Resubmissions

11/05/2025, 03:54

250511-egp2javwat 10

03/09/2024, 14:02

240903-rb57sazdqf 10

03/09/2024, 13:51

240903-q59avszclf 10

02/09/2024, 19:51

240902-yk8gtsxbpd 10

02/09/2024, 02:27

240902-cxh7tazflg 10

02/09/2024, 02:26

240902-cwxc2sygll 10

21/06/2024, 19:37

240621-yca7cszgnd 10

09/06/2024, 17:07

240609-vm7rjadd73 10

13/05/2024, 17:36

240513-v6qblafe3y 10

Analysis

  • max time kernel
    150s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 17:17

General

  • Target

    Ransomware/criticalupdate01.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>CoD31r6Q/KBsJ3NqcqcbOZhZCAzILwOgG69b98aWwDZeev5Jzb7fsaoSS0E7pAAxa0NNVybCVaxwjuYtp4OloISe7AwlMj7iwjEuO0OAO2WtQDUAHAQaMfNSKpW3NT8/MDLIX55EU9pxBWX28iInl1/fYb1nsv1A+D2wjgnY+FmZoX6kuZBcSXBTlSqDLs11WzBELpY1IoyblZ33Kb08HL1P6CsNZV5tCvfvAduuMIqP3g+NdE1w3TDGIlF1L7795aXKtBjJ8ejRolWXShQwHbxf4wQ436UbnEuhhmO9cb7Z/oeS9t9m5dy851/aio3qJPU9E0DFf4qpPOr/ixuqbw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1047) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3208

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak

          Filesize

          16B

          MD5

          f211d7562024b582ba710c3d29e599f4

          SHA1

          313eed160249c7a3a4a46f13f0714a5f69c8ab88

          SHA256

          1d66176c589a8419667c9d3a99b2683229c9559cfb0c4ae70ea777a324b0fa2f

          SHA512

          814a033ae08650070fa26008fc99583f685f51802d104cd2d4bd73f3f50d9d3c743eeafa23dbb25bb6fb175ec2354fc1e1e77c64af24cebb64df89d45a61170d

        • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

          Filesize

          1KB

          MD5

          eab78ded251067c29be524d97908733a

          SHA1

          2b8b1c89f3986ee7ff54e1c2a616027d41d652fc

          SHA256

          20ec6e36774f5934555819172fd523975b909108d5ea363d4463931dfd91b531

          SHA512

          81f8ca8a85b445e543b8209f10c8bb8685c33ea96f65a5c69ab1f73857728a99fe0fe8227d1c2aba1db65002c87a025e73eafaa57eed9bbe0077fcf0f6d3db2b

        • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

          Filesize

          160B

          MD5

          d7ddd790d92bac5b61d03ecb38919759

          SHA1

          07414a6ffc6e896d5e1854d5e2b24e0c3e7a9feb

          SHA256

          6b34db505fdc7a03addbccfaeb14bcc89d3ce1f2cdb756808ecab97d444c43e9

          SHA512

          81619dbbba3ed919b300ffeb11b6c7b3718eecb72478a0849fe975c3c309135623a3e53f3c73ea1180136b2ab191fb2b5dab51b3c889f234b6a482f0ac3e8070

        • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

          Filesize

          192B

          MD5

          a01f9bf3ad4bdbd476836d9826424004

          SHA1

          1c0585a5264812b3f231c6cf98654b2b9653d97c

          SHA256

          338cbe8b417746a544f310333b02355fa8990220ccb1f5b6353f082706482f6c

          SHA512

          6a801c01cec28eeca0eccfc2a05f9d36f13d7135cf8571eb781cc9f0bc3939137d52541f544fa8cff64664d0e6946038126d23cf1a77fe8a18fe47ca89af78b9

        • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

          Filesize

          192B

          MD5

          38c74f93127ee30eb50bda774b321d06

          SHA1

          dc03044bf78432dd74b74b921208e936223e55c6

          SHA256

          8fbb6a1c11d5343d743d6b66f18d4434c48d0e05bf15fc887b3fb60b38f76172

          SHA512

          627d00d479db7fb7f8efac031cf1229d612a1ee1520cb4d4766a6ba9379aeebe1e25c1f7f468390aef02f4ea879de81a14c0e6bc4104b75aee8a6dead31d2348

        • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

          Filesize

          1KB

          MD5

          7f3ec6f4b85fe21d3137a5d24187f082

          SHA1

          86bed8e7004df9a4071863565e3ab3f93574a914

          SHA256

          00559b54840df3cf0c8cfd59fd0cd8848c8467179f5ae15ec51ef1016933a391

          SHA512

          8b02bc5780ae484deb7ef2a6886d48d041d6adbe80e1bcd64b70718ec2714662f8da6581746ff38776ce8600903b5ef57095a858b710b830c441db2072c977e4

        • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

          Filesize

          31KB

          MD5

          2083b4ede8a40fb75f023b5670899e19

          SHA1

          6feb34b8b7c118415b48c7f87e1351e78e95f0b4

          SHA256

          11182dae725d06e27b34349e2ef1811a959d9bbe4abecdbe55fd2271d39efd8e

          SHA512

          fc2140dea496e074f63a9859ea14465638c812fb6ed55a672af1ca08f4e3657dfb87172ce5a8098ef6c064f77f294c3f015af969e942526a8e0e0d9bb5bf320d

        • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

          Filesize

          34KB

          MD5

          79514aef510e4fe9533a9726d8878d8b

          SHA1

          9d8ead2a2de9636c68ccf63c0e9a4193fa4295e3

          SHA256

          6e4b76c01cc20bcacf5a834662030afa443bedcaf056a6c4833de7340ef5fc74

          SHA512

          5994f1fc37cae791f7db0f2bcda50c82db7ce05dd81ec294cb95af2311b17e544a5557886cf09eb77a9cc72aa7470b61478eb833cb8dc71d1f4a6eed9aee2453

        • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

          Filesize

          2KB

          MD5

          cccd219b56d10831feae421cd940f5c2

          SHA1

          804bee9d05a175f0f9fc9e84e12df50cd835c97e

          SHA256

          4da91518d39c11b933b0feaaa92098d5e487ae71e4a17f892fe0f3ce60bdb183

          SHA512

          373eacae355a0e77fb96a04586a061469d90d7930312f9b3e80f1b10c4a6921fce58b38666a952ce2dcfb5451a1d886bc7055cb4f2311db67c16f42f48190262

        • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

          Filesize

          3KB

          MD5

          ba639f4675bf4c3c928c9dac5712823c

          SHA1

          a08a466931e60d4ddd4e72beb1d22542d15c99a6

          SHA256

          a37d5a759cb80cf56aee72f80b62c8cfc0a780c16a2d40f30fe9fe21cc812134

          SHA512

          d315dc5455d1a1dae5d0973be2e14abd529600ae73a61f50d7c6d16fa06499d7b9146f67aa1f160f5adfca817f57c3dfd7591ea4e5ffa5f7e507ce936120e172

        • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

          Filesize

          2KB

          MD5

          c08cd66386d312c1d5dce463c4408c0b

          SHA1

          ced310a9d83884ced55424f7d629315f80d28f4d

          SHA256

          daf754ef92de717c9ad20938d1b9da7383d14860e36807cb76957c0013c3f308

          SHA512

          6beb7cadc3f656d0f4a6280a54f529c1dbd051b38388884fa5e4a135195e6d6b52e85de84e1a3de3ab43e90c365f0c9fe4e580f308c5248a45037f6c9ec007ea

        • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

          Filesize

          5KB

          MD5

          75eb76617d42e47ababd180e612a5f58

          SHA1

          d9f556686a1a40affb72c5b802ad198cadd72d88

          SHA256

          601b64c6356aa6ad29386b43c814024f9823ff411538c068d86936966b8d6a9f

          SHA512

          048cf509c4c18a64063c42a4a4d5ed6c663211a0b6202cd0fde1b6877e840fd0314e300d722ad4049ffdf66fc28cfd99ce82e029f91b5fbf00d0f2012b2ae1cb

        • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

          Filesize

          1KB

          MD5

          422d7d5a7af3c732afce5c1a672a84ca

          SHA1

          baceb386cab461c811029bdd69a118b09fbef1ea

          SHA256

          4eca47be268d043e74f7ced5115b673a1d034a3ff326f1058fa38c439aca0fec

          SHA512

          e14ea728c6494377ebb36dbf10e3155123a6e70b5621f833855924e71783fe7c277a82b8ed0beba9afeff9bd94e58212fc7a8315fe314449bc27d17e7467a01d

        • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.fantom

          Filesize

          10KB

          MD5

          caf440e543dc23ec24b9173b664c63a9

          SHA1

          803c052da42fb0e78206be9d39fb7b69d7bd155d

          SHA256

          0bc2383fd6d3e209703573bb0a41168b7975782e924f2fdd4f0f274af7f8f964

          SHA512

          796e07ce4efca1526bba22168e32a1e4f6c3885b1beb1b8a2f583f0495b687da748e66c509f3daeb1d6163f444dba36181dcd3228df554603a328b4bedebdacc

        • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

          Filesize

          3KB

          MD5

          37a7cb02230cdcdb9622e07b104d5fc1

          SHA1

          b2a839f51fc2416f32ed6da48d6505f9afa2e6cd

          SHA256

          00d4716c80a50be453df023a0e2f3859519dab9d24369fb59d9b89f232f1ca0f

          SHA512

          09e301743fcd9d933ca030c69ed65f3f4c8fa8a62eb93682e7df87bae1a4127050252691dcb6979219c66cb66199dba5a509609c1c88267e45ddf21ce2f1481d

        • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

          Filesize

          176B

          MD5

          9a099a04dbb5093cf2e4c8195a31cbd0

          SHA1

          f5c04e8035bc8dad1e3ca583c0c05bebd908e5c8

          SHA256

          dcc8f8a94b7015dff61c906979967ff36cd8a238f16412d3a7131eae38552503

          SHA512

          19e4eb50bdecb3c68c2ec893a4622a28148edf9a56a00c9653151b29e3ac8d098c0b3df2a2239818f54f8d1f5646efed03a0a6eb3246bbffe82fb30a1c908893

        • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

          Filesize

          1KB

          MD5

          623c39e335148a8cdf95a56d44bc6fea

          SHA1

          7db56fbfcbad47de74c93aabe30b5555ea3aa7bd

          SHA256

          838b58e606eac5653586e4c2c5aec5cfa7dcfd182b165320a51fba6fa9f2ff09

          SHA512

          de183b8c53885f908b4a41bb052d3e20d176063432d43d8c51b695005e599a7782c0756082249bc0a995ab6f897721ec87098216d79362aaa0a2d1fb8686ed46

        • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

          Filesize

          3KB

          MD5

          d461c17d93951b35bf9cce0be4472cb8

          SHA1

          b4553757d1050ae4d97e10b19560a7d14fdc0b41

          SHA256

          cd42fd6252c4a96e02e0cab69b74285e8772b4c54b94665ab9318afe4955244e

          SHA512

          85a209ec1f481ece7195bb5aa1d872dba3ce74252bb1a3551b8840073a3dbe3e5a6edf07fa504c376e92a8b25c2f719585e3164c66c283036e34ff5e4b3e7276

        • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

          Filesize

          1KB

          MD5

          9311e412a97a3ff73ffb77f886003b40

          SHA1

          f4a856e2496ee6e9acdbeae182bfcb0eefafa78d

          SHA256

          edafb406e467e7086efc16ac73499fd7e2c824d803480a642542cb60ce51d8d0

          SHA512

          2dba720af70085ef0f4a6d08a660b4e90e7a84c3ed282f8d6541c1e248cb574d4e6de1f523ae4e1e8ae1d5a4948bf1e419da210db8f5f199b9d4a1a45936e096

        • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

          Filesize

          28KB

          MD5

          c97ff708395a851b5207c6cd2474b900

          SHA1

          cd15407aa8e03da3532ac68368eb1d054a3d7706

          SHA256

          09a7734ab6928fce974fc23b4e90f585967ca4d54e19fb04e9cdfa43e0e72a92

          SHA512

          9843c4d28ed4106f43d9117540c1d9ce58e38e02338f1bea430818af79c643709bbd004a55f3239b25fd8fa9618cbc9a3c880ddb0cb616d51570e89c9990c9a9

        • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

          Filesize

          2KB

          MD5

          0f6e2ba34550e408954170862de8513b

          SHA1

          999875a34163da8ad9930ee3444d2096f17a2529

          SHA256

          1b7d887005962ad3a3dc0a5e8cd077adc618de14f4bfce1209bddcba2f0bb0ce

          SHA512

          8ed7f750440a14563b813985024bad2cc6bc81a8f32b6928b701b228abaa5c7630fe24905f320f5eddc4023cca9bc24d8edb0d329e1596cb19bf4cc608d3882d

        • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

          Filesize

          1KB

          MD5

          25428bcda3ce75d543f9cd1cdec416d8

          SHA1

          212cbae73e99b18959d7bf12e38db4986b765ef7

          SHA256

          e84f185e744e0d0ee5ec6cd258001ce1bd08dcf3376096da195448b49c9c4046

          SHA512

          7288c6656bf801af2ecfdcadda5b271aacca2e9aa8401e8b8f5cbdf455dd08df521533bdb3648025ab5e3b5a0cbbf96062dc81679387db70ef24af4a0899f534

        • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

          Filesize

          2KB

          MD5

          66328b2fd8ac94935851d8375edddc96

          SHA1

          31fc90b049e0ec17806bc9ea811f3fa7e89fce9a

          SHA256

          97a507c9ad52ac59beea6a7cc6431d4c5617721210084118970de3b55520b46e

          SHA512

          bc690b154561568e9c70ce319b6d072858145e48042055d94416a143ae61e46cf216b21931ff4ca14055e9f34403c692d58704b06e49209b264418310b10f14f

        • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

          Filesize

          1KB

          MD5

          b610518bf8eae6d085ec14413a342eb9

          SHA1

          3a73dded0556ac05d5028456652d741d38eb4c09

          SHA256

          e9297d9340614c294289d6230905c234e70994f2fa32cac8f6974d394850c985

          SHA512

          d841a50b5911544712c74ffdcda8794155e4f1ec486240442f2670542ced70dc72d1e316a8e3bae2977b6fd0b783a11d927642cc8ee90df7489a7f1780d3bc36

        • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

          Filesize

          1KB

          MD5

          ec828038db689920a96bf729466e7d10

          SHA1

          95ce4b2639b661482f07a73b2abcfa52a1916b55

          SHA256

          aa8a425429006119755bae39427556f50afeabd26e0ae36906bc50efcb1b7a8a

          SHA512

          4088ef3f55e1aa18b9ca20c0e279100060281bfc19ce3045d05b8a7ddad9ab104be742f506a92391162f42f1ee1716d9d87cc3f75f96b51aa10a18473d486ffa

        • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

          Filesize

          1KB

          MD5

          c2d44e4310b9b8ab4c96c567cc31be8d

          SHA1

          bfcd952e371bfb8454474b0bb5edf4c1960c539e

          SHA256

          2cc79e874e6a821000c67bbc12cdf7057626d222fc8a0ae1a2cdf7c8a99709ac

          SHA512

          fa0517a5a3dce95196ec76c4bbfae10c17abd7dbe2bbf7e853576ad3ff4b685949fe0b9df7ed656acc1666dcac3d9f2e189e917097524dd647fad1d9d6f79b16

        • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

          Filesize

          3KB

          MD5

          cea43a561fdae58002fec51a8a28830c

          SHA1

          508b35efd8edac34558d52b5260ed7f6b61dcd28

          SHA256

          f29ff7e9f4c831d218ff1a5cc18eb1a89fb2c9aa13b3b255e34d0c774e4c2225

          SHA512

          1f3d74df91694165a7f387d28589cc92637fafeea8d8c7c02dc5b6ccba61c5aa097e414db14fdc9ea1550d8e6b746260eecfb98af3549640ab7644de6895850a

        • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

          Filesize

          2KB

          MD5

          af655a56a67dc0f59e203027ad4b706f

          SHA1

          9494868f531f7794cde87f1c33fc1fd07d44d2c8

          SHA256

          d7b511a150932a4d1a83a63705ec5bd2f674864972395319a96a3a06f34e94ab

          SHA512

          8603836f98c743857b175c36affee39f93fa6e3c7dc8d8074e70eb2625d6bfdcd3508e43ea678cc144e608a1776421d085e5e50f32531bfe3ccc7950a3c17170

        • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

          Filesize

          5KB

          MD5

          a8f465e5ba0056fd06e18a5384d1e158

          SHA1

          4cafa95b4ab0ec989f909321082beba6f2a0ddb9

          SHA256

          34632fbd93525d94b7e22a20b9088c02afe7b78e41fbde22eb31c48e93c14e55

          SHA512

          d92137c81bc7260acc934f52b3c2f3d341b8e1bb264293b69fa5bce0621fe1d3298f57d74de6edc89ecde256b1457b902204dfa54729d5505f2273de55cd72ec

        • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

          Filesize

          3KB

          MD5

          4817a64ccb9488c23108f2200bee6373

          SHA1

          a3ecdeda5f6302dd6e23caa9a72ffafcad47b597

          SHA256

          a52064abb4106d3ade5cdd1a7552cd8d54c4d78a88535ae1ba71fde00b856281

          SHA512

          af28cb10794f99c1f8a8e9b65aa420fc8ac77f9c3365fb9c2f0a94d4e18cdd57ebadbee31e39dda0f0ddf302424b52650a51ee883ccaef9ea0a4823abac74b46

        • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

          Filesize

          2KB

          MD5

          fa89abbc5418d3de30a6258d827b849e

          SHA1

          413c8ac0cb6f9d8bf06a6150b3d8d715e06df20d

          SHA256

          3764d56443f7d7bb186beca7f9fd7f16ad382256c5ecab5eb4c20ffdf395d01d

          SHA512

          866d5b52b2000008b3259fb7724b5be53da9d4a0443cf25ed3c5267dd4e4d1c11180f792918b8c8354b7054e414c6247e409955b8e849da2bb2c35866bddec4e

        • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

          Filesize

          2KB

          MD5

          29530b9b5b43a487bc0c87da44ec2e41

          SHA1

          696663e8188817cdf1eb4bee57e71d7c9b3eabf5

          SHA256

          ee4aee7e26938136e82b3c33a8d3eee118b7595f2e1bc0052ff3cb610341831b

          SHA512

          eb3ccec0190c06b0bae23619a1f1c9f429abfa842cc6c165517d12ed9f278244cf12ec24c57912d65ef3d9814cdb6f56c0249cd1e36e7e8853750abf8ee4e3e7

        • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

          Filesize

          1KB

          MD5

          ce2683a3c5b8d04fc0efd130848efb0d

          SHA1

          a638388b4f7dc25f522b81b9f244d4155ec89cfa

          SHA256

          41f0dab87609afb97f4c9918bd51a94509da889040e6a250b7ae5571688a5129

          SHA512

          86e9c4d600d1a8b589fb219195bebf61b54499fd90232ac7340d0db9b9e2538b6a3781b506a580b703bf1500404c17e629c9ff0b456c91cb658454c3ad4b54e8

        • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

          Filesize

          1KB

          MD5

          131e8969965eaa94717173c774cefacc

          SHA1

          c20c078ec5500afe7fe809e486ac862d16a7d2c0

          SHA256

          27e697dca6691c4268eb34dedc62d869c9b44af4e1fcf5fc520223efb56d7cc4

          SHA512

          e569fde659c5390c7dee5a40fb5f59833b0b9c3dad5cbc9f49f6870eee565050e627e9c594ec5b5c25918880cb8f8f0e0d6520c73b146293b87a18159634d024

        • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

          Filesize

          11KB

          MD5

          7f99c5034e4e1b7177440a07cde4c819

          SHA1

          fc96d50474e8156d3db1de703ff3eb6a960413f4

          SHA256

          4c8f4a12fd2d255a882a384f60ad4a748dd2534732ff9e399a42c82cfe617764

          SHA512

          85d952b36538426aad0ae1bc3936ff279c661bf3142b4b6e020993fcf622a6b8d9814acb6f025cc4f4babe55bb0738e0e7e274e48f41f0c24fa6c7e53368a17f

        • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

          Filesize

          1KB

          MD5

          0c574bc443c0555a416522a0203d8a32

          SHA1

          a1768f5231a767734904d013a8d2f037403355ff

          SHA256

          d0735f62d6ec4dac9ab2c381c4a840463dee0c6867e89b6e6a657c622824b1ca

          SHA512

          e95868575e857a2ad31d54bd13f7f3292a0fef1f521c6546c68df5303deb477c7a99e20d6fa2d6c800d770bd2e5a387e6b3e9ff33a2d5b2924ff37cebcf9716d

        • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

          Filesize

          2KB

          MD5

          d1e8fdec19513c940de23a099e26b7a0

          SHA1

          e48f07bd9f9c32746cea26f0c9754541519e1424

          SHA256

          c8460b381507bfaabf056dbf601db641c06d89c81c687c8f4247c0942c97d845

          SHA512

          5edfdf6c43510a1fad2d4f0a7e4e5fdf61ff2f1b562c6d4c8e80c526f7f04c761dce8de84486e0832b4ff45e006468473866bf571fad2d4a9a530deb9064a11d

        • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

          Filesize

          11KB

          MD5

          c01cdececf2df0924fcb60eb93b4c4c1

          SHA1

          8d5f95670dbe886ab391082240c98bf5a2150f17

          SHA256

          3466d941ab3e6644f0820ef8f32f57c4c758d26538f208e43a8af44c9a939e64

          SHA512

          67e53affeb749d1d0b5ff05d2b47eb069c50f9fe1aa3ff823f7fd79f5e9839d4bd3193d88b86854ef72226802e7760b8fa28375e28617b19b0a9df546e198b88

        • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

          Filesize

          11KB

          MD5

          388b87d832cfd82f2d7d131d12a2c682

          SHA1

          3128f5167a83e740ccb59c23847581f34c74d2ef

          SHA256

          51bb2b252ec62efb07b238c1af18d4975e2047e5f8d830e4a7b20e6bcd3d3699

          SHA512

          2861949da26a8b497f186b75b91b919b23947a2d3f7c89bc82481340d359057f8b0cafd7a1579873bdc706a148f0499ea2f1b671cfbd6546b6c1b137e468151b

        • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

          Filesize

          11KB

          MD5

          406f0680b6e44eeee9cc8884a1d28f24

          SHA1

          05a9b52c2bcd739101e540a4353c900f8a7987f6

          SHA256

          cb42eb5d21597a058b5608d9622ea635fcf6897412fa1baf59f6713483f5b90e

          SHA512

          cb9983bfdb96146f1c5e9f25695f0cc20c18c7cb8aa1ddef9b3207a3bf3675d04146ea879e0702f08510e6caa59f796c82eb666277d4c95fbf21f3591e28aee6

        • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

          Filesize

          1024B

          MD5

          fef7ea911c8d8332bdb23ce7a3a50c5d

          SHA1

          e7005af3b8be915fb6c1d0dc823f88faf16bf774

          SHA256

          b6458f22f4514aa800300a67486acc61eb3a5925225c8de66794a0e70d849a54

          SHA512

          40a52d9b5e50c9121d9d1a9c2801227f660fc2eaad1d93a145b2da502d3269cfa474c1e7527e506482777f4fad010501339d8c4aa1e246a2c24c23267de8b3d8

        • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

          Filesize

          48B

          MD5

          e5603cd9babdd159dd8ce49d06dd1b01

          SHA1

          d5da13424fe3d21d91c40d7e52bc4db1a5509b7a

          SHA256

          75042387b1d6a38f133524f52e1b3ffb7b24a89745117c0b3c6962fe9a3377e7

          SHA512

          04bee2804ba418479ef2884a355ff80898e4cb7418cc193b3a408e03f368905ccaed1f391269a12917a05662a1c120a843415bd3bbc786ff7689ef54566dbc6f

        • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

          Filesize

          21KB

          MD5

          fec89e9d2784b4c015fed6f5ae558e08

          SHA1

          581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

          SHA256

          489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

          SHA512

          e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

        • memory/3208-150-0x00007FF96E2F3000-0x00007FF96E2F5000-memory.dmp

          Filesize

          8KB

        • memory/3208-1501-0x00007FF96E2F3000-0x00007FF96E2F5000-memory.dmp

          Filesize

          8KB

        • memory/3208-1941-0x00007FF96E2F0000-0x00007FF96EDB1000-memory.dmp

          Filesize

          10.8MB

        • memory/3208-155-0x00007FF96E2F0000-0x00007FF96EDB1000-memory.dmp

          Filesize

          10.8MB

        • memory/3208-149-0x0000000000590000-0x000000000059C000-memory.dmp

          Filesize

          48KB

        • memory/4160-133-0x0000000074A70000-0x0000000075220000-memory.dmp

          Filesize

          7.7MB

        • memory/4160-137-0x0000000006070000-0x000000000607E000-memory.dmp

          Filesize

          56KB

        • memory/4160-136-0x0000000074A70000-0x0000000075220000-memory.dmp

          Filesize

          7.7MB

        • memory/4160-135-0x0000000074A7E000-0x0000000074A7F000-memory.dmp

          Filesize

          4KB

        • memory/4160-134-0x0000000005330000-0x000000000533A000-memory.dmp

          Filesize

          40KB

        • memory/4160-11-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-13-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-15-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-17-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-19-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-6-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-7-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-9-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-49-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-69-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-23-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-25-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-29-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-31-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-33-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-35-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-37-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-39-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-130-0x0000000004BB0000-0x0000000005154000-memory.dmp

          Filesize

          5.6MB

        • memory/4160-0-0x0000000074A7E000-0x0000000074A7F000-memory.dmp

          Filesize

          4KB

        • memory/4160-131-0x0000000074A70000-0x0000000075220000-memory.dmp

          Filesize

          7.7MB

        • memory/4160-132-0x0000000005160000-0x00000000051F2000-memory.dmp

          Filesize

          584KB

        • memory/4160-41-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-43-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-45-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-47-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-51-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-53-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-56-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-58-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-59-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-61-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-64-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-66-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-67-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-27-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-21-0x0000000002500000-0x000000000252B000-memory.dmp

          Filesize

          172KB

        • memory/4160-5-0x0000000074A70000-0x0000000075220000-memory.dmp

          Filesize

          7.7MB

        • memory/4160-4-0x0000000074A70000-0x0000000075220000-memory.dmp

          Filesize

          7.7MB

        • memory/4160-3-0x0000000074A70000-0x0000000075220000-memory.dmp

          Filesize

          7.7MB

        • memory/4160-2-0x0000000002500000-0x0000000002532000-memory.dmp

          Filesize

          200KB

        • memory/4160-1-0x00000000024D0000-0x0000000002502000-memory.dmp

          Filesize

          200KB