Resubmissions

03-09-2024 14:02

240903-rb57sazdqf 10

03-09-2024 13:51

240903-q59avszclf 10

02-09-2024 19:51

240902-yk8gtsxbpd 10

02-09-2024 02:27

240902-cxh7tazflg 10

02-09-2024 02:26

240902-cwxc2sygll 10

21-06-2024 19:37

240621-yca7cszgnd 10

09-06-2024 17:07

240609-vm7rjadd73 10

13-05-2024 17:36

240513-v6qblafe3y 10

12-05-2024 17:17

240512-vty3zafh5s 10

Analysis

  • max time kernel
    150s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-09-2024 19:51

General

  • Target

    Ransomware/criticalupdate01.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>iXD2ZSbZyFYEpgJDmEZEgpLj4UtP+8gGF457R4AzXuulDOKS40asaBquinDx8xbGtqcVIdtYKNPvBF1wmqEVjpjHtlH9m79NSXRXkfiGZTw1jPFbi9ZMle70FEqUjS6Tl2NORtUOcgvhLnybrwuksr+2jIDvARtVNGa6fqrW7Aq7I5ZdBBU+I6AbfKeLzxyjbiaU1GACps1SDQ58ZgviVUYVn9tPlKV/vJkPz4ojNbe+4ru3mmm5amNJsGAQ3kUlDjJCEFaux028fMYCnA8CXQuKuBCHcmk/iy1qrsSkFvyJGiXpJTw8GKBYvl9BDywoNZE3YiEKnoSrRVcR0O8Y2A==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1020) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    3c1297a0cc448c8d184bf0a2246ec876

    SHA1

    6d0ece501d1cb45fcec3f451e0515a41d6587c76

    SHA256

    cca16fbb53f4f125c6872807f7c36887d70e6c9c814810536f80be1f9c2849d6

    SHA512

    8ba6d7c925f17fb437d8a259c3e9789aa8fd2004a26f728f5a672a11562ec04dc5fe2882040b83d39a67498831bee9816ac8dcc9845ce2c80552f9f838fe24cc

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    14cab644c5779ecb106c10a6d3c11832

    SHA1

    7f72141d2a836da832c610976fa8f65c1c779284

    SHA256

    64ee9ba8f924b5160888b2c7c1fc47b08019716994c3c9d13d6c8ab7b49f86ec

    SHA512

    f128ca072874c500615d2042f845ec45c374be082030812eb57639cfed85257d82a37eef5f280df5e46119137f894f588aafb0bb8206ed64a50bb557e4dca181

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    904cad279223aac4a237063b8020d2f6

    SHA1

    119f18f4788c372be7213bf8e7605222fcfe3ef2

    SHA256

    073a9d03a3f7860f26880daa00af4ad17bc057c2e66c7105b411f8e017883ea6

    SHA512

    7cec19b042e2e2b46087af0412f4a985920cb7f24a664984214c3ce339f69aa2897ad1df73fa7537347235777ab15e41160199717ea5f1dc825892380b190578

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    4b95f83273f232c438e6c05397d963b1

    SHA1

    ed37db7c557cfe542ae23e5c2ae8959cf755bcdf

    SHA256

    5d9d223ba050f043bd50ac433028aed05468eece456f0cd883f8c7dfe2de9d13

    SHA512

    cb2dc2092ad5a758e296220e5c2c252c71e198a7eeb2e999de70b279d3956790fdb6db8af44b8b35cdfa354a37ce02b708b51b89cb1d1f496624f3cbd592a87d

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    2a463c0357b7ee2df1b4d7c69c533dca

    SHA1

    8bf1dad6d94990caab9b93d8f185c6913f0d88d2

    SHA256

    d6914b9da8bbde07dac71755c10587233607921e3c0cda08bb8a3e1e8e0aacfb

    SHA512

    499665890f790d93b01e2f8682961f101e78a23351d7ea36054cbe89b42357672836d746107880b4ff01234c04faae663cea2fce4356f4fb9637ea992b8b9735

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    6ffb2c353d4b2abc359e8f78b744d66e

    SHA1

    2c62fd1671f8f22cc95a1b115b89e8529086ce4f

    SHA256

    a1629ec7295756560acd721807e4e823f49bd894b32e2feb45c282f88fc22ece

    SHA512

    f5d58e048823ae1f558a5adaf3fcedf44c9def8180a7d73efe1de41e9195cfa3db45b09bda6517a85ffe34fbd8ec1b72323568fe1acda49ee42824705e403b3d

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    0927a3ba49e40233fc83f3eb0f4da1d3

    SHA1

    f438c8603273d1d50f391a2f9c9639a9ae758bd7

    SHA256

    e4d8947e069f0f2b3ed4be896d30cd9f5d4cfb0ad09bb7cb2585d5dc6e13a5d3

    SHA512

    cc14df69002ed87e48d935ddc994fe6b2e241e108c9195391ebcc3996601816474a2dc4fc0cb35085840c422f6898afccdea7bfe65b54563f0e6fcf1983717c4

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    066682e616d4d1643802e1df3843e5aa

    SHA1

    26887753e5d32397e79fb154086075373aee5337

    SHA256

    6d79aa51071ad83972f9ff8057bf3d03e2e63f1fb22710813012d3dc840563fc

    SHA512

    4da8edc43730a8f5879ccbf5c7bc3c818518a6d433990a3ec413457be245d0d1be4f1fd85f053ca9367a651bca1ba040babb5a76d636d1ab9e8fbb040ad641ef

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    e85a691f14625db04d3bc7726fee1657

    SHA1

    c727c6594a222826a42a544e7623e0dd282ffd29

    SHA256

    12aa0f944e55a75828d6a47af59ddcf3850395a532f9e3ec616f770306cc019e

    SHA512

    fac1d1fb85d759025c8a6ad6c8ff4f4f4ef55f5dd4ff0de4d5a65ff36eed0b583916389737d6a27b504554ba7726eb98a5df7d664f3a997b1d0a5bc2f86db050

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    987ef81ba0904269693d59221e615b8d

    SHA1

    759d0bc012f7861e014e52acb67314d8e233f780

    SHA256

    f8a8ffdfc2f17d1ac89643db02f8f444ba0cb61e9d4a4cf613da5869a32bd24a

    SHA512

    e6d0b5b43d74e142707ace50815c566691d2e8ac64236ea266342d3d3a209145558742ab950f3544805d2a232fabe52a5c3e0d682e2a5a189f9378402a05a6d7

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    00810ab13799fb0997d691386dcdc8e2

    SHA1

    ee67511643ddac40338dd62461a909011b1c844a

    SHA256

    116ea19676dd35f75b3884e9cf1d4464da7eaff44664c105fa39a79dc2fbbb9a

    SHA512

    bafa497e9f857c0f36d2aae9d39d514f8f8aaa59b9a27dd74440797b45d5b930607df96e2b564d72dda831c6ebf575e7c9576ce0ba2b9ec667371beeaa2ad885

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    cf8570bbdbacb7669971364e97537329

    SHA1

    d5b435b7d41cc737a4600cb645f86a03dd8f79c3

    SHA256

    f58a51e3ca1dc094d714bb6f751a9352f871239bfa37347ef0490735de70f0bf

    SHA512

    c8eee96fef29e2e2f86ab90bab995ebcc01d2ff23c524e37d40dde58960ac9bf6cdd0b46570ec0209d0c47996a121f8c9626c7ea1c368b4c335f07ebcf33c3db

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    8696ee55d1af457532272130d1efc458

    SHA1

    66ce65bdff6d6ea4903cf725f8b9ccb94a586efb

    SHA256

    40dc70500fccd61d94a0fb9180aa410299ce4ba29c7cc8da508572a0c05c4d8d

    SHA512

    d1fed3d74e1ce934c1865032de1a1bea688803e04e9fd641175649354aa74fa678be6d61acea21ef326398aa59158f1080e2249b9471959e685d308e5554a73d

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    769ea885d67af04f5f5144622c16202e

    SHA1

    6a8ea1a238b8bbb698adcff4612922a2297cfcaf

    SHA256

    37c780a041d89a494fd90ded8df899300b79ea4e8b5b9c79749627c48117c8f0

    SHA512

    ce38bf355e7c5be28268941d9fddedb8009d9fa4098295e7aa5519048e47a6dd4affb26cea6c129ba3847ed82b67bfdd5e1a5ddc8d9e644fbf00dd41088865d3

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    af0326a233828a999b4587394df4b877

    SHA1

    de4aee37a622b3233bdd55c06fccc287b2b96861

    SHA256

    98cf0319e6cc732a2445116293ef7a512564506a905640063393125cd9e7a7ef

    SHA512

    5b808b3a25d7ebd475e2640d0b9c850831519362e17ca2284f14e6bf23c2b2ae634f7a702c97bdea2a122c423de8f78f67d719077871ea70f2f783c27d16cd7c

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    ac8787c245a89358cd442761fd540ce6

    SHA1

    cc611aa4460e87af283d93c95750c14f1d47e121

    SHA256

    766a737cc54519706fdf77d2ea7c4da80f07b536dc5225fdd40888247c08e307

    SHA512

    22d40a65c7927db704a206050f78697dc5951881038f96da57cfd93f06fe18528c896594e9e514f7e5764386df4161f88416bd8b32dff7084fa64788fe40e632

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    55b6363b8a29d370650c66fe735ba112

    SHA1

    0aad558ae412b37f938f9d8a93341bda11c14c17

    SHA256

    d804a2800f4888ecfe6c1e7156f756d12c62acec240b019fe5ce2a65f60b7bf8

    SHA512

    37c2413871824f5214dc39769ce1c48170826cab56d35f2893c0a209228aedf2290720ddd8a49a935e23fbe2653929a33ee47bff775554a260eaed1660be1be6

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    019ff884eef47d82a932beda68110363

    SHA1

    e704937c529b5222907b5135ae875a09eadb6c73

    SHA256

    41db3e47d2c17f09eece53d92428fb79a37060d8671f568e5bb9965261da1d57

    SHA512

    722413c8243765a8723e38d361b1cd02393aaf9921c42bdf4966f0af2d56974b9807ef32cac3db2c2890ab60a69836f7add70d4ffaa3066832883f1e5435e96d

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    cf4a77d0621588be3b8dceedc4ff213c

    SHA1

    95e5e9e5c1ac64f54121d29a0b365517c03e8d67

    SHA256

    25f7885c84a115f94e4eb2ee82981578a25f69c43365c5c1ad37f103cb728816

    SHA512

    0c2b5ea636e19df8bf0c653b387f4cd30e76528bea179e26614b5f826d77f13aa2e3fd1f145c2386ac4d04ccabf992440641ce26d30caa340cb77b4d9cd66c89

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    129ed780b98a95f41ca288db1c26e5ba

    SHA1

    128343e2bec86b647c38332eb6f7ab40d571b48e

    SHA256

    ce6c3c84639d15663fd78c8d7e1c1c5b2f0a7249cbbfdf2f8070149135ca153d

    SHA512

    ab28fa30328cda4e74ee7bc0b25af0e328d4aead670da4cd3d01c33458284cfa6bcfc2204337d85da74b73461a01321dedd39ca0a09aeed00342116b2fd0f6bb

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    5f8e2f730fcbec4f7ad17852ffd01fdb

    SHA1

    ca8a2d854884d028a7db4f4d650aa43c8a04de19

    SHA256

    59e5f0857d68f39093d555f5793fb53b0bbec2fd588d7023c2b7700263d090c0

    SHA512

    c8c0ca6cb0f588a1ccf86867cf80160335a288123d3e0d8a4724921106bcd392c127a1c04bd5f36eb20bcb35238f134604fa1541ed3d2324bac9105fd539f64b

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    a5c55974cb8d494caed434b67f9d1502

    SHA1

    7faf5188ec00d5760a9252371576d3c71b5372d6

    SHA256

    582380a0aac7f3d84ab41e027bc1fdc2d793a02c1fede5d8711a26777178e3a5

    SHA512

    6ef91ca8dbe40e570cf723883524996b0fd859e8d211f7dc2efea3d3f1586abb3fa0f54e496d76cebec925c95c3e7050855277966c656f5855ea70644318676b

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    4be78401dac10b83ac0cb9c1c23839c7

    SHA1

    8f20765d19a1f79c52b69747516576040d0ab140

    SHA256

    adbb78a396a307e0a6f4ecb27878eedaf87ae518beaf252f88cde6e772bc337b

    SHA512

    81d904c31bdcb88f2e9375f5472a5b562400eb38a7681b4b1a6bf2d63140eaa8a08cfd430d75a5e8d2793de64de4220c5f574b2eef1880e67e2e00be1f5ff7f8

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    bec6c4796fd819d6b7091c0c43cd8823

    SHA1

    260a3b28339bc46615cb14cb3e06734704375f34

    SHA256

    f28c1f88ce7eb93503971be3f6c2b7183b3563e4ed8e4f745fde64755c8f3594

    SHA512

    d29d43880eb28e93b88ac45cd3eb1a9f4f0c9ce929731eef371560ab4dc860cfb7b978ac21cf9353cad7ac3d02eeb7426c11ec6e6b617429f90a2934893fd546

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    3a0739e51dd20fe3650b9a5e0d0eac12

    SHA1

    7401aa525e55f77a710f247e49e78cc81b191307

    SHA256

    62c588a945ee67c3c70432e16d0a97a78b2ad08b42179d78b4a219168bc2b27d

    SHA512

    06e7566f64cab05d260f72845fa7a8921f0702cc1a89fc07e2f9dfaebbc4fd11f0b7bc5a15e3b88bf0af49052ad8e48af6e013fc081f40afeb650f5248a60d51

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    41477f19e863d27c98b4e8d847880f25

    SHA1

    06215830990c08d6d5d301f724c97931a5fd8087

    SHA256

    a634476d11c0381f1bcdaf387e4ff437dbb1bced8b40c3ffe7b264fd8245bc35

    SHA512

    370e84409dc92918d6cfc2bf6bbe6dab8be12fd9ed678fddc97e3400086b7de731f14b6f2f9b057ef18d2984b6a5790182bbe54e9b1b69b00391fe9f002fe3d0

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    f72f2a9d46bba09224792de281a9fd68

    SHA1

    9cbbbc09950a23cbf073b213caf070e5698fcee9

    SHA256

    b9ba52434c4964315b1b542a6aaeeeecd15c5b5f4ec1b3b4da21ecc1bcf6a126

    SHA512

    6d05912f940ab1614baab6b5fd6657eefe1fe918cfb68ecf5f179075dbd3e98fb89f47a8abe23315885abe5279aa8bb7bc7d39515fa31d51d3b7908b66dd5ab2

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    48c8c2f9d417a84d804f82949af9f758

    SHA1

    5cb75babca20784b482714584a1d19884bec7f77

    SHA256

    aadb6cdc2c6bdf2af4e01b3d3907b65d5ab29b365b963a35bf3b9f21f88d8e71

    SHA512

    951941fcdf6e9e8154534ab1a7ce0b47eb62457169af116058cdce1a32043de6b9529b26932dea791de311e65b82471bcf3ab650ee281418476f8f9d2681a771

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    a6e60dd7c10a73ac8787298ac01c1396

    SHA1

    2d5e43bbeabf56fa1e5596b762d8d5d8fa94d20c

    SHA256

    dbd4d8972e64966f2228b6ea88ed417f2e38ea385953b27f053b1707745de510

    SHA512

    778e074fbeb4b8efe9be549cd775dc03ca30f72132c7d9ee675ea69eaed11839dd999fc17690c99039963bf4401a178fbb3bb312cf1feeee5afe80cdc3cc9042

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    11a3c937be541ddd38e052e4d96a5ef0

    SHA1

    44eb6618134265a72bd9704dd1f5690b6f480bdc

    SHA256

    5128b0193af30b84771a73e81d1b18c40c23848d419dffb4310be650b0febb7e

    SHA512

    733242345b262cac9bf771ecb92a585e6ba72527bd1100d7f6057b486472b156dfe24f20fd19e306a562a1fa94eb2cf15be0b717ae33b9d7b647379675fa37cd

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    06a364f3fadc47507b03a906798a9db2

    SHA1

    784b33ad550ea78a3131e58c7ecf3b75f0d1430f

    SHA256

    daed1217cc608612c51d777073ec888c95a345f799872f3affcb9c8fb11d7824

    SHA512

    99c1bf7d49d26a07bad6721072aa27c3246326673c1671049500e71d974efe949d905d8a6b3fdb4ca3ed6e399eb62e4da1b9b3247cea0f77a3f904525a44e775

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    9465370e3bd56b8efa657bdf48fc3a7b

    SHA1

    89eda66da5867b2ca24833ca40e10e5f75e19317

    SHA256

    f492f8ea5bf61e685d79a5064f27d9385b64b0b37b65c8aaa97d57c196ceebbc

    SHA512

    9822e09d7b76c42e4f0662ffab116619d2d6bd632fbc8311b317ffd399967d2edd133360e6bc6e859d7d147b5db018dcddac781214d638b3edb73dc5ae854ccb

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    e97066c180ed10716b5a09bfedec0330

    SHA1

    9dbb1ace3e2d5a84827c28ac8a7916484dbb5eed

    SHA256

    d50bdf19da947bc9f62006774a5b251fec6e84bc0fabe0fdb1a8d1198657b565

    SHA512

    f5260baf2a4e10bbc45561f06a318fc2d8deb0389d3b0a1b289f8eaeda662b807ebbb62d39c500f42e3cf48c65f710b7c4a4cce41b588050330e48a9dd078143

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    341e58327c2081159c95d38bce8e6847

    SHA1

    3a83b905c5be053428cd0b3632c2e66d9283f250

    SHA256

    1c4b413f6a7cc6acb56b84753516a52763edea58e43b96434ec2d3efa2fff3aa

    SHA512

    00559b0c175209ef2ac9750a5a7c6e24025c8f73d739808d1413b6b98fe503d9b86346157474e099590b6112412f83a8580a1faeeeb507f398e7e3c92d9b2679

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    40837b382d2cada7f292f9a8ca0f7be8

    SHA1

    4ba5bc917a1ea77c04b8f37dab5eb42e686bdec1

    SHA256

    4c5453621a406aa88431d5adeb9d74226088184e46f58e7aa3d245c77ae2464f

    SHA512

    08f5fb3c740091c38237a31e80259b0da8e017bfa144820c5a160efc6ebdef7056a97c61950cb633afbbb8cdbd2769b4da4a8ffb3eaf40724413e52ced2625f5

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    1a9f75194dbc03c249233c8b933eee05

    SHA1

    01f61aba2eb7a29b2d9a72cf4b8fc1dd9a84cef6

    SHA256

    56814b74e35a657963583e28a26bfdbd606cd7213e02de95eb26278b4c2167e3

    SHA512

    dd082eebe581ca151f8d4b0880cb413f3b39f829d8e40d40c5a5aa752d6b634bb8dc235b1289f7c2644764129d7867410d0896b476052c5c39e39da2644b49f7

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    996b464cf0943a04928495437278d12d

    SHA1

    ebc6fd040ac003efef40a7773020957e4ffa7bf9

    SHA256

    003a9138e491391a8784e6527702b3be7df76b25c5582c8c6ba211ea4824a8b6

    SHA512

    d0cc17e50b8aab76eef93b553111026795427d3bd3bd93703012572f63d02371c1271c3b8c3c01388403349eeb4b9ebafc1fcf94c81025f74eede1b8221248db

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    c0ae1358d4d1f7805b0d43c317cfe4ed

    SHA1

    caff7605ccbbb67d781f41ff4c571b331de44c45

    SHA256

    0bf7b308bc860a4d57f994749abfada6a19db353db5471a14d916a922aef6ee8

    SHA512

    53afdbda31b77bc369afd7ff69c1be59105bd818de9eba0700fbc2f91bc738463d0ff4e9a16cdfa033abf3f04f738930c069f0e2e00e9f6a3e4fc9b8b0782333

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    8de470c2f781609fb4b53b901492bf4a

    SHA1

    755bd99c87a24715dd1a5bfec7581de820cda7f5

    SHA256

    23aa5753d35f72bb39ef327c8496ae965133376b23b4a0f0a55972ea28e26c0f

    SHA512

    9fa5fbd02614994517cf007d3ad991d696cd3579d0412352a5f3cadcd0df9f30062360df2a6c9b2787431dc4571d965b4b23997af4583160d0beb4ef5324980d

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    db93990833cda45daa9ae19d9d82b5cb

    SHA1

    61f879b7b7efac9d6dbbecb24e450b5b52472035

    SHA256

    abdff6c97fa1871fbec7b8f938573d5f1c9a6456c0686deac552a4b3e2e437e4

    SHA512

    b6da8ee930f3d269cbebc93d62232b12d1fa9ec1ce938fa3e3eddbb312cadf97cca26e112f116b1d7180854dd5c2048599786d0229925438c696a90289dccbe6

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    84a07ca281c5498e53c25cbcea2c9c59

    SHA1

    37697dbdf4d2eef3c9e2657ad8f0316d2f87a905

    SHA256

    07abd005c6bea791947b019f26e0e0a318052c67807d760f3862625bd6e0d1f4

    SHA512

    cf0bb485ab405a2364fa83fb19ad4157e9ab0568ca9704116d40ca39dddbd1a565d3630e62d4aca3f7eed79dcc9c32833197592a472e6e5c9f1d290cd9c4d24a

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    4cebf9f6bb420fd4f179303a049b7909

    SHA1

    ec2ee03ec082f8d218d597ec97a49db9eafef71b

    SHA256

    c3009f1b1b357465f863308968713c2052ec68cc901c40258cae4b08843bb493

    SHA512

    6df1fa24bb9ebdc68cc05cee75e3e993800cf5d2287c38523cfddad4dc07affbcfca0db022700a848d7e0172a7e90d52a5ce10566982d5c194fe93b6eaa287a2

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    0f016ce2243203420d56627dbaa61ba0

    SHA1

    51392ea97d2dbea5932dde5bae673ae202eb6e56

    SHA256

    5054cd7e6d59784c9d83f4c94023e2bccd1982e08995411f428f49cfd79ba650

    SHA512

    3b28f60c340257ab6ba7a676ad01e80015a3d62f121d51f0ad0440dc14fbfc1898ecd976ea7d32a2ec2c3ba94e9da436c0efa84c5ed9a70b1157aeb3d367331f

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    7a8ba881d21a302e35e6d0c391f7fc79

    SHA1

    81139884f173bd928750682b7647593c895d4ae1

    SHA256

    96c4f074aa6f24034b166eebf3270fb4c69a3827f8f7f57fc52727e998abb647

    SHA512

    090de1c3d2f57fa7952c6db1fa2b8f48401546a0ef786d524d6d513aa0bf6b974c4f2394c9177d59f9623ca68553fa6664ee4feba5a608abb3d06340604a35d2

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    074cf9f610d7f2643d4fd08eaa682e0f

    SHA1

    de04212ec3adf64b3db970dbd557e0c94a88a03a

    SHA256

    6394098d1dfee1b92dfc43dd661a2a8c86ab4eb0ab83a0007426fd127e545edf

    SHA512

    4cf1b4a199b4fb4bfd15962a476f3e44ded0b98c048536157c8ffa6fd58dd857cd0361ff51c9dd3b6d03fe4cda4d958de2bdfee86873acfa2dde4bdab18855d2

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    ecd51ae5301f2ecf67831b6c82df8b3c

    SHA1

    889421f889b72d81b25c1919a4deb0373e82c295

    SHA256

    443381d7f8833daa594b95ea9ab6cd4b6a89afc5a521344efbd869c92ae53c48

    SHA512

    368e1693c97bd74b8ab863caf73395314afd966a34f796a62b0c1ea015215d9cafc7b0c9124ad2c63dada335c1d15877ec8d770597b727701ce6157e3d8f6ff3

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/1808-37-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-30-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-1-0x0000000002410000-0x0000000002442000-memory.dmp

    Filesize

    200KB

  • memory/1808-2-0x0000000002450000-0x0000000002482000-memory.dmp

    Filesize

    200KB

  • memory/1808-137-0x0000000005430000-0x000000000543E000-memory.dmp

    Filesize

    56KB

  • memory/1808-3-0x00000000749C0000-0x0000000075170000-memory.dmp

    Filesize

    7.7MB

  • memory/1808-61-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-136-0x00000000749C0000-0x0000000075170000-memory.dmp

    Filesize

    7.7MB

  • memory/1808-135-0x00000000749CE000-0x00000000749CF000-memory.dmp

    Filesize

    4KB

  • memory/1808-7-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-15-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-25-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-35-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-45-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-53-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-4-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-5-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-9-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-11-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-13-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-17-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-20-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-21-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-23-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-27-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-67-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-31-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-33-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-0-0x00000000749CE000-0x00000000749CF000-memory.dmp

    Filesize

    4KB

  • memory/1808-39-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-41-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-43-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-134-0x00000000749C0000-0x0000000075170000-memory.dmp

    Filesize

    7.7MB

  • memory/1808-47-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-49-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-133-0x00000000749C0000-0x0000000075170000-memory.dmp

    Filesize

    7.7MB

  • memory/1808-132-0x0000000005340000-0x000000000534A000-memory.dmp

    Filesize

    40KB

  • memory/1808-51-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-55-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-57-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-59-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-63-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-130-0x0000000004BB0000-0x0000000005154000-memory.dmp

    Filesize

    5.6MB

  • memory/1808-131-0x0000000005160000-0x00000000051F2000-memory.dmp

    Filesize

    584KB

  • memory/1808-129-0x00000000749C0000-0x0000000075170000-memory.dmp

    Filesize

    7.7MB

  • memory/1808-65-0x0000000002450000-0x000000000247B000-memory.dmp

    Filesize

    172KB

  • memory/1808-95-0x00000000749C0000-0x0000000075170000-memory.dmp

    Filesize

    7.7MB

  • memory/3920-149-0x00007FFEDB763000-0x00007FFEDB765000-memory.dmp

    Filesize

    8KB

  • memory/3920-622-0x00007FFEDB760000-0x00007FFEDC221000-memory.dmp

    Filesize

    10.8MB

  • memory/3920-621-0x00007FFEDB763000-0x00007FFEDB765000-memory.dmp

    Filesize

    8KB

  • memory/3920-151-0x00007FFEDB760000-0x00007FFEDC221000-memory.dmp

    Filesize

    10.8MB

  • memory/3920-150-0x0000000000C30000-0x0000000000C3C000-memory.dmp

    Filesize

    48KB