7cc03f784557d8e675fecfe2c2d6a57f3a72624475c5043ba4c80bdb8dced1da

        • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

          Filesize

          3KB

          MD5

          95753a0260b3dc4cb5162044b6526210

          SHA1

          07e1403f59494ecdc91f33d5065e7b3da6791cb8

          SHA256

          0d6314c9f2640b73cfd5245a3b60d7f26d14166917c39e896166be5465b6b48c

          SHA512

          d96662c1ec95651e79e14f32934a143452cda07686ac5cdeffa972a6427a1f72d74175fc9ff5b730afd8fd6fee6bfc389837a9ad5e24b548d51d325c03e15f1b

        • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

          Filesize

          176B

          MD5

          ccabf3b10be4d97efa91f803b56a55d3

          SHA1

          46d3c841db2e31421f08c44193ddfd0ff84dbbeb

          SHA256

          d3c590879e2acf5379c341680d93bb188384abcf888d28d4b753e578b87ed0eb

          SHA512

          36e0dc486f3ec1dcfeff8c8cd453a47198aa49e954ab569821c2692eaf873e6277db3c92766f84428d63070d445caa4b8e447cfd3b7207eb6f2f6c9dc9b97837

        • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

          Filesize

          1KB

          MD5

          6b76b2a71c3c5d86683d1c68b7a4a2da

          SHA1

          a1d0e6ed95150502ba77eac466b8101193d786c5

          SHA256

          11cb5d20134a530dd64b4b4e7f34667075924aa7077f603ce59f88bbd08e8354

          SHA512

          610fecd25df4a40c28eb0387a66d4e4a66c908fd22bb92ad19b725f7174554c8f2a7d0f6b9bf337c7309e6a95ae35e3e880cc66761b387dbdae556d713125d90

        • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

          Filesize

          3KB

          MD5

          879e7947b52befb142625021a519c9c2

          SHA1

          6a13c5ac03a5bc7e6f73a06ccd7590346d7986c3

          SHA256

          60f0dd73fce73497bc4101a54f6268e53aee882c5dec0ef50b489c0f09df4e0b

          SHA512

          c8db2e4a5dad31f1708e727f217eb5a5e34d3d22a1f7dea1cac16935b025fcc7f63a4b16f27b92dbe1f2687e79ed9655fd6ed0bc70406b0e3ec60ee61c9b4585

        • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

          Filesize

          1KB

          MD5

          af793c2fb8f40323f0c05dd878d2ec20

          SHA1

          3ce59ff71e1becfd584669742d3a61b094b4c6b6

          SHA256

          0923ca11577c9e58ffb86f645109e8cf4b9aaa7c55db54ba8dd9942bf9f73294

          SHA512

          19c8e1d1de34634281a5f2e32bea896d1b921a0f679d0166ed67b860c2e29a66e995a9c32b8d6b8cc9222c9782ec545bc436ffc078d6acf656bcf35beea0f9c3

        • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

          Filesize

          28KB

          MD5

          f7d64af96c3d6270711c32b33281a026

          SHA1

          08c8e8d8a8b679063b1ea947cc4d4cf293b24027

          SHA256

          4d92ca631f3e008415d9664557d0724b92283f33ec6d8fb27d09c41c964b7b49

          SHA512

          3f82b674ddda0b8a047d9d6c2fa57c35490a700fb4c4cee6ebab13672df2331de18cba36bc999031a1f5c235bd2568cbe07c00cee8825dd6907606478dc7f7a3

        • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

          Filesize

          2KB

          MD5

          8ac60eda2d6e5a35278ae4cec0900173

          SHA1

          090d2b6672bcefcbbbf2afeb197a24323edb0f43

          SHA256

          542cd7688532ca4bf71358180f406b53bd00b2b504e736d0106aaecbc346bf50

          SHA512

          85dfa9e98e95a8a1d47e64fdb025c9e2f47eb6686b5fe364f149131bd7c21c1cc076595a1a937eb6275df7aa29dece50df1aa2fc3d6568c36b2fb3f1a2f1007c

        • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

          Filesize

          1KB

          MD5

          66edfef2b4471ceab23547e5b887f5ff

          SHA1

          2af651309393f4d4864c9884e08f33db920e14f0

          SHA256

          46a424fda1733b9a233e39b5e561d15bda5966a4c6832e4449a707a52b563ffe

          SHA512

          89c760838069323d72d83daa7982303ddd323b9b08aa9322649625486634abb09d11f52b3281b8a6318af5ce5937e260102065e536fda27289b6ed76ebe58026

        • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

          Filesize

          2KB

          MD5

          bf72fff23973ce4731a4e25cc92a509b

          SHA1

          ae2d15bc0ec5b6a921d79ba81ab4705bc7dac738

          SHA256

          1a0917e977f3aa1f01ae0739b9a15600e99d6b9f51f23a98066fff23e26e2d32

          SHA512

          441af8450e338590399726d9e2e6b54e8259c069c27c6c5a8697136ac678adbd59d7bf66e1cd4823003fd0ceb12934956a7807c8a08f2ac9d0632bd927f6b87c

        • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

          Filesize

          1KB

          MD5

          fce9d1720f2faec54b09115147c44604

          SHA1

          fe916264f2cc55bd7c5de8234cd2d95ee79b291c

          SHA256

          2852dedede95bc96b5fda31421a97d2d8c9c78d048040fe6b235d4abe40c4fd1

          SHA512

          9682dc6c43d45bbab98f0e9f3183ebbc3f244a97cc6ece80f9c35d8fe4636d3ffe5a591ec2ea4f25db27fddbf597cb53f0a80c75b9fac9fd15236b4c1711cf06

        • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

          Filesize

          1KB

          MD5

          b5684bb006bad1b72069857f9542c97b

          SHA1

          53eed80f12dea35f959b9a083693e3aec6d9efa5

          SHA256

          980b586d5dae48b8bb03086f4b1f9ba996f88796936d079b403650d7d88bfb9f

          SHA512

          07e0e2d1a787936db938ef8bd9e38e1b60b1d661cfe4f89818e47d36463ef85a1b25d3c8e3ef681ea458f0b5fae18ef5c5713aef7c74132984fb96f5c5e76e38

        • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

          Filesize

          1KB

          MD5

          0ac69c9907c287ef299054c17d137777

          SHA1

          481ff47a2e761f228ce6115e9a0f2897d2fe6e84

          SHA256

          227d54eaf0eeeee6cf0a48100dfd5ce45ca815762a3a466b2c06d228dbc248e3

          SHA512

          948ef18f117ca556453e5ddd966aa1c4cc7344ceb9a22357f6da69f09f19263a0bbae9de80e89558e1004ef073395add6c612d5b55536d40750ecae8381ae749

        • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

          Filesize

          3KB

          MD5

          59b0ac72dc270c128f0939d032df2594

          SHA1

          b79767d87aea75adfd354e8ec93bd4221ddfbd04

          SHA256

          eda64911972c9200662dcb3b03df9e77067f6bc562cd5e2410777282d281239f

          SHA512

          3a2558dacef58a3d9f07e9906e416f9b1055d23661ab9e1c0d70a16a9a9e407d37df8f397dd0286b4495edd257ee265551d5dce46ea3d9e8d18368bcea4d42fa

        • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

          Filesize

          2KB

          MD5

          850aba1a30936cce98abc14cd253fad3

          SHA1

          7a2657a79f238394034fbb3eda2afc2805bb98a2

          SHA256

          de3cbcb0e7b69de9820a397f9b4bd2ec2ed0661a672b618f77c698dee12d6f2b

          SHA512

          7a0c28b7be653fe6f80007f2a5ac8eb1f361fcfd2ef1c3dd436cb91c7f7a528ea89da67f6b4b7c5556d2a076125a30342db54285bb1b807311c0fc2ce5ff3633

        • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

          Filesize

          5KB

          MD5

          1c1cc671898a7fb22264392d3acfeb8a

          SHA1

          f573bbb760d3666a6f4c63adf0b16aa6dec0b872

          SHA256

          e56700c22b492a609f0ef52f71e114bab2f96ef02b300c8590f4b4c3a6575c60

          SHA512

          dd02f84d973f89112a5ebc12b95848a680f6db15d27c50bc02e7305c907fa3f6c00366458b2648fb9132b2f739d8dd67fd0f8cdb0938a79b5a083748ef18d901

        • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

          Filesize

          3KB

          MD5

          1db008d79a52b273f405c19b9b30e8da

          SHA1

          8f9c046a5185cff5f10c304b567597e7c9146cfd

          SHA256

          9ead906d741d2c7eba29123d3fec374edb6b5b2eb7bf062cc6b1493530d4aa14

          SHA512

          26107e7847acae65d83b541896f9b9d5fa7959d0634f8380da3d2a1a06abc8cd7ec5c6b1700f38eef61a624dad0de8c9e6e32b92c799433e335836da76404b95

        • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

          Filesize

          2KB

          MD5

          6f76bda0cd4cc69019fbaef760ba9a61

          SHA1

          2662442908ecc0a3f1ab9be3be68fcc8bb346a3b

          SHA256

          f2b12dc0b40a379b82a56853ae5ebfd8697c6e1be14d72aacfd8898852e58658

          SHA512

          526062f5259c5388d466fe9e3126a30379968cc279ca0b99919219fc1a5a0ffaa9d4711b87e45487d36b0652b1363fed92a78ee3152e2013b0ea8c68094d32b5

        • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

          Filesize

          2KB

          MD5

          b62e952b34e661547fc95f2b89b06b3c

          SHA1

          92b3657d4abda33b5aeec0303dfa492e692cd33c

          SHA256

          7bc07ce141c5acdde062fc378819d46f4a5bc0d84981a8d939840b8bfdf585e6

          SHA512

          3946b0fc661006778234ed5f79f1ebd7cbd7fec1598390c289686f080ab59c4d3488e6cd0df8ad34c590acc7d75eeb6da23705eacae949dae772d1eb1b66d6c1

        • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

          Filesize

          1KB

          MD5

          fed4aec658ab7dd19e833814bf3f852c

          SHA1

          e1f2c78873f72b89a940cfb24b3f02e577fae100

          SHA256

          380fc52241621a4789a316e1e77eace59d1f04bfde7188821db80dbe2a3c9453

          SHA512

          6fbecf8673c65c4b486a40c036fb2920488ad027c8486f5fb1b07b9c931b13bd7dadb29ee08c2926154b1ac5dace8dcd090625964c95a801c2df566a37c5d0af

        • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

          Filesize

          1KB

          MD5

          3250df892800e3979ca4c732fd52a0dc

          SHA1

          5b2e96e2bd034d42a587eec3e8ba61dc15b8e30b

          SHA256

          3098970e0568bf7d7f6d5d54463108036dd5dac2d0c8351dd6142dc09a004ba3

          SHA512

          56803e0abe7a90fccbdddd658dd5a1695204cc26538dc73f805404f49439aa79b3a4f1b35ae1e9b9abb348189443f579af634423c6eacbc43dcadda891c55727

        • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

          Filesize

          11KB

          MD5

          ab4c835363482b2bc70771b68ec7962c

          SHA1

          b5334eab1c6eb5968bfb506e3b2bb8c60421069c

          SHA256

          2f55e0df7b03ee2ad6d4cc416125cd6b959042f319ee0ee838229e8f1c9bb77e

          SHA512

          fcf7f28136887d0976e97e0e481c963bbe295c5a680ca0a7b7e6f4aacfd123085fa64f306f8d026f44fdc56e314a2794da2ff6b0a766a00360389fdf4784707d

        • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

          Filesize

          1KB

          MD5

          cee07f393b21a6b035b57c1907b11478

          SHA1

          ebeaba86e15de5a353e2870e3dc98bca05205ca2

          SHA256

          c173f5595339ee7c843cb2aa8ffed103892900b601e570be24b2c04de228654a

          SHA512

          cd9182de02dec87229373e596f6a78fa6dd91e617ebebe613be2ad23095cc480df7456f1d8ce033b3f1c4dbec1b3c162709f2047da5a0776186d6f2a8f3247c2

        • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

          Filesize

          2KB

          MD5

          72ab84442abffe2b95f7aa942ceaa33f

          SHA1

          9be15203847cdf4ff67e8bb32c8f07e4a662227a

          SHA256

          7f64b7d74f9c7aa91390c3abc8f08f6e94e92a027beb94f305a287b64af4c526

          SHA512

          8f1a3cdd49fbdf30f8923c0df788866571aca99542b0a8c600111d28be089094a5229a5327236addb52ab54e6c890a2245298f45452597dc8846c3e865767583

        • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

          Filesize

          11KB

          MD5

          d4a5f1ccbb1d2c75fd15f40412abcf43

          SHA1

          a6d316e1164ae9d99bc4af718105c367ec1eb100

          SHA256

          fef645851ae78d615c06a55b455bf4456133dda034d8618b033cfc7889f7e71c

          SHA512

          205f1695e816e9c83f216c4eb2b52f5bcd44de4c90f9390a29ae229f232bf35ab22c76a2da570a1b6bb0e05588a97a0c02e725924c4681411f9bc9eaece6c1c6

        • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

          Filesize

          11KB

          MD5

          b56a3c4687834fee34955d7c5ea9697b

          SHA1

          25f7d5dd3046630d2b5f2dbb8f5e1c776c4c1967

          SHA256

          55432aa8b6923ebb09a4db53958795ffbf3f584fb2ac6a586113d49bd28ac186

          SHA512

          9960e6e3c76a41ca6b999533851e0162cfc86e1d0fd9a7529e12864c8eefd6f6a847beab894f97d426ecfa79dd7c6f51b5a8525e80bbd4d03dba264249b9fb11

        • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

          Filesize

          11KB

          MD5

          e39eb78f383e33525566d06680a601e8

          SHA1

          4f805634863fe6f102e6ddaccb8636d61b8ca0e7

          SHA256

          9822ac35ed921d1fb07e5e9256fd174b0bd93f5a9dc6bbe6f70a2f752581c4d5

          SHA512

          2e1c4b95fc5d5af77062a15f474ec8a201661cb574812e6e238cce4086acd287ef1a14d102819bdc6a116c2952d46dbd6a046a0838aab0de199ab73d6db45d16

        • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

          Filesize

          1024B

          MD5

          45daf46d6b8c493497869ca30dc040a8

          SHA1

          7eef7b2eb4a140258e575500dbb119160c1f4378

          SHA256

          e4d6f8b0b4296e1fcf3184ac9646f1e582968b7097e7ede0c1bc834eb4d00d0c

          SHA512

          adab95f91baa1fcda975c79632591350d9d9d6a6b209b0fda38d03e4c61207af10fcece509a4af1e546099388ebc4ca203fa054ebb7884d26618ddedacd943fb

        • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

          Filesize

          48B

          MD5

          e41e35e8d61f82f8dae104563fa2b28f

          SHA1

          ac85f37a7e7a623e3a179136f2837e9e2fa79a29

          SHA256

          8dc7a08ec08b1e02706c2a361b0580d3f10ae928c5743d30d38a9ecd057f4f80

          SHA512

          7fcd17bef7411b708223b16b05c26bf14c45263d9fbf29d90612584d579c7f5fd999049eed5eb246fe6222da936fed468dc320ab56d4368a5c8c4eb5c7ac844d

        • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

          Filesize

          21KB

          MD5

          fec89e9d2784b4c015fed6f5ae558e08

          SHA1

          581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

          SHA256

          489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

          SHA512

          e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

        • memory/3128-149-0x00007FFADAC93000-0x00007FFADAC95000-memory.dmp

          Filesize

          8KB

        • memory/3128-1928-0x00007FFADAC93000-0x00007FFADAC95000-memory.dmp

          Filesize

          8KB

        • memory/3128-150-0x0000000000F50000-0x0000000000F5C000-memory.dmp

          Filesize

          48KB

        • memory/3128-151-0x00007FFADAC90000-0x00007FFADB751000-memory.dmp

          Filesize

          10.8MB

        • memory/3128-2401-0x00007FFADAC90000-0x00007FFADB751000-memory.dmp

          Filesize

          10.8MB

        • memory/3788-43-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-22-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-12-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-15-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-24-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-5-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-6-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-8-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-10-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-17-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-18-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-20-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-48-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-26-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-28-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-30-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-32-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-34-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-36-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-38-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-0-0x00000000752FE000-0x00000000752FF000-memory.dmp

          Filesize

          4KB

        • memory/3788-44-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-135-0x00000000752FE000-0x00000000752FF000-memory.dmp

          Filesize

          4KB

        • memory/3788-46-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-61-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-52-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-55-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-56-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-134-0x00000000752F0000-0x0000000075AA0000-memory.dmp

          Filesize

          7.7MB

        • memory/3788-133-0x00000000752F0000-0x0000000075AA0000-memory.dmp

          Filesize

          7.7MB

        • memory/3788-58-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-50-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-62-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-132-0x0000000004C90000-0x0000000004C9A000-memory.dmp

          Filesize

          40KB

        • memory/3788-64-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-130-0x0000000004CB0000-0x0000000005254000-memory.dmp

          Filesize

          5.6MB

        • memory/3788-131-0x0000000004B30000-0x0000000004BC2000-memory.dmp

          Filesize

          584KB

        • memory/3788-66-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-129-0x00000000752F0000-0x0000000075AA0000-memory.dmp

          Filesize

          7.7MB

        • memory/3788-68-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-136-0x00000000752F0000-0x0000000075AA0000-memory.dmp

          Filesize

          7.7MB

        • memory/3788-137-0x0000000005470000-0x000000000547E000-memory.dmp

          Filesize

          56KB

        • memory/3788-40-0x0000000002560000-0x000000000258B000-memory.dmp

          Filesize

          172KB

        • memory/3788-4-0x00000000752F0000-0x0000000075AA0000-memory.dmp

          Filesize

          7.7MB

        • memory/3788-3-0x00000000752F0000-0x0000000075AA0000-memory.dmp

          Filesize

          7.7MB

        • memory/3788-2-0x0000000002560000-0x0000000002592000-memory.dmp

          Filesize

          200KB

        • memory/3788-1-0x00000000023A0000-0x00000000023D2000-memory.dmp

          Filesize

          200KB