Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-07-2024 01:50

General

  • Target

    LisectAVT_2403002C_66.exe

  • Size

    261KB

  • MD5

    522cc277fe92ba28c0df898c7da2ec9e

  • SHA1

    2366a44bfbccc70424e07e22b0c3294bca2fb9a7

  • SHA256

    813a9449049448ebbb4e39a3a024fa258b40730c86648ae706449c1ea8730439

  • SHA512

    9438aa0a25c49723b302c1dbcc7ec4b2ce2315a6a145fbd57dc280f1302b0d097877c405e49e0856d08ad87e1f282cb6768cafdf369f2221695489ff508c8f0a

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUg:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdz

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>G0eX73WWiL5kutm5fgd4XOmsR8YJM3dGzNbHNpDwFY4Cn8wfyhy8EOsOt9NNLnk/KDUrJY+RD2knBQ5v0D4SaUgUQljFSRo70C7WaXVjV2387YXBVCXOMmlFY0/AKHoN3lgHbhkhha5sc86nl5W6acoED5YEN/eKq7tPkiAOhjMaRMAf3fS/5rQJhbIhaMh/VNFzhio3z/9FHI2ua8+fnDxGjFE+AfvLS3aOaWInN0nrAU5EeRT3mUUEay5oN2WuorQ/xQPNmVmnMUGbR8TLOw1BeSmIeXNVjaiz31psJvHDardu8SxhFBfdrHKWQ4y4Lfe8J/swyHFgKeUvgjS2vg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1037) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_66.exe
    "C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_66.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:748

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    c265122700b01e3ce37498a1ae64184d

    SHA1

    4dbf95f956461cc651e907614ead8b7e9f77f6e9

    SHA256

    2205d1476f0cc2e2f4dcac9561c910440b0e6871e2f30592dd99ce2414714b6d

    SHA512

    18b80378eac05b9cc520181bd4ea8f9e78ed1c05a9b460e79cd578b1bfcdc3d05e6ce720b26f42df3de80dfc2eda06c9e01b7b33ddd6a87f7535aa5dc7747dd8

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    a74d87652c37813a96c3f11a6e813fef

    SHA1

    762fa04aaa6da0e4fae8a444bec0438d36883c03

    SHA256

    73caeb601f23d87e5ed8cbc0d2b28fead7467452a72a60a5df92805b64fe2bda

    SHA512

    770b90ac48c828e109d7f18e1c97c1af093adabfbcc946485f1c361dcd55e3b3f1c040ba622906310334f04034deb35260a2015a83424b2f0fe21b4650315826

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    1120f0cec534d90169888cc00dc9673f

    SHA1

    d245a970acd4b5c046c16efb23d35b79696c1cd4

    SHA256

    4f88c9e779a469e92fb51099eed116c3dda007467957d09327a2b2afce120d9d

    SHA512

    00c97448fa21d04a9c038113db0036c2f6c25c321f95194803e27f46599adab9e9681e06dbc8e148cc39cf9efa9f64520584ef6e5c9e282159c43659655ce23d

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    0c7d7004b588edac498f143d813489ba

    SHA1

    f2e2bc9943bc2dc9e5c751d7284ffbd1bab534d5

    SHA256

    1db82000cc01f95647d1321ff7687efb1dda17d39febb2d50399d3fe24f336b2

    SHA512

    016bfa4eb607df1316a734a82a5ed3a5f9ff96c11b0a93148ae37bc2836992ce9edffe8af939303189e588dafd6eaa2bc7cdf577034fc34506216093d8b64153

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    0353a9183d0bb8f16d7f9bee889f80d7

    SHA1

    2ad0d015f9a2a3cd6e79a575779c5d0315966511

    SHA256

    259dc40bfdfa84eef91cf52003aed8c1ae4736eaafdc69583f31ceb28b0662e8

    SHA512

    0a7b552e23dfcc9b18ec06fc6421c3978a58fe40468401d521dbe481ed0c944e14b5c9baf48c02cd8ed5ef69000e588d817e252a98039b47467361ec2eb61732

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    5e8338d7782487b63f473d6e66b7633b

    SHA1

    ea5ef3cc48b66ea6698ca5ffc19a06171be1a2d7

    SHA256

    23e97b0e4de7596d00d0794e1d1a101b1562d53eaf6f04eec25e4ca24ac93b94

    SHA512

    3591dbed5cc946526fc0ab49ce9d5440583c0006db8789f6d50b2d97de753f4882dbc0236d0f996a7c3e2ac0241922b7423865d5423c607be20aa4de901c8eb0

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    549572d8447ef9f005f42cf276a12853

    SHA1

    77bafb9c22a41df22eaed347bc8573310bf135de

    SHA256

    241230cf8bb18b3bfee9d08d7cecc8ce56962c4f5e678f28b4e84ac1060190f0

    SHA512

    cfe0acd9e3b30ceb8359e72ecc4e370232d572378e2b0ec0af2d4c560d52aa8a0c14b192e046e1a7e8feabc0fff1abb76f553a599431c13dcb54fa33884a645b

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    a9c333d62163f41ceb72f091de09aed1

    SHA1

    4f494de61cc69959264ae596408437b2327f7cb4

    SHA256

    823f01e9ac2147a82704f44413e39f8dc62c4035692c0325415ea8c0e1a9efb3

    SHA512

    3fb89ffb68661f3d41b167e955aefeade35ade0c499ede4450d0aecaec45daffcf10e4d0b1e04b2ebaed4ce0401847567106503d908683bbf306c059fd0d0b31

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    02734afc89c45a08f59c7046a82deff9

    SHA1

    caef216660a59662ba908307a2ed476e7612aee4

    SHA256

    83e00523761db27cc839fc6f4138c55fa7a202e9dcc7d449b5423df4dc676695

    SHA512

    f92d3437861efcce2141cde27dc4816e56809dd03914eaa8d864001013a06c0b1bb5ac791592d874b8c60fb4270f0a17eb16aadc3ef84a23f3b612da5f4974f3

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    2e8838218797fcd6ac9c1bfed4114a3a

    SHA1

    46fcf758c7a1b2ba499fc39e99b534edcd21aeb9

    SHA256

    3812b602a39df4f5fb7c3591f1ef432f59c21959bdc3aa35a5ae8bf3e26247e9

    SHA512

    17239e0618bd5f706c35563d21fca6dc081219cb5adbda9b5b9ac288448d8c049c6aa9644b2c1164f7adba80bcaeb044f893b9d159c15a4c0b529d48a06d1324

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    640ef09e688be3cb857f7187a62e2e8e

    SHA1

    e3fdd4365c1e45ce3d85086e48f94dc79dff1a99

    SHA256

    908d4f9348a189b6187a145857571f4d87320e3d4cbe94ca61e0430dbfb40b8b

    SHA512

    036a65afdb51f70eefa13f773493ae965b19d45bdb6750861ea52044e009cc9c4dbda5f7f397a8be689d8cf4a96a80926c5d3c4e3b86696b3d46853222880dd2

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    882034f30fde62aec6afae1ee492e232

    SHA1

    ef271a82d81045c8deaa0308181b9d59681cc9de

    SHA256

    33b4b02fb1129117861bbb5dea470cbb38eac50678bcc8558ddc6c20627d919b

    SHA512

    b4992505bea8bbde6391a2fdd373b6147dee759434eeca22e22628d27cca9a4dcc953cbb924cb14413128f5fbe25e50b20fe39b545b6e6794feae838a38a657b

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    df1d86b42185351eef60a3f070c66916

    SHA1

    208daca4da041146a26293bb231d487cdff94b8e

    SHA256

    62348ccdb1400678de4bc1be5423c8edd20a169a3f01a6d777d8ad6c2c2bfdc0

    SHA512

    081a7d619e18eff7d71ac6909c27a0ceb9bebb6661a7df4f53b3711c5381d87f3d62ad5cae44a0c57aef4569d667bacd65d54c003d11411096c981e175db23b3

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    7aacce2345523cc8840b233170e5c3f5

    SHA1

    fd76f4883b4d47fcf4e90d8fca815e564b81f186

    SHA256

    4d124a2841e539a742d1ad0ad923bda1799c57953c87f5901cd89c9b13a18fc8

    SHA512

    9afe2480599b07d391ef4a37bb1fed1a7045ee5704228ffaebd2111848646fa5226756a42574916735c3bca5c881ed5a6602b0ce9ba91fc6077085da140097aa

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    78448a9beb1bc93fdab4ec6cc25ded1d

    SHA1

    84fe041765574fdb46edbcfc1c67ef67dd627773

    SHA256

    afc7f48619b225e6bca49e71f1869219c55ee982604ff295ce651d179a7b2dfb

    SHA512

    4969ae096d7306a531683d4d503d964f9e2072010db7eb344de2dba0f4f85df6cbada1f3851c0dc8f9b8fa2fd270eb9e5ccc436f17070993852bc91073631a06

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    2294e7fbcde07a1306bc7c4450c29efe

    SHA1

    da3df8f21bd1585465ce11909ef3091749aa0a83

    SHA256

    d1a6bc2938e86a56648e579907c2c6e7d64fc8e425c1b261fd481170a68a9c7b

    SHA512

    ffb4679d7d4fda1bc72c148e22be6b55f881ed1b0fb033552edb3a5fa0a72419eb13577a08a9dae38d66cca8aee8e615f23d177eb30fc4758183f4168715f335

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    d8073acf66d47e125897019e695c2d36

    SHA1

    fd9a2d03ae0c453f8da237d85c9715f96f96b172

    SHA256

    5648bd8050d95bed36f405809403ec7f13db248cb0989bcf71463977ba720894

    SHA512

    9e7458654085d50b684ac3d470851436eef5346a3674df0539eec113d094843eb585c1cc0a23f4f92792b82ebad78c125fa36811c09e6c906776b191a1a3b525

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    41cd2b3dd87eaf17a9d20f3195d0a2aa

    SHA1

    b9ecc2ac72f45399a95bd7612f3e7fe0eef1c9c3

    SHA256

    28d98ac8b10b418f25c5a43c2623e2a719791b9df9e8e4a5f1465bbfe024e510

    SHA512

    bd3e30a52cdd0c7781a0dda26a7afa5133ee7826b5d70656e9faedbc6fad8dc4dfd82c69a4be5e1164535f1b603ad8aa2af027120d80ed3792867720e03c85b2

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    f8478d0269c2309aef58498f777fe0b0

    SHA1

    694571627de0348cf124ea058bf978d28ee005ad

    SHA256

    fbe9453707bf22f81c3f41aa82c22ae40b454f5febb3e0e9a6835c87757215f2

    SHA512

    51c48856a35252588d4ad9f2754f9624f76bf8d2c3ffdc630ce46c22954293937549aa479fc3a9c612a9f031a7f5d74f5e28b01709db2aa5e506fdc4786b38ac

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    45a885037e0f255a73bd4f527b6f296c

    SHA1

    80ff76fca88a8e32592aecaec8b2a90bd693da2c

    SHA256

    8f713b03b6d6055cb3aa23bec33f46cb32a809a75dd06b74e0e271454f534a4e

    SHA512

    1068cf270c67852554fb8518b3e64538c50db5d1b54aea7a0f5b372c78d6237d71418254bca19989c852a69022e12c2d510d91926105460337b622c159930ac1

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    ee462f0ee8f55c150447e9e73038fc06

    SHA1

    45c934d50243a06b1cb3c5cd2c902cfe1678787a

    SHA256

    38076bbc01d58315c887c37afc178deafb33a1b44e66e878db8fb3e5137de55b

    SHA512

    c66a6d2a62e12567ab54a0c733645ac5dc5a962c47e2a920a63bb69812397fdc2b81e6987c92e5fa8ff10e73779b647ab6aec879dfe586df4c532796bb9c4801

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    d4f716a0e45628d113459a0cdb9ec993

    SHA1

    7b03f91a6b8b3dd1351060ff3774aa34e20f32eb

    SHA256

    8aff78442be4c70921aa0428de5358b55e45ee991f4022c2d2561e590f3268ba

    SHA512

    ed4e28ec74efe0d31a9af44aa0b5322b222b347c45acdd7481ad2f1fa8f99780ba23b37aacde54de08f3e46183c07c60346b1d28c00db50d2374e4fa61673507

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    02ae5ab4758dc45819a0ed9cad72dc74

    SHA1

    f228038dfc1bc1dca64c26893e83e5ba2af49189

    SHA256

    f723e2e10e0a09683aba9eec580080f911f88c4e0f08bae5fd8b126fff6a90d4

    SHA512

    f96dd536e96701fa74c4adee3f8d6e9b34ff5d9a5289b0ed5acfeb16822bdbdfc2cba12ee5a14686d459b10d8f05803ea4ee5544b75e60f3a9d092a84cf49bd2

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    7073072f64e02c9eb70aadccabf90546

    SHA1

    726163bcc17617a64b03b321d325482c08088437

    SHA256

    5e61c47461f5b61b935d8a9ed090c145a705bdeeb600a581118c3f1f14d83b85

    SHA512

    8dc5c8d81af1e03e59b7a6192910895f00aa44ba545981c13ccf1502df571be7986bd6cd5d0fd63c5468a034cd116948a2f7aa8d4134bd7741d7eee8c41067a8

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    d3f70d4fc157626a0e7d36df43caa801

    SHA1

    2d0e5e4e9a7ff5df9869b0220b1a8f91d60f6eae

    SHA256

    cbb8c4127ff0a69edcd58a5f0328e99ed459c6cf8b6d4e0ab99148f99c463590

    SHA512

    5a7737b25803ffe5d9366803af8536072bd8a7e8ce2baed0a3b5452296cb205f95cdd9bf7378d6e174eb3b9528612d29a2bfcf9d019a4d2d4d0460b6d1c7c922

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    635f45790f5e5c63a8f99ea3176a5d95

    SHA1

    afd993b5af839389933474289b3672ff6a48765c

    SHA256

    b4976a3fb2f8e1d667e75e548b70be17c9af460c4b4e2bffc857810032635131

    SHA512

    fc1a722a98b8483973d78ef8e2f2bb4e21816e7fb917669f3fec4c291d8334f528fdd573b52d1394c63359b88ece429639e81e0a3e1d6eccff429be9d6790aa1

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    1865b1a1048f47ce3edde8aa69dcbb22

    SHA1

    a32819555a767a7622e2c95ef63da71316112372

    SHA256

    37b529fdb4c3be2a42a2b2c9eeb50eaff2fcc7b652ba78071a0915fb5d6f81db

    SHA512

    e690aef513b5507ae77b293a9a55939a4bee291921b8e898dd99f97c5a3d4ec2316e3ba34e103b27b0140b073d9401b4b03a31421cdba10d6d3aeab35d3d6e64

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    81d51cc22866409acaf0d325d6180c22

    SHA1

    6882a243a2c8ab2b9f649433a0d913be0240b2e7

    SHA256

    3c752bd28e88321752cef86be97f30c39af4be45cf0f883e9ed47dde0e3b5768

    SHA512

    edec3696016230eba18ec4e46234fa2801bdcdd4ba12c8797817c9d74626931a4935a2d60c5082222b30359c56d1ef7b4e92ee79f028732a1a497b01fac04f76

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    38901c0a7424dd2344287d187103c57f

    SHA1

    c36d9d026948874eb3e5b82647390ac98e6e710c

    SHA256

    19c2757a812cc1bb29ab1b37b67453b82d9e9d8b92fa16cdca3f377586fd391f

    SHA512

    a175255dc1715b00e959b3ace6349b1406e3b72e444d678851f32c816afbebd8aef56084cb4c6596a3dfbdd8ce7e5fc57f0efe7e8683e9324073026f9d0736a2

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    76877a4bed1205def4344eebccc7f4ba

    SHA1

    a6bac4eef6e585b783048767c0f5deaf0978f785

    SHA256

    b36d90dcb18120f1ae564a96652761e36348b0d44a95c26f1adfabf51ccdba4e

    SHA512

    1c435e2fef6aa22f52bac4828a1a34492efe107f29322864dd96b2b7e6e7d5b55d8fd355365e678bcf2a56574b12a1534e8bfdbc19197a5d3742f3c15435e9e6

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    420c3ce700a056ef500335630710f99d

    SHA1

    674fd2956ba6a159ac7bcb73e9f2018db73fc63e

    SHA256

    e3a1f5b1bbf434e75234185697fe97168870e04025072125069dfec751fcdc30

    SHA512

    9880b416418deb1b1cecb1923b89158bd0213d1b42b9160c641abb16cd555ddb3b34f1f8801458bc33337814e24c53e32458413395c3e6496852853dfcc68c9a

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    2c736f659d73431557712eff9cc85db4

    SHA1

    31095c426b0580012da9b99334a87fe3f40367aa

    SHA256

    821ada65eff88c78e5dc8d3fc2ffefd5ae2227c479cdd523682070cdf66974fe

    SHA512

    d549eddee0018ad288122bd9d9e5150904e09c626946c5bb0e79fde5c30ce0f5e5cc56bd7ebb5f40e5b5f29d67f390e6fa00741d99e0143165f27f7d5ea0ec23

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    0cec243a5dc530872be176a9e2038095

    SHA1

    9facfc85b61cb566a2a7b3a31d491921122c5564

    SHA256

    cb963493b5a3023b76e5b6d39633bfad9917610a332d6d653b5bff94c1062a7c

    SHA512

    f49d6048202e44117bead65654576fc35d63c52678796f2406bb372c821ce3355ff3521e1afedae44572f5d1c095a2d0d35af5aa9032a916758d58d4aa2c62bf

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    efc8cd24350d6de3e62a0022ce231673

    SHA1

    1079fc417e2fb8f3e3fcff11c2a61dd314d7146c

    SHA256

    12d33f03676234739563ab8b7c7c74f255a890a492f58e910f67aa23ecd85783

    SHA512

    e7207e465ec799a7321c1c94da32323a6af8475c86350735d946a45eca266133a72677ad09a584a0f11ff608b014a1050c8f4700a2f6be32368ad5104d1fa4a9

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    57025585bd045f03647739ca9bccef73

    SHA1

    0daa646095074ecd2d2903b5dd3c8c05db7044c9

    SHA256

    66719f13367ec296285d139f9b70c0dc26000abe96ea5109c5cec16d181b257d

    SHA512

    d5fbc61e30e780991e44a1c685cd782b283c0ce8ecc303e913dade3ffce74312bc98a1b755198c23c85f57d57f8d5b9628697b9605703321e581b6b771dfbffa

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    257dfd5edb17926f6658f766b24fbd38

    SHA1

    82dfa3f03e1142d4fec225c72428d6b1c43a4a09

    SHA256

    cef602f974710044ed8dd9f2127a75203671a6b3a218ed573465ad8ffebf497a

    SHA512

    c4c39c244e669d54018a729ecc075a3352c4892f23ee0709cb7a0e3460925ae8c49799bd4f1d516f7ef9b5e55fb7cab74bd1fe53fe54a12b2fa165ef43cc7497

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    0c2c0db0f08621af8b544bf4a2191a25

    SHA1

    c1d2733e12ed8e1af649dd1044428e90e7988f11

    SHA256

    144ddbaba5291e7b5a71750af90d79453db06736fa49e73848afe1aad527f765

    SHA512

    d0da6d16db4659e63ecac66970e97eefa41dfe697a80f72b2842abed6359009854cba7b0995dd6b41b5e8d7effe5d1cc44d5729f01dd5351ae2dd4c60d6b2577

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    43dbc31344db016259d60d32064bafea

    SHA1

    49b2226d333d336b2abced385915a3a07ffe79c8

    SHA256

    8e7e55deef2782f9b20dafb61c7e586c74225f5cf8f1a728618f2abea33fa0ce

    SHA512

    887b1a8f2299a9449ff04a42874ba1064e4d5dc251d22d2f16a96493653c5482108fd92602d2381c5ba9f8feeec87f1597c16dc77fcac5fd2db2473e9c87e9ae

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    52fcee2aad1f7cae437a6fdb19e9fdbb

    SHA1

    681bc72b9f5b88b05e6e4256be6b8963e5bceaad

    SHA256

    2b072150948b755017d19a60225217a15a862964ff3cecb8020ee00679de3498

    SHA512

    b1b99c674945e75d83635b8863ebf766d1962c1369bb4b8596e829a53874e4895df5f3babf2c68750126a6ad1c3d1fac2c5eef0ade7316035a06d4ba4483344b

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    bcd2899e671c26ed4e8790c56a6120f7

    SHA1

    74b36503e48a25220c949dafb6d09fc376bb3f90

    SHA256

    2778387477f0bb647c476a239341454dc4260d4b721e0b674bc1b601c98b8686

    SHA512

    dd252c3cb589970249c6d7690043832155c0373480fc9ebeeff8d69f4645b7f6347aa66d6b6905333dff295a95a9d6be45207f2349006124a5d9820b0c1a1838

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    0d707cf98893473001294695693655ca

    SHA1

    2409802c6faefe690909593e0fce02a09ece071f

    SHA256

    81c13bf24aa8643d6c2774c379ce2dc38fec9ddd00fcdb80614f0c876d3c6cc7

    SHA512

    3db424f959af6a97258defc461b04991a755560ba4d61e7af9a1a340a1e4d438bfa57114116349e8b4c0e2436c44aa9264550c7ea484ac40e8cf9e7053e4623b

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    21e0de484bcd220d813fdada591715b7

    SHA1

    a0d727821412b862f28025979854c8545f799eb7

    SHA256

    39d905958608d94e82b256e5aea7456fde70a015ed022fa54fe00dd925b7a68b

    SHA512

    7f54a815fdb01f3a01d051e7af9c5f9bbd1ccdc894f9d8ee66ff424ab3dc5de3d7ac0ba6d3c350102e4bdada8f4ea5b32de38a72019d736a8679daf57727ecbf

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    2ae6c5a7a4b04e72fdb806f209dfb954

    SHA1

    764312ed7b7dea6162e9cdb9c6498a1923667f95

    SHA256

    48eec1c1d612830e70e97940a84493e8635b4549c8e269ced528f318d304131c

    SHA512

    250049847a1c6980ee43e3bbfb17731787e040ed98af22adcff802ff25c88a1edb7b851865e6f50af7582bdfe337b6e43e67ae8a142061108b0d0b34f73edcc5

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    56c54c9699c6750fe26fd8b023c3e3d2

    SHA1

    6f3b67929746eef93520c3a3db76855acd310bf2

    SHA256

    3d2f1f8c50532a24e584cbfb0d4a2592ee460a85fc60cec5cc0a9875de270ba9

    SHA512

    9cc2582f8b1c8f2a804a71a562fa8e2db8c0e6ae3f097cc421f749b2f721a13c8cc1bebdcd3cecc23c253879e0aa9bde6b78cc6ff6115adaf51a266e31601ede

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    213a32856b6b3bc32f1faf52e013aa3d

    SHA1

    85e92868ee569cd73e4ef52cfd162048133c6455

    SHA256

    eb26b303fa700f9e55b141ce8eedc3ac751a7f35aa5542ea7cd70a7648eb8310

    SHA512

    24cc5c3c08d5e1f996b63a3d4cb8e8189170547baaa0bfef24b3a2d16b0aa3007b0a1174abbe95b713bca2fb05db18ed4ffee5a5a5c40ffb4504c7faed021ccc

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    047d4b196fe0dca3f8213541318dc0ec

    SHA1

    7ed52b54337b233d7386bae573107b6368441b85

    SHA256

    a1aa94d9bd35b174b817e265e9e579faaa3523720828b581b0b9a0561f4bd1e2

    SHA512

    e431b1e49d992858cd7a8e849bffeaac47f6146cc776bbebb9c426a15e9b8240d090ce55ebeb89156c8295cad831267ce74c29764fa00bb2a0140dbfa0b27ac0

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/748-149-0x00007FFEFD9A3000-0x00007FFEFD9A5000-memory.dmp

    Filesize

    8KB

  • memory/748-1527-0x00007FFEFD9A3000-0x00007FFEFD9A5000-memory.dmp

    Filesize

    8KB

  • memory/748-150-0x0000000000CE0000-0x0000000000CEC000-memory.dmp

    Filesize

    48KB

  • memory/748-151-0x00007FFEFD9A0000-0x00007FFEFE461000-memory.dmp

    Filesize

    10.8MB

  • memory/748-1894-0x00007FFEFD9A0000-0x00007FFEFE461000-memory.dmp

    Filesize

    10.8MB

  • memory/2644-33-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-55-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-134-0x0000000074940000-0x00000000750F0000-memory.dmp

    Filesize

    7.7MB

  • memory/2644-5-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-133-0x0000000074940000-0x00000000750F0000-memory.dmp

    Filesize

    7.7MB

  • memory/2644-9-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-11-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-19-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-29-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-45-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-4-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-7-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-13-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-16-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-17-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-21-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-23-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-25-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-27-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-31-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-0-0x000000007494E000-0x000000007494F000-memory.dmp

    Filesize

    4KB

  • memory/2644-35-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-1-0x00000000026E0000-0x0000000002712000-memory.dmp

    Filesize

    200KB

  • memory/2644-135-0x000000007494E000-0x000000007494F000-memory.dmp

    Filesize

    4KB

  • memory/2644-49-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-43-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-47-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-41-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-51-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-53-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-57-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-59-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-132-0x0000000004C80000-0x0000000004C8A000-memory.dmp

    Filesize

    40KB

  • memory/2644-61-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-63-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-65-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-129-0x0000000074940000-0x00000000750F0000-memory.dmp

    Filesize

    7.7MB

  • memory/2644-131-0x0000000004B30000-0x0000000004BC2000-memory.dmp

    Filesize

    584KB

  • memory/2644-130-0x0000000004CA0000-0x0000000005244000-memory.dmp

    Filesize

    5.6MB

  • memory/2644-67-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-112-0x0000000074940000-0x00000000750F0000-memory.dmp

    Filesize

    7.7MB

  • memory/2644-39-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-3-0x0000000074940000-0x00000000750F0000-memory.dmp

    Filesize

    7.7MB

  • memory/2644-2-0x0000000002710000-0x0000000002742000-memory.dmp

    Filesize

    200KB

  • memory/2644-136-0x0000000074940000-0x00000000750F0000-memory.dmp

    Filesize

    7.7MB

  • memory/2644-37-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/2644-137-0x0000000005FC0000-0x0000000005FCE000-memory.dmp

    Filesize

    56KB