Resubmissions

03-09-2024 14:02

240903-rb57sazdqf 10

03-09-2024 13:51

240903-q59avszclf 10

02-09-2024 19:51

240902-yk8gtsxbpd 10

02-09-2024 02:27

240902-cxh7tazflg 10

02-09-2024 02:26

240902-cwxc2sygll 10

21-06-2024 19:37

240621-yca7cszgnd 10

09-06-2024 17:07

240609-vm7rjadd73 10

13-05-2024 17:36

240513-v6qblafe3y 10

12-05-2024 17:17

240512-vty3zafh5s 10

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-09-2024 02:26

General

  • Target

    Ransomware/criticalupdate01.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>U1ALeBy2KvSelC6xitTVqOXcZyBFlVGMLodU65EytNf9gXqQ48/zBFgQhgzyO3qG7sdl1aeo9lhr7Ax5cfvwR+ZnUQ9lRFJyEM4bfDUa8pWbZ7sIfYD5YHvSWMe/G5J89Q220Irv2hBLYfqB3ujSFy+NDv7ASzK5LcNKxiY2Rp5qsDoDnAPHbkEppxPBKzC43tnvu+/+Qd8ywcfkYRVkNo6dyjGc5AAH3xRB3C639AtYVxUDIDWzcQvQDhmheV+PSGpl9uOSayyXE9doKyMKiKGPX8qe6/7Jl+rPPkMEDlhOPj57lYLXQWgSVbNaDxaWFFZ+QWTxE5RDBt2kPhM6qg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1031) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3368

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    929a95b6cf279b28f285a5e93197981e

    SHA1

    080b45a4718b3bf34e3104f354675e1fe6be51f9

    SHA256

    099785d63343068203830ce0660a1a9039d9d2eaa0b80cf2876dafbebb57e23d

    SHA512

    f259b136183821b945e5ea2ba31efa6be028184cb174d699416b19bf0de5e65036341ba377a26eb8e75b677a11e741cf45686fa3aee998c9228f533f92469daa

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    336185063d611f4d08820cc8a6a62db6

    SHA1

    ab800b33d15eb45c3c75a3522d509ef997ace8dd

    SHA256

    55abf925237afc5370556e420c45f43dadc20872f9164465960b674d053321b5

    SHA512

    308d68d9904498708cd71df1bf1fe4b7ca8f7477dcafec3154b9f24c5213ee6a4f31d1b5eea005db956e2b96da36e11a0b7594232edde12f45045c8247698536

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    03c8ebc9d53b658692764be710215705

    SHA1

    bc56b9f5fb6c32910196fa897639df419f723e74

    SHA256

    c54f090cd1b4cdd1be4796e29b724bbc5919aa004ee842c55a452ab7acf2925a

    SHA512

    acee6cabfb4bb80208fc7b0764eb489cce495f41cd3d86ec322a1fb37c5736c430814ee24fe5c701dc9fd5aa2d0391dcd7895f19196158fda8d1218685b0b4a7

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    47512a6ad88e7e15e8f8c376b69e55f9

    SHA1

    0a023bee828d6e4ed931563c9f7346256d9e5f4a

    SHA256

    549badaf56c066c57501098861b9594479ddcfc6b4c7a73ee9b929acdafe0afc

    SHA512

    2ab194985983664fc5092ec76e3f5bad8f686036331ba7922c200e347c61e2b8039a893bf8cd0ca33309bd09be5a2bc056f9221009a765d1802f9f01d1459aee

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    9c0291e00f38981edbf981361bb0e11e

    SHA1

    6b252107a58d460b1329c346067a815c4224c125

    SHA256

    da5fd4ac1e998121b447c50da64b580e7ac8a6d262e705d94c6b1e08a2bcf899

    SHA512

    9e53150df7bba980e953e811ca3eab16a973525273122dcc07148420804b0c5022c6492a62ed8a2cd12cb344cefa698061533a9fcb880bf9562edd881f704057

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    f9ab3014145365ddf29c8b50b74a9b85

    SHA1

    c54d29665fa2c98ba60b5ab00ef244ef769c8c68

    SHA256

    e6c41f9ca3aed585f0f6968bf4745c44c0674c7f75e3fe5a4ded3df11b55aa32

    SHA512

    642c63fb1321ae2d6a65f40e57a16e21e72183d2236296e273bbe4c31a5f511bb561e68b9a0e28bafe5f017c1026c08fe4f5ec2284d4104363690292eeab6464

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    795417b3ae5a56264ed30e6107ee7d1e

    SHA1

    5bdeac5aa923e2509ae0ce143c78477f4fab275d

    SHA256

    e9dd9d97a79c79e5f85f7fb6f65ffc201101836bf29115659b022c80eb31ee25

    SHA512

    b442b6d712ac773d8e45f77aeccdf7f8d50bfdfdca51023cc41b0b98ff1204be96b333656c89af5ac47bfb8ce128b5d2ecdfa42e5b2a3c1ce381fc2d7416809c

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    8c00352f20123706213f1283e725d66a

    SHA1

    be46e3fe10d22ac326fb6e356e3f52ca24521d44

    SHA256

    6e56f322a397be7bb4401698262fa616a1e688196a7fceb1163ea9cecf6d291f

    SHA512

    449e608903f4d1d9f81a76f18a26061fb6251a339a1cd4b35e8ffc4f6935e2c9cf42b4f05cfc0e74dde23f08115ebcae6b37a088ab5bc89f8281738d3fc62c34

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    a870d076f310aaf7b404f2790712d1e5

    SHA1

    fabfd93372d1db43811383b8d6d0ce0f96da4dd7

    SHA256

    254ce60a21997c4073b9500c1ecbf7875a5527e3ec8d08b3138e2e478d182c4f

    SHA512

    df014bdea8ab5288f40a1696aaedf9e916322c3eb82fc44714e2a54bfd8942c122e6da2f75fdcaa043775f32aedba43ce398fe7ccefb01486a14b136d8369172

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    6e3dd888cdf19138ae104e50808a70db

    SHA1

    eb7010a5ade03be3a441b291ae19da7a63201a91

    SHA256

    9dce7ee429dccd6fa6f039e97ef83f058f6e2b5d078ebb0232867a209b7fe1bd

    SHA512

    1175a899a1111fa50be7c3df78bb8348c06ead38d04651a63bb51630755abfca1a67533011c17069246d34dd402292255be97e4bb3f53cb49823beb79a9d8a56

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    ee1f47129107c656c19feff05f8feade

    SHA1

    7b59a464812de6dd7146f147b88ae4f48ffc81cd

    SHA256

    fe1e3b8f2ad1b103482fceee70ed613532afb5429e29b567bdd7aea43cdcc45a

    SHA512

    977d2c7d621835f8c3aa0a9e8b8f608588cc11ac7b1a767c5c2d02d1b27d7c027e810e7c6613bcbeda088c972e6eb889aa402434f5047a943a7386da3577b0d0

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    4a719d6d85dc672448a4d44faf00e246

    SHA1

    5d95606ea30bd23722d38ef5fcbec6b49fa6e9b0

    SHA256

    a7d191fdd133ed65ba0debbb9ffd014e40f4d66fc41a2a9ce14818f340185119

    SHA512

    5ca81a9c277ed16b7bdbb2c183902f317a31f9ab84a9ce9322e6e751a5612da31d5580e93ffc120a5410389d8d9f8632f8fa35cea5ad160e9f6b7641904e1b96

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    20bf621206f310c1893223974a889b9c

    SHA1

    79a70fea28e86f8a8e786aa33b6f056e05536967

    SHA256

    ed68d8d10ed676bc9e37272aaee6f92081bfaf78b482297c44a54faf59a62d00

    SHA512

    10864e8eddd0080f3c5a8fe6494f7d6d5a0674df9337aed42a1507ddd3acf194ce49cde243d5460114e180806445c910106914f038aa9eeb083826f6ec18e334

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    ec5ce95b66414c6523a068a0d8630841

    SHA1

    17cbd0a76fab3d48e38beeed1f395400cd697f18

    SHA256

    78c4ce42082b3969b28cf37eb5285713f43377f573f56035d03714481b2ab447

    SHA512

    62e6317a39e8922f261c9b18d70a6fc41db1667024f9f0815d3d96a329cb034c5430aa630581eb53d9086cadd62c9bcc24ee117ef6afda52cf3565d52ac7752e

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    1daae7fc8dbea72d622b0bf64ff7f86e

    SHA1

    8f7e0ad34ac36864871162eb65ed7c84b8689e17

    SHA256

    5d51886a653f6262457404acc758da8de61754f956a61ca9226a740929596676

    SHA512

    66e36fa354d52b5831299bacc7c61733f529c42cc20fdf4946692ac58919dbea3f5f81c7283e44457e48676fe62158058bca4bdda15077e4179a5f68b777086b

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    b2f4e63e8784d4adc9f14ab936554d0a

    SHA1

    0d4b2d64fd78f3a6b0eea2774170588d770284bb

    SHA256

    272fc8768cc10d12b1d46c0effa61762532b542fa7fb1b560b9016f0b2fdd4ef

    SHA512

    a65ef0a8e1a61e337e753382f3d32293c2e4bdaa90a59bcd47f9f01222da7dfefffe69cac273f141d0596edfc78837a2c4f10a5d0b7ae2d88dac23a7b497901d

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.fantom

    Filesize

    10KB

    MD5

    2809b28e396ab68b8372528378d4dbe3

    SHA1

    977271bbdba3dc3436ad7cbee8bd3db47f4f6bda

    SHA256

    88d5dc363dfb87b63d6b9dc4751b5c4f371550c5bf5dea8d0c85023b61bec3f7

    SHA512

    96b11368dc16725a5007ab5438b4e6db0bbc68c2291001aecf13fecc12b9160612abf8f0efececa845aeacf8cf945433c7c5c990905e102254c0a490a367af83

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    4c3f6837b8e2a73c7506992481e2d39b

    SHA1

    a1e14ffa9355c75c1e77edacde2b13ad3aa796c1

    SHA256

    b5c452e3ade44302008e2f6d1d1b2d4f052e0c90974048452f4301353142219e

    SHA512

    5a7e0efeacf95e3d6fd164f461a067f9b918258a1365cc00bc8540a578f670df5a964c10c8fedefb0cafbe5cbfaa1135ab958d366cad17c273c835473524ede8

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    94caadeef475614658863145aea9f2b3

    SHA1

    b6bad563b8ce92ebb586212959358f40cd493560

    SHA256

    ac7205e3c87071862527857ec473f34e8d51de9ed2145e6345635ec46466db7f

    SHA512

    5db0c42410ea226f01ee0b31f5510f9c61317224809f18b09620ed5b170d0aa1f1399694da958cd366e5c389e52c36bd38477497e3558c6657270a058a2f98c0

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    dc974c501bd9a1eb1e17f61bdb8cc39a

    SHA1

    9f4fd53d9fd24fd4e342a7c5a44fcf4e365fb941

    SHA256

    4feabedd26ddb4fcbcc27f27f48b2645e47143773538ad8d120fe822e9299a86

    SHA512

    a9983407a7e0511fd26b93af0870b6ba420156adb67239326eb9d41706adf56458821c6af217f984972feddbe4705b9b07d6aed334902c1abbede1c252a7f92a

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    cd9adde92781b9fc9a1d9f08cb96468e

    SHA1

    6cf2423c2f5163a4e7494578932cdef024ed492b

    SHA256

    387066375bafd3a41d97b577948814555234098da5119ca0bbf9a04437b160fa

    SHA512

    3032c0a5b95d765908789eecfd61301a0b0e7f9f85ed7d12bc99aad0830e621614361c05eea77ec6aee4d89a89a22c7bb76608bb4eb7d2c2a4e232749973fbd0

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    8c15f06887d87d596cf233d346227075

    SHA1

    862835d440e0b95cc213053d20ad9f1f8e81c14b

    SHA256

    22b92f1ecae3f84ec9e382a8eb2236437ce07969e18a5a466b48deed8778d00a

    SHA512

    d5909477003588844bb412f24099fcfe72b4fa427972df743e6f292c63beaddbd259ee9544814e8577024f863f53c9293fc966af7e47e827ed3dfd7fa8767574

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    d23ced257587352ad2a8a31891a12595

    SHA1

    574a74923f68bdf3b984ae112dabdad62e82a637

    SHA256

    bda595ded731d8f0fdfde495b849892d7b08d1261297bf25712dd78c092f7388

    SHA512

    6ace276fc83122f96e562b224011254d9ceff88c508794974291b3e2b1c9bcd8053a01612978a3812599b944378302dc8cd69432cdedcb7837fb82449b0aed72

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    8f8aae1469a960afc26b6851409e0af8

    SHA1

    9abad997dc5c2a43bf9db69e4de9dbbe2790a139

    SHA256

    76e2c06ca4f9a6af4d707a27f1fc9e4a24a0532f20d5a13d49c8a04076c0ae81

    SHA512

    5515b82961d26d9cfc1826dbdddea771b1cc3ed07e3a9ca935495e142a7fae935bfc176bc47afab74198d0b849457526b6709a8fdec7d14bfd40a5ebc3631a5e

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    c7e562b0e70ab898728b5637142ba521

    SHA1

    bf4fb62e534d69f77d4624de8b8181c2e55d95c6

    SHA256

    4237b926e8ab96b3a6ec512f3413f63563ed844fa08f9a315b7f5b414a49cb2a

    SHA512

    4321cda68a0f3000eb341de0791b6313966bc6c0a11a013cdd434d7bfd5d70cdf7722b570364351e40985c26ce4ae98dc6be8560799cf6d7abf30682fc1065c3

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    7f53f5912aeeb02651d0c7bb3ca3bb51

    SHA1

    e96e924502c1d8f8eddfff365f7ca5d6a9cabd27

    SHA256

    58042803c4938e527584b5d40cc865b960047cb5852aa5acaa4eccf30fd84626

    SHA512

    fbc38b059731733b986a9e343ddb7d1c5c656f15e5523c51b854f8c89c2a6eaaa4bb27ba84eb6be70d97e940bbb0bc437241dd35b1a87aa40395e647be70d505

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    58f0f1f72cf3aa5fc0e86329470e869c

    SHA1

    f6a390774a17ca28f484a5d2d9bf25c67a705895

    SHA256

    5c4dc32f3d8b6f04c9666ed148d65208fb93daf03c23627d0aa9f2d3d424c280

    SHA512

    4d7ebb4c00c52c56d6d7bbc8c30f3e77eff707005ffba5254eae6c6bc8f654c549b541595079cc542dfe019f9d9c40257b186810c3e51840b58f0581093e04f0

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    785b2ba38acbb7f3edd13fc7eeecdd95

    SHA1

    b03b57992870723d92551b7ec1dffa7876311375

    SHA256

    8e077e78a83f9fc5108498f443992a2e806634f2c90dde4119b5ae50ce08c535

    SHA512

    1e3ecfcec9b6e7609f09919d9676fa3cd5e6f88bfeee142092889a99506a24590043e90423c3286ad1eacdf7e27ec0022f14636c73d7394c0876ad8241994b16

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    07e9697b390b694af79198613c1c11fb

    SHA1

    6835e4e8af696fd5127c09c16a61187eb7968c52

    SHA256

    c3abc6ce73d768a5553c9b817b021b421f8fdfacc330778813341c1ab066352f

    SHA512

    f4291789e3a15247bd4557ef9979abdf7a2533b17a0c411c02e16a207cc286883672f39d5398cde75e5a2cde5267a5fdf898b663f9c95bf4ba9525e45ce4804b

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    43d63ddefc1e084732f9eaeb2c947386

    SHA1

    8d0897707c0d5f89328fce0b26681ca6df68aead

    SHA256

    aaae82a5a7359a5b692c0b6749ed6ea2ea94f7b9a94663cff9f863fab35a7071

    SHA512

    5203b9f424b9c9d5c096f8580b097f6eab8a768340c4c6e57b6cc3789f4bd07fb860f247a87bf9deee192840fe5c1b6043c88a703992655e4be87da310e4394a

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    617511e334f8b3dcd61d080c6f263ddc

    SHA1

    a19db2af563635ed544a2862723b6707ddb9661f

    SHA256

    383c5799381bf0ea1458cb4fec368b3afdb89e188ee29e7a315c7bf62e4fb6d3

    SHA512

    c18fb6496295916d1b6d12b5e44eaab0866751f8daa32b3ff9f30b75dd434a9e65b14ecc80309ef4b287f2cf8f3af4fedbb6f3e59d2bbc9ec4a183a81f1135be

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    178b5db92bf69a4c734bd45a6b1f1796

    SHA1

    0558ee6305f8b409826441358aabbf4abe9a8396

    SHA256

    e777b18485b81fa048b013bbd472cdb8ab0764b6e67b37edab897d9aaaac7799

    SHA512

    32720ac8c14d39be23de8b20ae6b1a6f7309068a8dd82bf91a847913f19961eff264d3149cf5aa11622475ae40e64f0b2596198352d562733bba3a3c89a1d0a5

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    4762229462943b178ef6f24ada740d4d

    SHA1

    5a64623b3f55d97557d2e7d0f3f51b7f8c005df8

    SHA256

    1a9505a4d32ce311a0bae49857889e82d25546a4486d23a1dba0c64685e49cd6

    SHA512

    6e38adf25369db9bf6a07f3502d2cc135f0b6cc338fa806c311596c787c5d4df5938b35488cd9300b58030209a3d7c9a2ef6c78ad69983c0d158151ca506cd5e

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    7fd5844d93efb72eff6c36ce4d327304

    SHA1

    f46fe7edca88b472d34cf68c850d4c5439456b52

    SHA256

    6f488946fd9433afa60d83c0131c62fe8da20f5114e49e8ff9f51a1027b7f5e8

    SHA512

    5127be114ec67fe2b79cbd84f5fe84d7fb77e85271e8f86f3bf2c1edc23ebfb3086cec8670813cf08d4c7b5cdc630d51cb78c2c25c0ba167b07fe17d5735ecda

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    de990f38ccf395474f29be96369267cd

    SHA1

    3308e5616bcd0079183340d85a7d144b52e2c2b7

    SHA256

    9bbc77710088a088ccda254137db7852b5c73e529e825d7e630b2010aa70351b

    SHA512

    302ca4fe7cf9415e6939d2ad1ca0650e76a9f7e70da7f41835d7c10f6cf25810c16a283edf3445db162499051bd7b93b81ef99e9dca25446080a03f77d8d3a0d

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    7cf5ed865dcc01cc1c51136367005dc6

    SHA1

    7cbc6a388de4bf1d11f9e69d55f43b25a9f04b63

    SHA256

    bb8c5ba5581c8971dc1fda1dff15c12c9d2f7bf31fb53a38a343860cf5ee9b24

    SHA512

    eeb0e867567afa4f1a4d48f70bdcbe1478ec5c8211a864aa4b56ca2db3399aab2e9782de7acd690848a5e1e10a5bc1aa6565c4c99fc93e7a9b4885337de50316

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    9416591c001c291c46ccd55def5f5e48

    SHA1

    0302971e1e226437780b0cc7ea87cdb774325eee

    SHA256

    a48ee14ecf90056d97a8ee2b492c89968699e3b25bd68d438551fdc0bb310c84

    SHA512

    3cdf449b0a49fbe002e1800adf09811721ea886d9f10a8eba44149f55ba804576e1031139b89c605849a81d976360e7cefb063c734bc243d2cfacd55c65bc4c0

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    94154f9a7a343aba7698ca8ffff29dd4

    SHA1

    ed2726f4ba9e95ab35f32edaf9938cbc2f8f03bb

    SHA256

    b97c9411fbb1d349af1f1f2f1432332126a86e7911b7358e60d9e0cdf3271698

    SHA512

    929d7e24365c4fa4b438a0a3c667d28a2458f81dcdd6c8f565bc0fa138c3ae7c725cad788f540e65cd5eaddfd41e2893c98225e564aaa5d02e7059f0803af5d3

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    1a2293d26492b55c5ec76966817f59c0

    SHA1

    3092d068b8c23791351ab2c707173ad6da569d60

    SHA256

    a9ae44cefe16049fb655bfd04a0d680bb4351e038fa0c6dca586766630180d60

    SHA512

    900639bd90ba87a8b843df1f4ce7fba72b21af78313b62efe409d05fefce3dfb2b0c83e543ace09fe662a79db6a886664151265f24c59f7c5c9245cbf7a3f797

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    4957877d68fe232557fdc35ccda74c9c

    SHA1

    2e9de373f877b30bbb64cdbeeaf42e883455f0d7

    SHA256

    96c941ed4e007b74d24747bf91f66a546203dd0b59f60c1d8d33cf65944e4f94

    SHA512

    1869e19c5f3ea98f9d81f5a5050713dcea749ab5a45f8f39b46b0120c1c87350ef8aa33f262b4da47b868dfb394e43f5d42209d0f7da6da516219033409d0763

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    7b2f7a613b6cc9a5c76aa09a6d79b88b

    SHA1

    5a45b41ad4ed5941d1f52fd89bd06327701d6b95

    SHA256

    6c2726ab4ad0a2db51fec7f410622aec8b24542072418eff8a370d757132e9b9

    SHA512

    f7b6cf3fee89cb6d42a2bd72aecb18db764dfbf88ae4913c3ab7b1d98a57eef8dc58a311b234ca36ec9eb9adf170b617ae7729073465ff2d9385d12c9a769e0b

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    c2266d3a0f7b9a3a1720b6691696cf09

    SHA1

    8e83a9121a3d8fbbc13d647a652c3dc7ddb12c54

    SHA256

    15903f9f160d76523fff65db2c4ace7aaa36fa08dfc2e4a8aebd1e4644b57354

    SHA512

    7da470bc23791e505cf0c404eb39ae0f4fb0d70ff3e1d583e86607a214c73b6a260a8c0647faeef31ea4c9fc8a3f375de2630f1b67d4487632f8d86bc8ba8566

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    945b1ef4c70175e4531c3bb93d4357c7

    SHA1

    d38cb0e4730ec233ce9dff360787f8cd0a4746ef

    SHA256

    9a0d3cd04b05d13c711d2cec543c2c6032ef6c3275a78122216051420ba08701

    SHA512

    b3cdc3c0372079d78d9aaf74d93f926c249d0f7cb985e9d3dfc1f40bcab83bb06c43b2b776a410886d282f087722cc62c353ee60dd0325abef19c664d2b9e8d3

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    d313a7ea86923da701c29771642e37c6

    SHA1

    e123e97ef41cd94158331929b8a9e688944d7f7a

    SHA256

    1b03aec9a62c20b30707486b05d4ba3e8a0d29cbebcbde667bb92e47e290e77e

    SHA512

    8e9e5ffaf7f03d23d93986f6a4a5f391ec931c266e3575ba95ff8a091f37984b1969e44c09b5a676105c4666b52575f200254e019a9be1fa4b6085025ddfe1f6

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    efbf0cb70de82394477eb5924fe7e3c3

    SHA1

    fc117476e8bebd0f2b559b95cdcb52d609e5aefa

    SHA256

    85928300b1dbe7ff32e4f0502e5a22eab4a2cef8125461a0f571fcf44f9b4d86

    SHA512

    54dfa402caa043561ae49f01d86508d9fd0f678bc2888bbd74dba2e488e8989f33927e789eaa76529e2750ad173d0280ef34bb727f49d5af5c5fdfdb39f71d76

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    e164164a794e16d7db1661a5c07508eb

    SHA1

    c59efec21f240189ac7c8eb5d2c61992693afd43

    SHA256

    fc04db99c7e64b03cd54e3e3c0caa040d2c045fe7b9b29c2fe72b2178166f289

    SHA512

    6010e64fdfc36dfaf74670fbf8a206a406b02adf0e1ffae877242f80c70110228d0bfd728fb5926cb3ac8d9e507f9a68e35c849592b02683b79f8b9f5d2136c6

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/2360-47-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-41-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-1-0x00000000023A0000-0x00000000023D2000-memory.dmp

    Filesize

    200KB

  • memory/2360-2-0x00000000023F0000-0x0000000002422000-memory.dmp

    Filesize

    200KB

  • memory/2360-137-0x0000000005E70000-0x0000000005E7E000-memory.dmp

    Filesize

    56KB

  • memory/2360-3-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/2360-67-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-136-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/2360-135-0x0000000074BEE000-0x0000000074BEF000-memory.dmp

    Filesize

    4KB

  • memory/2360-134-0x0000000005100000-0x000000000510A000-memory.dmp

    Filesize

    40KB

  • memory/2360-133-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/2360-130-0x0000000004A30000-0x0000000004FD4000-memory.dmp

    Filesize

    5.6MB

  • memory/2360-131-0x0000000004FE0000-0x0000000005072000-memory.dmp

    Filesize

    584KB

  • memory/2360-132-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/2360-129-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/2360-128-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/2360-4-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-23-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-25-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-27-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-29-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-31-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-33-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-37-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-39-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-51-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-43-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-45-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-0-0x0000000074BEE000-0x0000000074BEF000-memory.dmp

    Filesize

    4KB

  • memory/2360-49-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-53-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-55-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-57-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-59-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-61-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-63-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-65-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-5-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-7-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-9-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-11-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-13-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-15-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-17-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-19-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-22-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/2360-35-0x00000000023F0000-0x000000000241B000-memory.dmp

    Filesize

    172KB

  • memory/3368-149-0x00007FFF2D173000-0x00007FFF2D175000-memory.dmp

    Filesize

    8KB

  • memory/3368-644-0x00007FFF2D170000-0x00007FFF2DC31000-memory.dmp

    Filesize

    10.8MB

  • memory/3368-643-0x00007FFF2D173000-0x00007FFF2D175000-memory.dmp

    Filesize

    8KB

  • memory/3368-153-0x00007FFF2D170000-0x00007FFF2DC31000-memory.dmp

    Filesize

    10.8MB

  • memory/3368-150-0x0000000000440000-0x000000000044C000-memory.dmp

    Filesize

    48KB