Resubmissions

03-09-2024 14:02

240903-rb57sazdqf 10

03-09-2024 13:51

240903-q59avszclf 10

02-09-2024 19:51

240902-yk8gtsxbpd 10

02-09-2024 02:27

240902-cxh7tazflg 10

02-09-2024 02:26

240902-cwxc2sygll 10

21-06-2024 19:37

240621-yca7cszgnd 10

09-06-2024 17:07

240609-vm7rjadd73 10

13-05-2024 17:36

240513-v6qblafe3y 10

12-05-2024 17:17

240512-vty3zafh5s 10

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02-09-2024 02:27

General

  • Target

    Ransomware/criticalupdate01.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>WNVkqJ+cs8OdVVKV+uvAvONcBCwGdCp6stAoVmFItZxjiAklVdO0dEQdXikhf93CAV8t1pODADDsKJ/70QfLiuB7rhcvvyBP3/YR/OdasIztybFPlFCyfmzZdyYsxeYxD6De78DPvCpzaxa+pYFKcldKONH1Q6uOgdM8mvnnoIhKc3u0HqUtbkf2atOjlwvRG1LUZgMOQVIRtEs+DvqWqD2pwsgP03CNcasOj0Cdqunv6fUwX4eDh4Sjp9iLUh+VGGKcHXvvze6Ss98itczgCB0d403tzL7Th6fga2ZOQ/6PGsgWHkGpydU2Vfz31WwRZ/uKyK3Yor3l0o/pCdjIPA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1003) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:1972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    2530f9bf7798cc1c8aba0331373824c6

    SHA1

    e69d0683995ce3e90f69fd6a1434bc23ffa6afa8

    SHA256

    e29a59b586a16d4c2d2d4b6db60d5f56726de9394b0709f80ce4d0a2160b9dc3

    SHA512

    b3faaeeb2eb9cbcbc3c404cc64436fdf5f22d5785d40f618ff1dc30f2924ab17a1afdc7a9a9ea03f60effaeb4541c207d7d2fd19632413f88a330e4263bd4543

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    1ae5052dec947df774a23a0a574d79eb

    SHA1

    13b531675a62702cabfeebe026f7ef3ea1030888

    SHA256

    202bfb3c009a9f4c9bc36622425c21e8d177e8097ff800bea8810ee9b6727e57

    SHA512

    770fbacb11689155051443ced8fb673e54d0af4aba6d512ebfe66cf6fb7b3afab6096aa883e9fafb31f819da46a40cdb2dd3cb365b43f45b89b9958f45f06620

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    9b7cd543680d9701b0da27d6c39d4e69

    SHA1

    e1e6a10bdf5ba8ceb4a1055f9c695b88dd9a82d9

    SHA256

    2b45c127bf6a07c9bff8145ddc67d36c97c281b0220e4c65b24150f0b532d394

    SHA512

    6ad7ec5a38ce066f8a4b86c2b0e8e3e64dea0241d370f58a83b8060e62376d4eec2290732b1a9a7bd56fc567e2919c195b23f3d4131a911a14928f140fde002e

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    dc9bc16e09b3b3b43a1905686c82f539

    SHA1

    5984dcbc0f33530ff830afdf56b40071c026ad12

    SHA256

    f690c3554b4e8a5a5b5e0cb5868e898ab7dc7431c5da530db793b35e32de004f

    SHA512

    7327968ae76565cfb9407643f2aa3459650e86d36b33f1f324c5e6320597bb2e7a295a7abb85d05133e35e955e41a9a0e859e2fbf5594347bb91fb384584eb98

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    42dd1a79dcce8b44310065202c5afffb

    SHA1

    d8c5d2595727a796a2b13d4bc0fa3dc7d25e65c2

    SHA256

    d26be68aca74eea7e7fff662f9ad2e6177dfb48057950ff2756d2bfa131db285

    SHA512

    9567c4d19fa17d48b741321f6b561779181b3d1b0e353bf52af2a4f6ed46547ea9cd925701785d13aa049a2980a9399b8d1d8cffa9ef47a34d3f2084651c1898

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    27f025123beef3d5ec283393ab643224

    SHA1

    f3f0589b7a55924bb6d0ca6bbb41414aa8832a6c

    SHA256

    b189abf3a2892be340f8c3d387d0295b41b39978452896cdcce1c8b1be56af91

    SHA512

    1ba65eb7040c6512dfa01980af49424bf14df1f827793dfa6875ece588809302992a068c8a5b534ba36db9a840e01752ac1da461f8f7a19c4a5d397850075eee

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    ef4fa2a6a1cbf382f2acf74ec9cba1f8

    SHA1

    96ec868e3350476bc927d0e76513a82a966d1e4f

    SHA256

    942155f79b7afa0b560cf93adc40c8d36d71e2ef1df84e6d0b55754a85c1a80f

    SHA512

    9d0e4f0ef8713324e6ed9c3baba059fead57bf1b378402342fefba5fe16d38b73a37896f95f9f0b75e632c53d2d638de608444c983d4ad58ee1bc071a8078d5a

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    7a735c917502325fd7ab865e6e434b81

    SHA1

    c13cb36c84ea0e8976b7abdfc28df91c0d0e4346

    SHA256

    9a74a41ba20452d6d27b903a847d095d7d3e1b768b83fa14a92f6b56829ad304

    SHA512

    b1a7762ed4d46bcb6d9ff08b2a9a5ee0502c4a4bd544fab86cadd401011e33bff6b020742a38c1063ab6651ce297d6e24eef625da467e9e62fcf9caf90ceb4b3

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    32b8b538cae427bf2c3b49f018ef9aed

    SHA1

    c369baac769794c8928241f6d85bf94af0f1acc4

    SHA256

    3742408736b52a63dd18020595fc3f861d87e796dd583f3af3f1b4150838dc69

    SHA512

    202ba265a2acbd8a98908fb5dcdf34457f1f7e25e665beaa08fce13739674bef5e7eb722845e13bd901e9c29b8010123a9814702b0c100e803cc725335217d97

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    05302ab233adf43d5d04de0dd34ddc08

    SHA1

    8c9bc26bebb7dc0324c8188c09ddf428f4e34b6f

    SHA256

    458c46660cf1723454dd024a84f32e6f4e91de950cbe09e25c152d11aeea7ed4

    SHA512

    59affc0f597b4d86b9db796656f7ac700c3d6ab02c8f413be7e98cd6f225f40eca30ed0b27e5baf955aad79c1af9af87c4b6c33d2c6e6a400e460633d1eba5d5

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    83a8ceba3f6b550be8bbb2dfb2610e11

    SHA1

    ed4037e0d577a0d0578359973f6166ba323ae962

    SHA256

    54d827b368da51ef851d2b9c1365cf1d71eb11dabbecc99ebdec313d182ff589

    SHA512

    5de6f899b37fee7511613072ba7d3489b3d01f4d8c8140b29de155151fdc73c2682adeb732717bafa137e21e279ba4a8f9b1b9569c226b0cb511f49993b2f571

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    eb451991526fcb9f27065f09571cd3b9

    SHA1

    f1855d972cf89d08b4013d99137b6cd55d4cbe6d

    SHA256

    5e1ec666c74cc6962f36aca6557287c8326663ded45244d521fa2114a6b19732

    SHA512

    a3b8e5ad17de3606f9e0232defecd65e8209e66cca85eb590b13eba0098f2f4e94d31e7498c6c23ee9fc9712a529e0864255c769aee7298d77b42cd0a2b5997b

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    553a39f15bf523c054bebcc1b1327359

    SHA1

    21fbe4139254df9490689cf1c839faea9d3985c5

    SHA256

    a7f6ba4a04c0cc7e5134597cf63a3ddba31e5a258524d301142f9bbdb19993a8

    SHA512

    c93904a36c12bd47aa1005f674460e294d0f2a8a295704d33e04dacc328249a8faa790f0b466ece3ad34303c4fa2ff1a9c3d8f926a247382217dcebe987e6b30

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    34ff80736a300a1cf9b41a45555fdcd7

    SHA1

    1e4fd500ca5ce40bf4f88eb69b9681ba2905ebb6

    SHA256

    51557bcee38fda98b5510a19eb666bce8519b7086112e851390220851b0e57fd

    SHA512

    783e6743fc0c904ac437a728a850dddcd13ecd153ec673a9d08de3c249571e51fdac6405d71d09934c2bb936f1816514fbab6513ea81888d2baeb1224fb21d9f

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    5e061f69c32d9c68a2b098b8b059c958

    SHA1

    026c4cbd4f651192711679eef7b68e618ca391a6

    SHA256

    d06ec8af797e6e366573518546f8d5c68a05449b17ca2d10c12ead89464229ed

    SHA512

    f54a4dc2d5f66ff1c3e4cc27e3503fab6602c9d60d77120cd7f9a4150801c2d64f0a0a68f0bcbccab3e58f163385bae6377ea847170c0efd13e682c97803f6ee

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    8ca53dd5231760c661c39fa550eca26a

    SHA1

    8692ffbc35bc99207cfccf9992f98faa6a74e795

    SHA256

    0f2348b4e07325653b3a4bef1e147b96933805a4017b9bf31404e189b3b60cd6

    SHA512

    507c90ac1ba4b262514cc12b707a4417744544faffe7290f52dee10bca3685c8b3d8c6812452c24b15e978cc7f6702a88c1da8e03d5ea31a98a0184d7425800d

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    75d7ce164f73e17ef11e7e5500d887e4

    SHA1

    ee67c3551e4e6a46299272510ceff75cc5bfa98b

    SHA256

    2ffe561a28c1772a543b9514decdf5c801fc6be5f0845ab74974216c62fa7178

    SHA512

    106bf6903f48475c2097702938b76f4c95a271a595840ed6632b920491362426196f424ea3e74f14c31c1fec767ea7163c2756b0db2ee0fbc66aa26b83c9aa5d

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    f451bf5d1271c28e86376d9d88657544

    SHA1

    86fcfb2e1166bbc58965c6da1d1c862427ab33df

    SHA256

    b2df0eeae03217b320eb7b0973a88cca49242f4340a70c696702a1304fc600e0

    SHA512

    224928e0946dea1be3de1d20c52585908c19f56384500b7bf7b6181c67b229e17a1936d76be96afd537246f879f359ef0d9735cd024b322f67c870d4e89ab6c3

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    6df509ad39e7dbcfad327238027b7914

    SHA1

    1bb1a568075ba59227449f9d94e07b493c4ea46f

    SHA256

    f07f035b5c40f750a79282ea9946804abffe5c47650973204e1fdfc0f91632e7

    SHA512

    576247f2af0842272f5db97e8d44756874377daa2a1acac4a64252ff749ecc69bf38bf8da90433515511f777b04b32e7bfbedea833afec222ec57d00587662e6

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    bbc01de2afd109efec366b12b179b7f3

    SHA1

    a7efa192997a1e1525b6c11972f13e981c81a9cd

    SHA256

    13c36750b18aac0bd896c50da8a0719a7b8034f6b4be92cccf62e16c7ec54b3c

    SHA512

    b9f658a514c4231ff66ea9e8f4a2ce43ebee7c12fc6769a532191cc9b162839610b307bc5b715456f31e62347f5a4aae4b9ec7e4bd25bbab6046bfa5eae53c3e

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    0e7a98a43ba2cb0c86f86b2154f82613

    SHA1

    49edc1548bbbc229d1f7fb7456bcfb064f2d0901

    SHA256

    c77ebb7325e461ce1e1977e1c8d1ddb805066121ce595b16bf5ffc788e8442cb

    SHA512

    6e410c6b0ce310ef37a40d245c477aefff220874bde8f6658ae524f32bf47d5d5593f7022c99123faf68a2a43ee3fef8d822b9061304f93300d621e317597378

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    fdac02bf1e437766c43242fe7bc7997e

    SHA1

    e5d9f3e33d0ed3c845a578b941f330dec7736f29

    SHA256

    28044e6ea801cab3ce09c43c51d366702480c8188e55758d1df00882317d71df

    SHA512

    e6a7a6a183f01d1f2dc77aabd00f013508ef830b4c6024dde6685b1bfc585718d0e46b1c20eb92a50bf0bad5738b850007c61b1fc78a0a3c8a3294a3c6665eab

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    43299094d4e8ca5e20426424253f408e

    SHA1

    5eca6d89837b8aeaa83b7d18e8ba356ccb72e7cf

    SHA256

    0ea84d1d5543fa573bdacb97e9fa304e3084367020a8305e96b2aca8579dc4f9

    SHA512

    ef031bb1319b9b1b307637834a557db42ee8b44f47773ecdcbd7e38ca2daa7fd2b13d864b8c5e9d128a521b1165273d712f2168a43569e1a28eea413c13c7a85

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    3aeed7a70d9bb07db110ea81e8b69cc4

    SHA1

    818c50dfad75f8fb83d0e36ccfbcdcacec702c62

    SHA256

    3197b00a7b6d76cc9a33251af9459be363ebf5bd166cbe70a72e5af4caa7c55c

    SHA512

    a747a9cbcc24d1ecf3d25f941061168afe6a5f7379c47c03fd80ebb3b8b8be12a974d36a9382ef67d54a4b34e4c030eccd178d6efcc0893bcf5564c32903e456

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    f1836d23e48141158e9d9755c012f2c2

    SHA1

    f8b15f162e13968d67e8485caa0d2877016f74f2

    SHA256

    355a54cda5a343472a605978ed56a1b13facbe744c7816222c4c7695bd493b86

    SHA512

    36f62829209b9335aa5675efd2ddfaecc2d5ef94d7c8e2907b945d2cf86a18137b750c5876726e414b28754d142f93348d43b00f541d7929323618909e157741

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.fantom

    Filesize

    2KB

    MD5

    102edf0fef3f7dec4fffc3e4e1ad6365

    SHA1

    88499446e03f161844585b9b6cbbfcd9ff75f602

    SHA256

    aa0f3cd5ace7ca0d5bea954ab137d8d557193eb4753bf8d981aabb2e2c72a7a4

    SHA512

    5507e248e5a5c4a1d6e87a5541fe8fe1c65076ade09fa91e07810901ca4ca2683aa69db945bdb85ae8984dc80a34c8c302c8a94837b54fb9438f7980df1d39d0

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    2a1fa7179b026ab423f9070287fcd059

    SHA1

    059337c313a2237022dc777ad952b9c50c31be79

    SHA256

    bdb794323f154553c5b7d5aacf2f64e8384f90e245f09de2919cb1f1b6268de3

    SHA512

    d1ea0b717726ccc2aa6da1ccdad0e9184cf0914c948678f83d25e494b8f899e2b7edea16a7c70c425d246dcc104075b1fb56cac7a5b75bbab3d0df0df9bc7469

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    5985bc037c3393f8398304403ce1040b

    SHA1

    02b3cc1d5bb7b662617b14a3f17935fbae48ea3f

    SHA256

    91ccdf7dd1ee981aad9213858d56053eebf48b3d651dc46371841588a0acacf1

    SHA512

    a600b976b4169401bd9dcfc827c4a70708f50f2fa2ee544b5ee6d53650204a904d4e5d956efc0bc2561a909c953fc576d6ac00bd10942f4efc82be213660d077

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    7e7904540e7fb1f14fea2c6bfe3e51a5

    SHA1

    55777b987ef590787147fff227c1f96a1b902969

    SHA256

    5e2be8a1e6e338b66dea081a0f9abba1fc1623a2f6fb54201650ced4ee30c45f

    SHA512

    94cd89a425d5e7ba4acb842be22b03c9c90bbfbb74efa94fc7534248d1ec5e41b1611b1f9b7347a5f54412ab9b0dfa990e8ff1a601b52ce09ca91eed8e014631

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    6b6aa19a97de0a7edbd01321506c9683

    SHA1

    950aee66682c9eae3d76ec6af4a6dd96445cfb6e

    SHA256

    4c3e602438411192079dd71a9dbcd377b7bf0acade49322a3169a7006813e717

    SHA512

    6b55e73d1708b34988be9ce9b2beb0d5d835d6cc4637b1c1c5143d36dd1f9e170d67511fa3248bb4bbb3e68a105f30b5261cb06cd08cfa3780070bdd58c4692e

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    2cdbf511722b3b97508a2062833d0ae6

    SHA1

    c0e399a03a2e5f8a193056ecb1de5a8dc2cfa729

    SHA256

    68400e008f04336cfe2e81b22af969b94ad046ba9a40c89646ba165a53977f24

    SHA512

    19692e3d8662fdbff12de7c1416ca8103ec55278968a1d3a3fac8d7fc40b8f6df446dfc3783250765109b47e6b9872cbea6195142e0879e095765d728456bac1

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    e0de12ea4169145f77434527ecccc7cf

    SHA1

    f9e7b0cc5b8b84fee8f159bbd840e075028897fc

    SHA256

    22fc1dcc1d3f2500a281644b536632a5d2c1dc0d947bd3af53cc9e21d2ae01cd

    SHA512

    1b559284524609f891f360ddfbca09480aa8c5175eb8fd2442a54d49f22a7dc178c64c1a6a850ca0afcfba1982ed248c6985f10e5a05b975a3c61037855f540d

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    4f4de958a568865a5c8d08ed752eb6c1

    SHA1

    f50a7af974603436e8600edd4b8225a6ecdb9f85

    SHA256

    f680253b25023f7aa9de536cf06ad62c123a5f281f89aaff58933d5827cf8c83

    SHA512

    b830c4542dfb9f3378796c5144a5833d5bf4cd76aad23ae17700a85184e4f174775eca2a716425eadf7b8ff6a8d9f723633b32289da5329f1962a5b52c55ff06

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    b54561a9aac46ee7f151717cf701588c

    SHA1

    8cba5c4d0566c4fb9cd06338541b8a9bb6629082

    SHA256

    ebde5943084094b3be890fdc9b75c46026730ff60a690a32541c1ac5b30f5dca

    SHA512

    571dd22f53daa4f7c9476b4e6a8198eb69dbea4fca84563682c81a5870d11314bac73ef9de982e006ef876f310317f3184f20fb0ef27acd59eb2cf40676b0b52

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    273b2ed9be6fa621a47e8a4201527fbc

    SHA1

    46296966393283b424133c5b26f9c08205860dcb

    SHA256

    4682add7a140b0975562570253ae2b016cda196c8360943772e2f6e90e43a4b6

    SHA512

    0b196235a833fa2770089b7dd721d1a2892e4871998a1b247ec6b4c68e7f51da46cf2a6d087fa3b1bc64d9643aa5035d4503260e7ee44847575d220930e855c0

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    a0a9420bd316beb0b799a4b8ad91da44

    SHA1

    a9ff2128178d93d17fc3042eb0173527e3721178

    SHA256

    7d64960359ef54fbdcbbf9518191ea59e931baa76ad2ea0e1bc8bfdd2366cbbf

    SHA512

    d5a54764826593fd1d984e86e65603c62255e475d1f7f66345bef6d6aa12fa848c1fc61532a5b7c35ad4aa121a78c95c25be69c3ca11861c27ab0ebc6f8d8ee5

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    7f0d5cbc2fa4450f8645c6e690e954a7

    SHA1

    912fbf045a7f95efb6f5bb43e352e19219ccf926

    SHA256

    cb2304c875696d06b3ec8431a1cd3791f6923c8f0a5fa1b90605cfe6d1f4a0a8

    SHA512

    bd9a0f7046d1cff787f38da0aec86205bc45c3ead12a010f5421772af73dbdbe10960ac9ab48ddb7786a656cedec15c241095cc41c24d53b78b56c2721c50107

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    c73969ddc98515e8e0163d18d5acd17c

    SHA1

    186520522b7eb7d881f91180b3a4b6fb7872182c

    SHA256

    f6b03e6331583406dc02ea240f70b7b3838367e30fa551d2711d330d674b74e4

    SHA512

    15579c4af64809270ed726d6810ef74468fa14382e850467902a6696f0827cb17343d6ab59e7c2be10df44b20d0a5b708f5caf640a5f7f7df48a10d76b9ed8ca

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    1eda5aea0cf8c543b31acf66357ad7d6

    SHA1

    9514a9b372753cda8d1482d6f2125aaa13f7442f

    SHA256

    a8525149cb99e59e9e37c80c6c4496dccfd32042c814be890c494461236461f2

    SHA512

    e884210cd5671c483130165eefdb215684f3eeaab521c9439cceab001732ed628f5b9559547e81a2ec3e61c3993f52b943047c2a87fe24c7b513c0c500cae627

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    a8d7b45309dbc51de0249dc4781719ff

    SHA1

    16810dc3c48bd6cfbcc506d09841be4e94126d6e

    SHA256

    b163b36bd926fbd73b7428a277dc292d9195b5b9e6193e7074d3fafde97c224a

    SHA512

    33aa9735ff10028112816b38682f053e5f6bfb72eeaf5e7588d79607265e82bf0c7887fa0b7152d60e5acc95cf3a3d38ec030b40d2ca5b87ae8f7b63c465f808

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    d9b60dc1ca8deeac069e07f86501937b

    SHA1

    138a151da2177999057145e146e06427db85ddfe

    SHA256

    8ecba1f70496ceac5966e25dcdf8bb6fb8ef5fdee5d45b43318019c26ae86207

    SHA512

    f7a73e0f5b2733164a7f25a84fcf94d28badf8018cf4eb0ad3e26b75ed7e836794bce424d0b6a455f0445dbc806a3434f2b91f81a9bcc5f7ad5bf6814dec3d44

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    29906405f85b726707d3748cb27e9885

    SHA1

    7a5cc1a549f2a1a4748fdc72b7e456667bfde422

    SHA256

    6d90d6b3a43129daac57fdb54be52b06316f69531f5e8a22841131f8e5f49f6d

    SHA512

    2e8aa1b839bb9030e17cb1f4f3e1f41f4610f39f84d5c54ccb98115f69c7be4857100fcc7d247a04c08d53a4200351bc886224c99ace5e3c221758b87e702b3b

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    cd359c51d644c8903eed4e2b9d757876

    SHA1

    759a44d6c2e21ef6c474d03227c048c901718688

    SHA256

    05c83b87669c9a77d2f90286312c42b1d3c919c0ae758b618550f136ad849b10

    SHA512

    0db0563f02d11ac69cefcf5128c8d229224bbbe2e2a8cd5cb497d3fd30c8d68f66590f0f7b6eb6743d60730b16712122fec837f97782cff656f2b37c7648115b

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    cdaa4f7455d7bae23db01cd7ce50c19a

    SHA1

    918bad5f58105ac22307aa1ae5cbd19cba186f19

    SHA256

    b6ff168ad7a387fb1f3b55f1147f97c2f23439b63f66b72691e8f4f3c2638cc0

    SHA512

    6a01a7c319fb6c0fd671d9349bcdebdfea82617bd2ebfc422e14d31461aafeb5d8f65babac950a8a746ff51daaeb851c4949b9c76d2ffef321cad7d4839d09e4

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    ad6c68d1c1fa7c904e78a71728edebf2

    SHA1

    770c261174cf3d36a0ad529a76c1e653b073cbed

    SHA256

    a9f7b074a8e2bb7dd58bfa33ebbaf9c81a2e2729847df540ab4781627d5deb60

    SHA512

    00e7eab570f8f12a0b980c5eea8dcc7431a7764e0d8ae9db300c1beb38443a31b61c319942f88e9200ac7bbcfd3d8c5d804e9976bd3b782cf166348b0aa42653

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    a5d6706113302d71168b967e99bd3e66

    SHA1

    fa550bc9a44b76dd33e12eb5653874f8f2d132a7

    SHA256

    28423f5c112dc4ae09fae9703f3ee7bbf2b3cb129e91547bba21b37db58a12ab

    SHA512

    f7933f7db162dbb5b8728587564e6958930a081352ed17bd580c5b2f2df3666503239cd508a1b256ea19863d884e1bbb1b8eb8d74634847e2956bbe0055ac923

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/1636-27-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-23-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-1-0x0000000000670000-0x00000000006A2000-memory.dmp

    Filesize

    200KB

  • memory/1636-2-0x00000000023E0000-0x0000000002412000-memory.dmp

    Filesize

    200KB

  • memory/1636-3-0x0000000073F20000-0x000000007460E000-memory.dmp

    Filesize

    6.9MB

  • memory/1636-4-0x0000000073F20000-0x000000007460E000-memory.dmp

    Filesize

    6.9MB

  • memory/1636-136-0x0000000005500000-0x000000000550E000-memory.dmp

    Filesize

    56KB

  • memory/1636-135-0x0000000073F20000-0x000000007460E000-memory.dmp

    Filesize

    6.9MB

  • memory/1636-134-0x0000000073F2E000-0x0000000073F2F000-memory.dmp

    Filesize

    4KB

  • memory/1636-133-0x0000000004B10000-0x0000000004B1A000-memory.dmp

    Filesize

    40KB

  • memory/1636-132-0x00000000049F0000-0x0000000004A82000-memory.dmp

    Filesize

    584KB

  • memory/1636-131-0x0000000004B50000-0x000000000504E000-memory.dmp

    Filesize

    5.0MB

  • memory/1636-13-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-33-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-49-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-63-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-5-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-6-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-8-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-10-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-12-0x0000000073F20000-0x000000007460E000-memory.dmp

    Filesize

    6.9MB

  • memory/1636-15-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-17-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-19-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-21-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-67-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-25-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-0-0x0000000073F2E000-0x0000000073F2F000-memory.dmp

    Filesize

    4KB

  • memory/1636-29-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-31-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-35-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-37-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-39-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-41-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-43-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-45-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-47-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-51-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-53-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-55-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-57-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-59-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-130-0x0000000073F20000-0x000000007460E000-memory.dmp

    Filesize

    6.9MB

  • memory/1636-61-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-65-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1636-69-0x00000000023E0000-0x000000000240B000-memory.dmp

    Filesize

    172KB

  • memory/1972-143-0x0000000000A10000-0x0000000000A1C000-memory.dmp

    Filesize

    48KB

  • memory/1972-526-0x00007FFF097B0000-0x00007FFF0A19C000-memory.dmp

    Filesize

    9.9MB

  • memory/1972-525-0x00007FFF097B3000-0x00007FFF097B4000-memory.dmp

    Filesize

    4KB

  • memory/1972-142-0x00007FFF097B3000-0x00007FFF097B4000-memory.dmp

    Filesize

    4KB

  • memory/1972-144-0x00007FFF097B0000-0x00007FFF0A19C000-memory.dmp

    Filesize

    9.9MB