Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2024, 01:50

General

  • Target

    LisectAVT_2403002C_66.exe

  • Size

    261KB

  • MD5

    522cc277fe92ba28c0df898c7da2ec9e

  • SHA1

    2366a44bfbccc70424e07e22b0c3294bca2fb9a7

  • SHA256

    813a9449049448ebbb4e39a3a024fa258b40730c86648ae706449c1ea8730439

  • SHA512

    9438aa0a25c49723b302c1dbcc7ec4b2ce2315a6a145fbd57dc280f1302b0d097877c405e49e0856d08ad87e1f282cb6768cafdf369f2221695489ff508c8f0a

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUg:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdz

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>G0eX73WWiL5kutm5fgd4XOmsR8YJM3dGzNbHNpDwFY4Cn8wfyhy8EOsOt9NNLnk/KDUrJY+RD2knBQ5v0D4SaUgUQljFSRo70C7WaXVjV2387YXBVCXOMmlFY0/AKHoN3lgHbhkhha5sc86nl5W6acoED5YEN/eKq7tPkiAOhjMaRMAf3fS/5rQJhbIhaMh/VNFzhio3z/9FHI2ua8+fnDxGjFE+AfvLS3aOaWInN0nrAU5EeRT3mUUEay5oN2WuorQ/xQPNmVmnMUGbR8TLOw1BeSmIeXNVjaiz31psJvHDardu8SxhFBfdrHKWQ4y4Lfe8J/swyHFgKeUvgjS2vg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1037) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_66.exe
    "C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_66.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:748

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

          Filesize

          1KB

          MD5

          c265122700b01e3ce37498a1ae64184d

          SHA1

          4dbf95f956461cc651e907614ead8b7e9f77f6e9

          SHA256

          2205d1476f0cc2e2f4dcac9561c910440b0e6871e2f30592dd99ce2414714b6d

          SHA512

          18b80378eac05b9cc520181bd4ea8f9e78ed1c05a9b460e79cd578b1bfcdc3d05e6ce720b26f42df3de80dfc2eda06c9e01b7b33ddd6a87f7535aa5dc7747dd8

        • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

          Filesize

          160B

          MD5

          a74d87652c37813a96c3f11a6e813fef

          SHA1

          762fa04aaa6da0e4fae8a444bec0438d36883c03

          SHA256

          73caeb601f23d87e5ed8cbc0d2b28fead7467452a72a60a5df92805b64fe2bda

          SHA512

          770b90ac48c828e109d7f18e1c97c1af093adabfbcc946485f1c361dcd55e3b3f1c040ba622906310334f04034deb35260a2015a83424b2f0fe21b4650315826

        • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

          Filesize

          192B

          MD5

          1120f0cec534d90169888cc00dc9673f

          SHA1

          d245a970acd4b5c046c16efb23d35b79696c1cd4

          SHA256

          4f88c9e779a469e92fb51099eed116c3dda007467957d09327a2b2afce120d9d

          SHA512

          00c97448fa21d04a9c038113db0036c2f6c25c321f95194803e27f46599adab9e9681e06dbc8e148cc39cf9efa9f64520584ef6e5c9e282159c43659655ce23d

        • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

          Filesize

          192B

          MD5

          0c7d7004b588edac498f143d813489ba

          SHA1

          f2e2bc9943bc2dc9e5c751d7284ffbd1bab534d5

          SHA256

          1db82000cc01f95647d1321ff7687efb1dda17d39febb2d50399d3fe24f336b2

          SHA512

          016bfa4eb607df1316a734a82a5ed3a5f9ff96c11b0a93148ae37bc2836992ce9edffe8af939303189e588dafd6eaa2bc7cdf577034fc34506216093d8b64153

        • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

          Filesize

          1KB

          MD5

          0353a9183d0bb8f16d7f9bee889f80d7

          SHA1

          2ad0d015f9a2a3cd6e79a575779c5d0315966511

          SHA256

          259dc40bfdfa84eef91cf52003aed8c1ae4736eaafdc69583f31ceb28b0662e8

          SHA512

          0a7b552e23dfcc9b18ec06fc6421c3978a58fe40468401d521dbe481ed0c944e14b5c9baf48c02cd8ed5ef69000e588d817e252a98039b47467361ec2eb61732

        • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

          Filesize

          31KB

          MD5

          5e8338d7782487b63f473d6e66b7633b

          SHA1

          ea5ef3cc48b66ea6698ca5ffc19a06171be1a2d7

          SHA256

          23e97b0e4de7596d00d0794e1d1a101b1562d53eaf6f04eec25e4ca24ac93b94

          SHA512

          3591dbed5cc946526fc0ab49ce9d5440583c0006db8789f6d50b2d97de753f4882dbc0236d0f996a7c3e2ac0241922b7423865d5423c607be20aa4de901c8eb0

        • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

          Filesize

          34KB

          MD5

          549572d8447ef9f005f42cf276a12853

          SHA1

          77bafb9c22a41df22eaed347bc8573310bf135de

          SHA256

          241230cf8bb18b3bfee9d08d7cecc8ce56962c4f5e678f28b4e84ac1060190f0

          SHA512

          cfe0acd9e3b30ceb8359e72ecc4e370232d572378e2b0ec0af2d4c560d52aa8a0c14b192e046e1a7e8feabc0fff1abb76f553a599431c13dcb54fa33884a645b

        • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

          Filesize

          23KB

          MD5

          a9c333d62163f41ceb72f091de09aed1

          SHA1

          4f494de61cc69959264ae596408437b2327f7cb4

          SHA256

          823f01e9ac2147a82704f44413e39f8dc62c4035692c0325415ea8c0e1a9efb3

          SHA512

          3fb89ffb68661f3d41b167e955aefeade35ade0c499ede4450d0aecaec45daffcf10e4d0b1e04b2ebaed4ce0401847567106503d908683bbf306c059fd0d0b31

        • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

          Filesize

          2KB

          MD5

          02734afc89c45a08f59c7046a82deff9

          SHA1

          caef216660a59662ba908307a2ed476e7612aee4

          SHA256

          83e00523761db27cc839fc6f4138c55fa7a202e9dcc7d449b5423df4dc676695

          SHA512

          f92d3437861efcce2141cde27dc4816e56809dd03914eaa8d864001013a06c0b1bb5ac791592d874b8c60fb4270f0a17eb16aadc3ef84a23f3b612da5f4974f3

        • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

          Filesize

          1KB

          MD5

          2e8838218797fcd6ac9c1bfed4114a3a

          SHA1

          46fcf758c7a1b2ba499fc39e99b534edcd21aeb9

          SHA256

          3812b602a39df4f5fb7c3591f1ef432f59c21959bdc3aa35a5ae8bf3e26247e9

          SHA512

          17239e0618bd5f706c35563d21fca6dc081219cb5adbda9b5b9ac288448d8c049c6aa9644b2c1164f7adba80bcaeb044f893b9d159c15a4c0b529d48a06d1324

        • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

          Filesize

          3KB

          MD5

          640ef09e688be3cb857f7187a62e2e8e

          SHA1

          e3fdd4365c1e45ce3d85086e48f94dc79dff1a99

          SHA256

          908d4f9348a189b6187a145857571f4d87320e3d4cbe94ca61e0430dbfb40b8b

          SHA512

          036a65afdb51f70eefa13f773493ae965b19d45bdb6750861ea52044e009cc9c4dbda5f7f397a8be689d8cf4a96a80926c5d3c4e3b86696b3d46853222880dd2

        • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

          Filesize

          2KB

          MD5

          882034f30fde62aec6afae1ee492e232

          SHA1

          ef271a82d81045c8deaa0308181b9d59681cc9de

          SHA256

          33b4b02fb1129117861bbb5dea470cbb38eac50678bcc8558ddc6c20627d919b

          SHA512

          b4992505bea8bbde6391a2fdd373b6147dee759434eeca22e22628d27cca9a4dcc953cbb924cb14413128f5fbe25e50b20fe39b545b6e6794feae838a38a657b

        • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

          Filesize

          5KB

          MD5

          df1d86b42185351eef60a3f070c66916

          SHA1

          208daca4da041146a26293bb231d487cdff94b8e

          SHA256

          62348ccdb1400678de4bc1be5423c8edd20a169a3f01a6d777d8ad6c2c2bfdc0

          SHA512

          081a7d619e18eff7d71ac6909c27a0ceb9bebb6661a7df4f53b3711c5381d87f3d62ad5cae44a0c57aef4569d667bacd65d54c003d11411096c981e175db23b3

        • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

          Filesize

          17KB

          MD5

          7aacce2345523cc8840b233170e5c3f5

          SHA1

          fd76f4883b4d47fcf4e90d8fca815e564b81f186

          SHA256

          4d124a2841e539a742d1ad0ad923bda1799c57953c87f5901cd89c9b13a18fc8

          SHA512

          9afe2480599b07d391ef4a37bb1fed1a7045ee5704228ffaebd2111848646fa5226756a42574916735c3bca5c881ed5a6602b0ce9ba91fc6077085da140097aa

        • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

          Filesize

          320KB

          MD5

          78448a9beb1bc93fdab4ec6cc25ded1d

          SHA1

          84fe041765574fdb46edbcfc1c67ef67dd627773

          SHA256

          afc7f48619b225e6bca49e71f1869219c55ee982604ff295ce651d179a7b2dfb

          SHA512

          4969ae096d7306a531683d4d503d964f9e2072010db7eb344de2dba0f4f85df6cbada1f3851c0dc8f9b8fa2fd270eb9e5ccc436f17070993852bc91073631a06

        • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

          Filesize

          1KB

          MD5

          2294e7fbcde07a1306bc7c4450c29efe

          SHA1

          da3df8f21bd1585465ce11909ef3091749aa0a83

          SHA256

          d1a6bc2938e86a56648e579907c2c6e7d64fc8e425c1b261fd481170a68a9c7b

          SHA512

          ffb4679d7d4fda1bc72c148e22be6b55f881ed1b0fb033552edb3a5fa0a72419eb13577a08a9dae38d66cca8aee8e615f23d177eb30fc4758183f4168715f335

        • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

          Filesize

          10KB

          MD5

          d8073acf66d47e125897019e695c2d36

          SHA1

          fd9a2d03ae0c453f8da237d85c9715f96f96b172

          SHA256

          5648bd8050d95bed36f405809403ec7f13db248cb0989bcf71463977ba720894

          SHA512

          9e7458654085d50b684ac3d470851436eef5346a3674df0539eec113d094843eb585c1cc0a23f4f92792b82ebad78c125fa36811c09e6c906776b191a1a3b525

        • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

          Filesize

          3KB

          MD5

          41cd2b3dd87eaf17a9d20f3195d0a2aa

          SHA1

          b9ecc2ac72f45399a95bd7612f3e7fe0eef1c9c3

          SHA256

          28d98ac8b10b418f25c5a43c2623e2a719791b9df9e8e4a5f1465bbfe024e510

          SHA512

          bd3e30a52cdd0c7781a0dda26a7afa5133ee7826b5d70656e9faedbc6fad8dc4dfd82c69a4be5e1164535f1b603ad8aa2af027120d80ed3792867720e03c85b2

        • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

          Filesize

          176B

          MD5

          f8478d0269c2309aef58498f777fe0b0

          SHA1

          694571627de0348cf124ea058bf978d28ee005ad

          SHA256

          fbe9453707bf22f81c3f41aa82c22ae40b454f5febb3e0e9a6835c87757215f2

          SHA512

          51c48856a35252588d4ad9f2754f9624f76bf8d2c3ffdc630ce46c22954293937549aa479fc3a9c612a9f031a7f5d74f5e28b01709db2aa5e506fdc4786b38ac

        • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

          Filesize

          1KB

          MD5

          45a885037e0f255a73bd4f527b6f296c

          SHA1

          80ff76fca88a8e32592aecaec8b2a90bd693da2c

          SHA256

          8f713b03b6d6055cb3aa23bec33f46cb32a809a75dd06b74e0e271454f534a4e

          SHA512

          1068cf270c67852554fb8518b3e64538c50db5d1b54aea7a0f5b372c78d6237d71418254bca19989c852a69022e12c2d510d91926105460337b622c159930ac1

        • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

          Filesize

          3KB

          MD5

          ee462f0ee8f55c150447e9e73038fc06

          SHA1

          45c934d50243a06b1cb3c5cd2c902cfe1678787a

          SHA256

          38076bbc01d58315c887c37afc178deafb33a1b44e66e878db8fb3e5137de55b

          SHA512

          c66a6d2a62e12567ab54a0c733645ac5dc5a962c47e2a920a63bb69812397fdc2b81e6987c92e5fa8ff10e73779b647ab6aec879dfe586df4c532796bb9c4801

        • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

          Filesize

          1KB

          MD5

          d4f716a0e45628d113459a0cdb9ec993

          SHA1

          7b03f91a6b8b3dd1351060ff3774aa34e20f32eb

          SHA256

          8aff78442be4c70921aa0428de5358b55e45ee991f4022c2d2561e590f3268ba

          SHA512

          ed4e28ec74efe0d31a9af44aa0b5322b222b347c45acdd7481ad2f1fa8f99780ba23b37aacde54de08f3e46183c07c60346b1d28c00db50d2374e4fa61673507

        • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

          Filesize

          28KB

          MD5

          02ae5ab4758dc45819a0ed9cad72dc74

          SHA1

          f228038dfc1bc1dca64c26893e83e5ba2af49189

          SHA256

          f723e2e10e0a09683aba9eec580080f911f88c4e0f08bae5fd8b126fff6a90d4

          SHA512

          f96dd536e96701fa74c4adee3f8d6e9b34ff5d9a5289b0ed5acfeb16822bdbdfc2cba12ee5a14686d459b10d8f05803ea4ee5544b75e60f3a9d092a84cf49bd2

        • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

          Filesize

          2KB

          MD5

          7073072f64e02c9eb70aadccabf90546

          SHA1

          726163bcc17617a64b03b321d325482c08088437

          SHA256

          5e61c47461f5b61b935d8a9ed090c145a705bdeeb600a581118c3f1f14d83b85

          SHA512

          8dc5c8d81af1e03e59b7a6192910895f00aa44ba545981c13ccf1502df571be7986bd6cd5d0fd63c5468a034cd116948a2f7aa8d4134bd7741d7eee8c41067a8

        • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

          Filesize

          1KB

          MD5

          d3f70d4fc157626a0e7d36df43caa801

          SHA1

          2d0e5e4e9a7ff5df9869b0220b1a8f91d60f6eae

          SHA256

          cbb8c4127ff0a69edcd58a5f0328e99ed459c6cf8b6d4e0ab99148f99c463590

          SHA512

          5a7737b25803ffe5d9366803af8536072bd8a7e8ce2baed0a3b5452296cb205f95cdd9bf7378d6e174eb3b9528612d29a2bfcf9d019a4d2d4d0460b6d1c7c922

        • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

          Filesize

          2KB

          MD5

          635f45790f5e5c63a8f99ea3176a5d95

          SHA1

          afd993b5af839389933474289b3672ff6a48765c

          SHA256

          b4976a3fb2f8e1d667e75e548b70be17c9af460c4b4e2bffc857810032635131

          SHA512

          fc1a722a98b8483973d78ef8e2f2bb4e21816e7fb917669f3fec4c291d8334f528fdd573b52d1394c63359b88ece429639e81e0a3e1d6eccff429be9d6790aa1

        • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

          Filesize

          1KB

          MD5

          1865b1a1048f47ce3edde8aa69dcbb22

          SHA1

          a32819555a767a7622e2c95ef63da71316112372

          SHA256

          37b529fdb4c3be2a42a2b2c9eeb50eaff2fcc7b652ba78071a0915fb5d6f81db

          SHA512

          e690aef513b5507ae77b293a9a55939a4bee291921b8e898dd99f97c5a3d4ec2316e3ba34e103b27b0140b073d9401b4b03a31421cdba10d6d3aeab35d3d6e64

        • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

          Filesize

          1KB

          MD5

          81d51cc22866409acaf0d325d6180c22

          SHA1

          6882a243a2c8ab2b9f649433a0d913be0240b2e7

          SHA256

          3c752bd28e88321752cef86be97f30c39af4be45cf0f883e9ed47dde0e3b5768

          SHA512

          edec3696016230eba18ec4e46234fa2801bdcdd4ba12c8797817c9d74626931a4935a2d60c5082222b30359c56d1ef7b4e92ee79f028732a1a497b01fac04f76

        • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

          Filesize

          1KB

          MD5

          38901c0a7424dd2344287d187103c57f

          SHA1

          c36d9d026948874eb3e5b82647390ac98e6e710c

          SHA256

          19c2757a812cc1bb29ab1b37b67453b82d9e9d8b92fa16cdca3f377586fd391f

          SHA512

          a175255dc1715b00e959b3ace6349b1406e3b72e444d678851f32c816afbebd8aef56084cb4c6596a3dfbdd8ce7e5fc57f0efe7e8683e9324073026f9d0736a2

        • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

          Filesize

          3KB

          MD5

          76877a4bed1205def4344eebccc7f4ba

          SHA1

          a6bac4eef6e585b783048767c0f5deaf0978f785

          SHA256

          b36d90dcb18120f1ae564a96652761e36348b0d44a95c26f1adfabf51ccdba4e

          SHA512

          1c435e2fef6aa22f52bac4828a1a34492efe107f29322864dd96b2b7e6e7d5b55d8fd355365e678bcf2a56574b12a1534e8bfdbc19197a5d3742f3c15435e9e6

        • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

          Filesize

          2KB

          MD5

          420c3ce700a056ef500335630710f99d

          SHA1

          674fd2956ba6a159ac7bcb73e9f2018db73fc63e

          SHA256

          e3a1f5b1bbf434e75234185697fe97168870e04025072125069dfec751fcdc30

          SHA512

          9880b416418deb1b1cecb1923b89158bd0213d1b42b9160c641abb16cd555ddb3b34f1f8801458bc33337814e24c53e32458413395c3e6496852853dfcc68c9a

        • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

          Filesize

          6KB

          MD5

          2c736f659d73431557712eff9cc85db4

          SHA1

          31095c426b0580012da9b99334a87fe3f40367aa

          SHA256

          821ada65eff88c78e5dc8d3fc2ffefd5ae2227c479cdd523682070cdf66974fe

          SHA512

          d549eddee0018ad288122bd9d9e5150904e09c626946c5bb0e79fde5c30ce0f5e5cc56bd7ebb5f40e5b5f29d67f390e6fa00741d99e0143165f27f7d5ea0ec23

        • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

          Filesize

          5KB

          MD5

          0cec243a5dc530872be176a9e2038095

          SHA1

          9facfc85b61cb566a2a7b3a31d491921122c5564

          SHA256

          cb963493b5a3023b76e5b6d39633bfad9917610a332d6d653b5bff94c1062a7c

          SHA512

          f49d6048202e44117bead65654576fc35d63c52678796f2406bb372c821ce3355ff3521e1afedae44572f5d1c095a2d0d35af5aa9032a916758d58d4aa2c62bf

        • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

          Filesize

          3KB

          MD5

          efc8cd24350d6de3e62a0022ce231673

          SHA1

          1079fc417e2fb8f3e3fcff11c2a61dd314d7146c

          SHA256

          12d33f03676234739563ab8b7c7c74f255a890a492f58e910f67aa23ecd85783

          SHA512

          e7207e465ec799a7321c1c94da32323a6af8475c86350735d946a45eca266133a72677ad09a584a0f11ff608b014a1050c8f4700a2f6be32368ad5104d1fa4a9

        • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

          Filesize

          2KB

          MD5

          57025585bd045f03647739ca9bccef73

          SHA1

          0daa646095074ecd2d2903b5dd3c8c05db7044c9

          SHA256

          66719f13367ec296285d139f9b70c0dc26000abe96ea5109c5cec16d181b257d

          SHA512

          d5fbc61e30e780991e44a1c685cd782b283c0ce8ecc303e913dade3ffce74312bc98a1b755198c23c85f57d57f8d5b9628697b9605703321e581b6b771dfbffa

        • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

          Filesize

          2KB

          MD5

          257dfd5edb17926f6658f766b24fbd38

          SHA1

          82dfa3f03e1142d4fec225c72428d6b1c43a4a09

          SHA256

          cef602f974710044ed8dd9f2127a75203671a6b3a218ed573465ad8ffebf497a

          SHA512

          c4c39c244e669d54018a729ecc075a3352c4892f23ee0709cb7a0e3460925ae8c49799bd4f1d516f7ef9b5e55fb7cab74bd1fe53fe54a12b2fa165ef43cc7497

        • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

          Filesize

          1KB

          MD5

          0c2c0db0f08621af8b544bf4a2191a25

          SHA1

          c1d2733e12ed8e1af649dd1044428e90e7988f11

          SHA256

          144ddbaba5291e7b5a71750af90d79453db06736fa49e73848afe1aad527f765

          SHA512

          d0da6d16db4659e63ecac66970e97eefa41dfe697a80f72b2842abed6359009854cba7b0995dd6b41b5e8d7effe5d1cc44d5729f01dd5351ae2dd4c60d6b2577

        • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

          Filesize

          1KB

          MD5

          43dbc31344db016259d60d32064bafea

          SHA1

          49b2226d333d336b2abced385915a3a07ffe79c8

          SHA256

          8e7e55deef2782f9b20dafb61c7e586c74225f5cf8f1a728618f2abea33fa0ce

          SHA512

          887b1a8f2299a9449ff04a42874ba1064e4d5dc251d22d2f16a96493653c5482108fd92602d2381c5ba9f8feeec87f1597c16dc77fcac5fd2db2473e9c87e9ae

        • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

          Filesize

          11KB

          MD5

          52fcee2aad1f7cae437a6fdb19e9fdbb

          SHA1

          681bc72b9f5b88b05e6e4256be6b8963e5bceaad

          SHA256

          2b072150948b755017d19a60225217a15a862964ff3cecb8020ee00679de3498

          SHA512

          b1b99c674945e75d83635b8863ebf766d1962c1369bb4b8596e829a53874e4895df5f3babf2c68750126a6ad1c3d1fac2c5eef0ade7316035a06d4ba4483344b

        • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

          Filesize

          1KB

          MD5

          bcd2899e671c26ed4e8790c56a6120f7

          SHA1

          74b36503e48a25220c949dafb6d09fc376bb3f90

          SHA256

          2778387477f0bb647c476a239341454dc4260d4b721e0b674bc1b601c98b8686

          SHA512

          dd252c3cb589970249c6d7690043832155c0373480fc9ebeeff8d69f4645b7f6347aa66d6b6905333dff295a95a9d6be45207f2349006124a5d9820b0c1a1838

        • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

          Filesize

          2KB

          MD5

          0d707cf98893473001294695693655ca

          SHA1

          2409802c6faefe690909593e0fce02a09ece071f

          SHA256

          81c13bf24aa8643d6c2774c379ce2dc38fec9ddd00fcdb80614f0c876d3c6cc7

          SHA512

          3db424f959af6a97258defc461b04991a755560ba4d61e7af9a1a340a1e4d438bfa57114116349e8b4c0e2436c44aa9264550c7ea484ac40e8cf9e7053e4623b

        • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

          Filesize

          11KB

          MD5

          21e0de484bcd220d813fdada591715b7

          SHA1

          a0d727821412b862f28025979854c8545f799eb7

          SHA256

          39d905958608d94e82b256e5aea7456fde70a015ed022fa54fe00dd925b7a68b

          SHA512

          7f54a815fdb01f3a01d051e7af9c5f9bbd1ccdc894f9d8ee66ff424ab3dc5de3d7ac0ba6d3c350102e4bdada8f4ea5b32de38a72019d736a8679daf57727ecbf

        • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

          Filesize

          11KB

          MD5

          2ae6c5a7a4b04e72fdb806f209dfb954

          SHA1

          764312ed7b7dea6162e9cdb9c6498a1923667f95

          SHA256

          48eec1c1d612830e70e97940a84493e8635b4549c8e269ced528f318d304131c

          SHA512

          250049847a1c6980ee43e3bbfb17731787e040ed98af22adcff802ff25c88a1edb7b851865e6f50af7582bdfe337b6e43e67ae8a142061108b0d0b34f73edcc5

        • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

          Filesize

          11KB

          MD5

          56c54c9699c6750fe26fd8b023c3e3d2

          SHA1

          6f3b67929746eef93520c3a3db76855acd310bf2

          SHA256

          3d2f1f8c50532a24e584cbfb0d4a2592ee460a85fc60cec5cc0a9875de270ba9

          SHA512

          9cc2582f8b1c8f2a804a71a562fa8e2db8c0e6ae3f097cc421f749b2f721a13c8cc1bebdcd3cecc23c253879e0aa9bde6b78cc6ff6115adaf51a266e31601ede

        • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

          Filesize

          1024B

          MD5

          213a32856b6b3bc32f1faf52e013aa3d

          SHA1

          85e92868ee569cd73e4ef52cfd162048133c6455

          SHA256

          eb26b303fa700f9e55b141ce8eedc3ac751a7f35aa5542ea7cd70a7648eb8310

          SHA512

          24cc5c3c08d5e1f996b63a3d4cb8e8189170547baaa0bfef24b3a2d16b0aa3007b0a1174abbe95b713bca2fb05db18ed4ffee5a5a5c40ffb4504c7faed021ccc

        • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

          Filesize

          48B

          MD5

          047d4b196fe0dca3f8213541318dc0ec

          SHA1

          7ed52b54337b233d7386bae573107b6368441b85

          SHA256

          a1aa94d9bd35b174b817e265e9e579faaa3523720828b581b0b9a0561f4bd1e2

          SHA512

          e431b1e49d992858cd7a8e849bffeaac47f6146cc776bbebb9c426a15e9b8240d090ce55ebeb89156c8295cad831267ce74c29764fa00bb2a0140dbfa0b27ac0

        • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

          Filesize

          21KB

          MD5

          fec89e9d2784b4c015fed6f5ae558e08

          SHA1

          581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

          SHA256

          489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

          SHA512

          e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

        • memory/748-149-0x00007FFEFD9A3000-0x00007FFEFD9A5000-memory.dmp

          Filesize

          8KB

        • memory/748-1527-0x00007FFEFD9A3000-0x00007FFEFD9A5000-memory.dmp

          Filesize

          8KB

        • memory/748-150-0x0000000000CE0000-0x0000000000CEC000-memory.dmp

          Filesize

          48KB

        • memory/748-151-0x00007FFEFD9A0000-0x00007FFEFE461000-memory.dmp

          Filesize

          10.8MB

        • memory/748-1894-0x00007FFEFD9A0000-0x00007FFEFE461000-memory.dmp

          Filesize

          10.8MB

        • memory/2644-33-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-13-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-134-0x0000000074940000-0x00000000750F0000-memory.dmp

          Filesize

          7.7MB

        • memory/2644-5-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-133-0x0000000074940000-0x00000000750F0000-memory.dmp

          Filesize

          7.7MB

        • memory/2644-9-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-11-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-19-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-29-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-45-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-4-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-7-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-39-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-16-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-17-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-21-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-23-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-25-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-27-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-31-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-0-0x000000007494E000-0x000000007494F000-memory.dmp

          Filesize

          4KB

        • memory/2644-35-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-135-0x000000007494E000-0x000000007494F000-memory.dmp

          Filesize

          4KB

        • memory/2644-37-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-59-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-43-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-47-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-49-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-51-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-53-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-57-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-41-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-132-0x0000000004C80000-0x0000000004C8A000-memory.dmp

          Filesize

          40KB

        • memory/2644-61-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-63-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-65-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-129-0x0000000074940000-0x00000000750F0000-memory.dmp

          Filesize

          7.7MB

        • memory/2644-131-0x0000000004B30000-0x0000000004BC2000-memory.dmp

          Filesize

          584KB

        • memory/2644-130-0x0000000004CA0000-0x0000000005244000-memory.dmp

          Filesize

          5.6MB

        • memory/2644-67-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-112-0x0000000074940000-0x00000000750F0000-memory.dmp

          Filesize

          7.7MB

        • memory/2644-55-0x0000000002710000-0x000000000273B000-memory.dmp

          Filesize

          172KB

        • memory/2644-3-0x0000000074940000-0x00000000750F0000-memory.dmp

          Filesize

          7.7MB

        • memory/2644-2-0x0000000002710000-0x0000000002742000-memory.dmp

          Filesize

          200KB

        • memory/2644-136-0x0000000074940000-0x00000000750F0000-memory.dmp

          Filesize

          7.7MB

        • memory/2644-1-0x00000000026E0000-0x0000000002712000-memory.dmp

          Filesize

          200KB

        • memory/2644-137-0x0000000005FC0000-0x0000000005FCE000-memory.dmp

          Filesize

          56KB