Resubmissions

03-09-2024 14:02

240903-rb57sazdqf 10

03-09-2024 13:51

240903-q59avszclf 10

02-09-2024 19:51

240902-yk8gtsxbpd 10

02-09-2024 02:27

240902-cxh7tazflg 10

02-09-2024 02:26

240902-cwxc2sygll 10

21-06-2024 19:37

240621-yca7cszgnd 10

09-06-2024 17:07

240609-vm7rjadd73 10

13-05-2024 17:36

240513-v6qblafe3y 10

12-05-2024 17:17

240512-vty3zafh5s 10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-09-2024 13:51

General

  • Target

    Ransomware/criticalupdate01.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>N6LQfM/smnA/0CwwDQPq3fdfrgjdyJb8jhZLwLaFUkFGjZw8L/XKJs1N0I/4UGEMnq8W2VqJyFLHjKdP6gsaLFEPjcTFM/hbSiMQ37TMMWybpcUwQ4uTkSlUDu0Z/zvd4no0MkrE7mg85mslLfkze8hACNYOkJzKdX6Samr7KkYA2l+MZ2/IGJob2f2TPMAlfNP955w6kG/4LMuf1P8FN772SPuGxcZhsOp++kWSxSfP+D76ARWryg+T4UK4RwaiHf68HwGriq2uPUMSOtnSUOWJUm7MORv8H3JQwd15fw1KBeVzgMeATySGQTarD9TsjQkQ87kBmmkzxujniQSQow==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1032) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:4264

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    7527d08741117321f66360e7938f4cce

    SHA1

    edfcb84303ed78c5435df5f0ba918658c22cf66b

    SHA256

    3c7a4aac7e87c9414ab253dbe8aea30c1987fdf95dad5609e010c4ebe80e4e94

    SHA512

    d806207aaa0eb5d75fef145677848243dc4b174c0075ca9fc0fb9e78e40ed8898e112d85b119e96ee1d2661633db93dcb918df3a5ca112ae1fecbf2c8069017b

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    5f3ae1da166046524bd80a13f56b0fee

    SHA1

    8c2396e343e81d10007c7cbc9db9d622f7b2f5fd

    SHA256

    208f04e4c6ca81339a51998db105995b6b3f7f6eda7bf9f7f4ccc239e51de7d6

    SHA512

    4c0ffcd603ca630952e721f87a9013060857ffc7742dc7791111fcef396cf7657bd67b648b7528ea67b8fd39e29e78dd0a0fdaceb393edc6cd3d1dd979ec63b3

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    d6f82bebbde419bef6f09d5a08aae730

    SHA1

    63b7295f2e4ff83de50c295321e0b9079b3505a0

    SHA256

    22d55e197a90a16d06e569c7f23888a0a77c857f65b9dc993c8f3f92c3888efe

    SHA512

    8a6c53c669c7bcab668a0385dd6affa7de5b03b9940078773a2c2be39967091c79a28624cc260062e7702cfd18da8204e11baef92617c542731afb01061d635b

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    4c6374bb8cf8e21c6db7ece1091ab7b4

    SHA1

    809b7476097646883df229a9b6eedafa13a65135

    SHA256

    7e044ec2c9b0a7990691451ed9dd17b3c17e1fc2ea1d3a13ebad3f421c1a613d

    SHA512

    54789269248575dece30793820a4dee6034316fdd6736153de0d1376d6ed77a9dcaeff67259e2fef3c00d6999f28013c48a774948631d1c8f641b4d05cf3670a

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    2785fff405778ace7727ff16873ab625

    SHA1

    2123ca75a00ce0cc45df1337fc37dfc1346b748a

    SHA256

    39b5f00a88d5b3c5cb7919a72a66f9ed288f6305b6ec29a050fbb2451f832985

    SHA512

    01ceb2c5391c8d9a3075baa3b18387734abb6867989ea874c0c60927113da55979d6b8c95409bc5d4dcf8fc35c59fc4e712c9d7e983746af63fa0426c66a3e6a

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    67b39697662d05f6b314de0c8e02fd88

    SHA1

    8b4e70d011f4d8fdc76fed0a4bbfead58d7df47a

    SHA256

    46efecbacb17be806fe336a98039337c2c818a50cd6ef9bd99153e1b24d049f5

    SHA512

    a0e54afabe10b134c9c1835e90d9389a2d11b813107532b879873348f1470cf4b4e6a548de616877da9fbce886834f212a3518fb9a1477f3f7c7b435880c6085

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    b0d4f38858d4d3744b2f0a3c87121106

    SHA1

    8cac2b9e51db57f0db622ba68e06e32b4051c2c1

    SHA256

    e2db2cd97c6be1441dc1f3662718d6c602b12c68f5f5a32e0b8e8c38eeb4f9ac

    SHA512

    aacd8789242fb47abe08336bc886e9ee3f0ddfec52b9f7327f2ad01c3f565ae86e93472adb1edbd71442f0495d613e737d83d45c5f26559d04cb010c3207d471

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    1d726cf22ddd598ccade4ebc3a2339d8

    SHA1

    4194f5e17c80dbec903aaf1c72d98aa7457d3293

    SHA256

    89593a958d41e8ed544dbe4d5753efaffe462551e8b251d46e9d6bd2a1d8e7cf

    SHA512

    e5fec60c38d8270525f055915273dd4046dacbd3af817ed8f6fd54d03156bc5bb48ac2f8764984ca17e05f2d2be0914fb638da65fe9a8dfb98f5bc142a36c19e

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    c699fc300e7a8d9ee3ba857157c0c827

    SHA1

    3193a38dc39226cb5c03dc7a817a550e944bd290

    SHA256

    94bc897e069d1c921377d7557e1d21dfc5c4bd2d0846dbf9becfdf4e7d2fcf01

    SHA512

    fb5c6d8e42f9a914f9e6fe6614254895d267d086140a64c9281ff1d7642e4c69f3a667a27dd131e4c2da2327bf0e8063255d7e9fab30708d4ef562e397173c5d

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    582331c36a1ebb366974d71be00263b8

    SHA1

    b70c4c22ea521e5124f1ebc5f6adbbebb2c6bbe7

    SHA256

    b326444323a840fc6cb6a137ed7987bee1f2f6322eef9ae215abe9abd32f3e5e

    SHA512

    888bc0ab8fcd6b2c789fb50f50a11b62813c3487f9da6fc4a28cea06bed7c5e4b7ce8166f166c042b6badc2786f7d18e1a02e2f5a710f5a5910ee47714f884a5

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    1e4e5ecfbf632db21488be7473f18617

    SHA1

    8a045c490daf12f305bf1451906a613a19ac01fe

    SHA256

    2f162b903e7fab51f78e36d76defcd95769352388ad1d7ea903d1d7fec572d8a

    SHA512

    80e666b5402c4e26094c900ac9b3f4722b66ae3f564cee0e03aab5e8f5eac492defa28daab5dc724093628dc6959f9f262c6e76b0918ae6e6e07c0c7f1fbc78f

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    4343528b8ce48b373ad252677872b96e

    SHA1

    4cbd1a6f113e5d8d8b6b5ed3dc7af01e03332c48

    SHA256

    35c25004f2e76ea781b24aadb7f79cc3dd4e4bbeedc278d49cb553543a999b69

    SHA512

    c4976e8b3d304d8a9be5bd10e5ca5a1d9d707dfdd9476f29e2d7e60fec6046558acc8d6189028d5f43a799d21e26fe14368816fb3a7f89e39b35e315e55d71ee

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    625c47d99b34e3a6a8e09978d09963ff

    SHA1

    b545897b77a39eeec2267071f974bbd910f01264

    SHA256

    a77e46308fe4a8d1262a5eea7e7dd22546bd9a6cd9da523b51a0bf4bfe45cccf

    SHA512

    747b22dcd78d7905c857679fcfca82e4eabf7476164164e68e366ac066805ab6eaf7e7f9e3ddb5bc7b1975ba0297dc9e78f2baa5018c1ea9cb55f8afe1b7a02a

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    9deb5ee9043dcf34cda19c5ed59700b2

    SHA1

    3451a04b16fe421086130776231ac1975597db43

    SHA256

    4df6c6313aab2c6a245c179e65556d96edb31e57e83115e1ad74703955381789

    SHA512

    88c743447d46e6b93aa86cc477d2e158236c1e27a2b56747e817fc084068035abef31b4fc7a37403fbc30de4cb4316c08ff416b47f85481dddf395ef1fcb4ac8

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    e854de11dfe6439cbd5421373b1ae47f

    SHA1

    bdbf1fd8244942791f9715497ee75ed37e0075c3

    SHA256

    acb4420b0179bf1f1b6c78d349334a5949f36b4c9f3a0fbf9580c0779684e70c

    SHA512

    f1a4ef1b724d3fdf0fc9dea90173efc301f646c0f027fd310a7f0160c0456cc1c421f57f2938d3c7f0cf0f6dfc2d51d182a7097541ac3d88589fd1f8406eb04b

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    ea8615b1e34b8c22de67277c20b9d88e

    SHA1

    bb943ca363315959cd5c7daafbcb4f051739de92

    SHA256

    7b86509329f3957d32dcaf4b3d49b52ba5c985c6052107214808eeb647cba7e0

    SHA512

    60f2a6bc7b5c89574f7e7703c5a88a94ac92dfb51961a1446cbe8ca967283521b728bbc57b3819eabb9e72189095dba3ce2405c2d02779febc0fc307fc990fc4

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    9722843300fd2c8c0c5deba732bf2568

    SHA1

    076a6241b84ee77c6350caf7a3ab32754cbd207c

    SHA256

    119ad874f0a5933932970c93883049de1ce76ad9692a89dedcb9b6d79d09b85c

    SHA512

    5dc6e69ba5ec5b6dc6c052624e7f0e56c1882cca0511a11e632e841f5b8f8f338627ffd5e3cd66dae64a7375c518ac0579c7db68389fab1d6f2979f2b5a3d757

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    271c8a278e2efb7745d2cb3d71ff711c

    SHA1

    d1476a010067c6f69b023387108be9f503bd1f61

    SHA256

    5a34ea841d976e330a807c6db1247398bbb66f1ca3334f744e71df642c2b3423

    SHA512

    70d619cf10d8e43d42b690bee729f0d931ed6efb105aca3f7115bb2d4dfabc94972a2c7c150aa5c9fc24e06070638a22f57d7b72702a36a71cba89947b54b871

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    c96d124e2aee7048c9905d874fa3f933

    SHA1

    42fd71d05af23ec9789f2116dd130f5153b2a3f9

    SHA256

    133110d747fcc81d73c81ad3c0079d8a14d15231c0dc01feec5a3bc9e8e9f058

    SHA512

    32e201025e7aef02e857632ae23307237ec335cffbacb21146ce3840de47825f04440ffed9e7458e9b86d0eda1a83517fc674091dc3ae161eec24215fdf0848c

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    3dfd72dd145600bf2dc9971fcf0d6b30

    SHA1

    b8ee60b08d34b376a62040ffa4d9486d2fd0baa0

    SHA256

    cb946b5154f83c9ca40ad46b1005e41cdb7273af01ef90abeb9b72f1a391c67f

    SHA512

    d5d6d001e87283298740d106a9e29b722234309ea5f0b44f629b23e86185ae487856c0f0c7010a97d8360f3b12dc5841a007c116aa1b3d57d46486ef140498c6

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    3efe596f1b080412bf466d38b2a47486

    SHA1

    6b44cfee0ab915151e64173dac834315d7f5eac1

    SHA256

    a5229bf1db2d55c7299673e74c4fa6091417691601dd5978b4b78b128eecb954

    SHA512

    9dd7a02dfba7279a2557381131d6d2c1ab8c0e207c953a754f97a37749b8de83c36a8cdc93a4741f067e68fb22dc0824258187327467c53218de3536176dcb6e

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    63354718982ab87cb34ae70869821bfd

    SHA1

    41559cca1cf27f8b352ef66027401fc5d2d3ca21

    SHA256

    39fce8111c6ca96c63ca2b8c178b95626f8f34f85fe81385671367d4e85ed0c7

    SHA512

    0fb87881f1f7b0b929c97ad6c2c424667c95fd8ea298008906244803c787748191aa529c0e4d2d515980b3db9c0c99ef9574f4f60fca4a2a17274266fd4d6235

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    6d1536c409494cf22982b9f4f102bc77

    SHA1

    c1259574cd233ef8b6133a5067319357df83f33f

    SHA256

    4a1674c469e6b86fc0ae1eda66fa8ef30f3ee67c00b9548434abc48db90029fe

    SHA512

    e7e0cf4099070f2e4b4f8d914cabfd5d382e523ad760b91d8c691ff734bfd644dafc66d977535cc14f1a3f1237e6cb0f2e6f07aa35572a2e0d5f577fa1908b3b

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    5a502580bdfcdcd9f71938400d3a907b

    SHA1

    09373b3d3a7fedee3a839aedef7b45d55999e734

    SHA256

    8cdf108796035c745b6ea3edbbe9dc37c452abcbb8aca92f856e9c9f70e83941

    SHA512

    9def0843350e42ce9f750f3d613f083211f131cf958e1d7578635a26b925e3db08ada951adc4cfea8784fa5fc64f19459939d07ce7626c98603b1d3e15a071cd

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    ff385eaf206da0bb48a1c3a207de9e40

    SHA1

    593978c4206cda393a185b6defda027c3219b43d

    SHA256

    9af1dee538396e367b244fac178591cf951103b2cf0c3852d087a8698820ecc5

    SHA512

    0b57315e161e41fc0662e64af6169b4726a54af299fc1f49bc01b48f3b171274ba55dde84f9056b91e4b70408df5d6b7b6324ac4bdab6c6f96954bd442168da2

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    b1b68a13f7606ff594a8a64ef8581a1f

    SHA1

    e85f1d031a12bf9ea1178764c4d4f2caf514b0d8

    SHA256

    8926350ea4d9ab29170691717a461e117b78b5b872c4a4aa351ff28994eec88f

    SHA512

    00fb909975277f58cf7109f5a480b83ddea06d195f87a1d42bcb6af201069209fa54e8e967a1613159a6b6763cea841ff3f468f19e66b9ea4499df9d0a3ec6e3

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    98b6f882b5b95574b9d4a97d46c24ac8

    SHA1

    4cf64e50e7cc62a74c14f7db4f5ea29ebe4c63ff

    SHA256

    de46fb784548a4cd9fdaa0ca2f1bb94c2e70b895456b9c57d69f8a1fccc27bdf

    SHA512

    633f6c58cf3d7dba2dd0676021416c62586659cb41c0c0ad1f2ebe78719a04cf0d982322a8ac4cefbece18098d7e7eb4907064a0cc1de315e08e36eb92955042

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    d1f39b25200d99a85ec2bcb03c82e215

    SHA1

    7eaedadad7f6107382a1e8dcdd17db0586e1476a

    SHA256

    082d9191858d4d5e388315e4834f347f3323008634e3c2d50cccd45512ef23f7

    SHA512

    97d3edf6255d0922d35a17e6c019b1d74da69575188b078a2d8c0bd79f887e76d031e06f2b31217c827433bc8ca61117afe04cd4922398618648be79a726abbd

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    823cf849294ade907c6baa6160ce2bea

    SHA1

    f935480164bdc2846853abc35afe3e034b6bcde5

    SHA256

    086d77cff43b7660b201a04f3781b53162d95bf1448198c18f6763a83159c456

    SHA512

    f0b342df3fed4f226c0eaa46f816d9ed52382f2b410a8952de52e68dfc7a52de6c9081a36dcb4143feabd25f8632135cab9022763283fa3ab397c0eb2c882901

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    d108951992c5e40fdf4fa75510da47c7

    SHA1

    23ca45210e62e9e867cec0cb286a9484fed37c83

    SHA256

    dd970603b22ee17451efe37622c5dddfbde091eb427c14b19dcabc72d6a0ddba

    SHA512

    eef09a2fc20b7e17260d40ca8a3495a1200c2f480659d9a0fcba58b9e9d1b8807ba11f9ff04c4b30b3f29c988bdbef8990a345804de1dfc07caba86fac140a17

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    976607505a8fd89064939c76b203d1a6

    SHA1

    b931c7d9dbc8e5fdbb694f3ebf52aedc0b131748

    SHA256

    c64626acd4968bbb5b7e26842d6189e4c730e8a80cb5d9272a50c07abc519aa0

    SHA512

    a80d8643c4d85bbdf594d45552963febb37cd491509671c092b1e21de1ac787d7fc0a37184bb2b5ed12092cc319c5265e521229e014200f2c258b7a54c9e8117

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    abbb2b6d5f3bc980047f9d08b7c89ccd

    SHA1

    ed96eddee1442f8d917618c36928b30a3d4f21a2

    SHA256

    645add1dee6916ed9e1e15d293bf8b7193c466e7fd2fee6fb8ef55c255c555fd

    SHA512

    5203f5db5172ed3d0deead6ec564e5349fb3e983e84c7e576ad98872305350fb46fc74a22a154ff2427fdc100b03d3356164b5a346b02f49fa87b299c7ff3a3d

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    99000364f584405ce2c9f84b71a682f9

    SHA1

    dbffb004fa447eeba8436deaf5fa609c9781d29a

    SHA256

    1b7dde193ca7527552a9a5a435f694ca18864613262a3529d181f7c690679abd

    SHA512

    7f739a5bd70adc8d766a08e3f807284bceae6bd684b33fec1c104d86c1d86398bd41c5bdd911e00d16833e9c08c9d6bbfc0aaa6a7ffa2f273353c875898a800b

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    99317b48fabde3b0841147b8aa78e396

    SHA1

    2b43d1a4ec31c41fc14cec76045e9b130b0e9c2c

    SHA256

    2ac532562bec945d5fab6610a6b30855c34de18ac8ecf1b41ab4ab763d3d6f08

    SHA512

    b96ad921b9a7fba5ff0b7899c9628905bda8374d0cda53567278bfe531eaffcbacae7ffb9ea4d5aa5d2763992473d75a051697af721d4e3e857deff419741357

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    d17c02f1c7f5e5ff022d8cca77ce0654

    SHA1

    c69404b5d24eda6155399b85b81451a40825ed2d

    SHA256

    c4f2e77c373c9f2137e738d4055badbb7774d31fb5e07bfb582d8e4923d88765

    SHA512

    9507d3c45bd779a907089ee72484c6ff97000af2d4046e4bd917a79382deb8889372f4c6ca31833629fec4bb6fd24500bb60802347a059aa111d994118f09a27

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    ae10730c1a0eb6a1487e6d8717281a04

    SHA1

    0eda52e41153c363bdb0c3a086a3d68f89bda1f9

    SHA256

    786916e4f3b3435699b7ff3eaa44168f80f14485d097734b915c17fabe20a551

    SHA512

    1638c1fb51dc78619b6b592e810081892dcabbc4ed93bc7bc5a8c92ce6edabb2b5c969ba4b0b22abcee6e2aab7c4ee6fd68e0cb108d7e1f90dc29075037d9993

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    e1868021a5d8d3be59cb8571bf91b6a4

    SHA1

    c6ed7b9be4357cd285244c957c98ddb320d8fecc

    SHA256

    360fcc9447b362afc64e7c455a8ce54ff53cf99f9d638c39229a87fbf946025e

    SHA512

    648c47312d411f3644149680fb36a8198bd3df5b30294fc1b92a05b487b1380c4d6b9bcdb3e799545742ae4b7682ff1d088fe72940e8315f9552ea5d35376a2b

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    a29ec53574ca70a585398ac55d9e6d54

    SHA1

    21f3e1dc0b6a3b639a9a74090a305cf85ab79199

    SHA256

    d283d0138de26b6b65dfb5ff35f14c54c968d65a28745e9fd45fc5fa90de3308

    SHA512

    504155ad25c5e5d4d9e17f52551e2f11e37937d184eb3dfb3c4ad953d0d8303ce663f1d14e44df4af2e16fa188d0dd33389e74b5fc57efbd2b71e1e59b4c4f4b

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    2c7d0c4f0a457644f82a985b7106265a

    SHA1

    4f18fe79f07a7265f261253b64bd4e7100692f63

    SHA256

    c80fbb94a76a9c97aa987db5cc66f2ffcaefa76de9bbd78153ec2d7b6b1d133d

    SHA512

    3fe812c8bb8464360e4ce50f23d7a03e87a0142d2f2257d19d7199b865c18aecdcdb2969eb1462e206805225c0def656eaaec8ffa9eeb3b96ddcf6ddf86683de

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.fantom

    Filesize

    1KB

    MD5

    8e4a8df5253071fdf24e86b9818572df

    SHA1

    79f10e2cb2869109c0c565109f2ab9f0d34ab983

    SHA256

    4f8740ba07feb220fc7a2068a27e5873d8f28ba16f35948b2c019127a96d8e3c

    SHA512

    cf86d9207bbbcbc2f3ff136bf256676c877c7f832f30318bfe08b7bdad40b74f5e655aff9b1ca28a4d594a8a1121839633b355ca6e40e6e513aa3cffe1e24c80

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    0f8884cc2425681062dd6618b519a0b2

    SHA1

    b0a8dec5a219e2322798e04313e77c731cf2ab58

    SHA256

    3a5a4651a19bba2a7728df7b6332fcfa39a6f490b28841c4fe9070d7ba3a54ae

    SHA512

    b72c627c64b97966ca9e1368e29b0bd9c7cec5a6b1f6c816c26467fa3a14c0d9b1900cc8b92f38f9cde3f0c5a599e7a8f347dc716d7b9d239b9092651c285409

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    b84b20c83a47d04aeb758703df1eb392

    SHA1

    14c679f5afa1a890b082c29c92465cff785d9f78

    SHA256

    f95672a917040102946d0d2f22200534841a42a27662c1298b84aa4756cc6ea4

    SHA512

    dc1a4408395a5f37227c465cb85b8a7eddb680eaf2658c916ebfc1446591afa667f5c66bf680c728e27cc4e2d3f78b6eda99d9a916df8c92246bd05e62ffa515

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    292cc04583ce2f9807b14cd68fd4814c

    SHA1

    2d0fee19af02723fe1efe6e5f9545c63679e21ae

    SHA256

    36bb6daa7d8f892725bb5b70e089c7f4658b14d29dc980d4006db8bd9ecea193

    SHA512

    0f0fe0be92dcd5166414760a0508a5f5ea0fca23b15ce4f2702251bb0f2f12dbd86c92958182401d09dc92e53b21cf8e91b578b9c2c4e7cf8170dd4260456696

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    ecedbd39913218c300bb721e5246d789

    SHA1

    99976dab714310c9cfe2ff94289763b056d17e15

    SHA256

    b3ee351024e64d8d09b5db4f594c366eb689d9b33a53f27004aae46782a983bd

    SHA512

    8a9d2eb75064a23502ccccd76fd1a6c59b2912290ae3b13eb37f87659854ba2d0ae29a7746020b12447a4b8935d4f82841a1882b1905f5af8c3e69df2cc16cca

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    aa18ec91dc757f50a14115b45c359700

    SHA1

    a2ac78ec129bf4140be867e26f4a19e3d81a6837

    SHA256

    192666ceb6383b9733f57b458faaea3968554dd1889e0b5ca2ee34547f975143

    SHA512

    53b3bf4a00cc6eca0d383b83baa1463564cecca7b4e83c0930494524680925d9feb591ef04d970f9aa7dba1d5bdfecf4a8a1579b18f8949e30753c75172f117f

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    88acabd1b2849713f2072f40e7c160a7

    SHA1

    f3b3f8c159d77ee0c583decd74fc3f2e23ee4aec

    SHA256

    9910cbf90e5e63dca107b68ae666ab8b56e23caa52903e4c9bbb6ee499865c1a

    SHA512

    4a977a2835a8d6c2b39a52c10ee67ad39f690d3327e644e8250c9cc7ddefb4b1a2320cfb8aa022e459a5c0dc54b58a558f8e94240437a19b8501a2999c042499

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/4264-149-0x0000000000520000-0x000000000052C000-memory.dmp

    Filesize

    48KB

  • memory/4264-645-0x00007FFAA9320000-0x00007FFAA9DE1000-memory.dmp

    Filesize

    10.8MB

  • memory/4264-152-0x00007FFAA9320000-0x00007FFAA9DE1000-memory.dmp

    Filesize

    10.8MB

  • memory/4264-148-0x00007FFAA9323000-0x00007FFAA9325000-memory.dmp

    Filesize

    8KB

  • memory/4264-644-0x00007FFAA9323000-0x00007FFAA9325000-memory.dmp

    Filesize

    8KB

  • memory/4744-41-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-2-0x0000000002510000-0x0000000002542000-memory.dmp

    Filesize

    200KB

  • memory/4744-135-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/4744-134-0x000000007506E000-0x000000007506F000-memory.dmp

    Filesize

    4KB

  • memory/4744-4-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-5-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-13-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-19-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-29-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-11-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-15-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-17-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-21-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-23-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-25-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-27-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-43-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-33-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-35-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-39-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-0-0x000000007506E000-0x000000007506F000-memory.dmp

    Filesize

    4KB

  • memory/4744-133-0x0000000005330000-0x000000000533A000-memory.dmp

    Filesize

    40KB

  • memory/4744-47-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-136-0x0000000005430000-0x000000000543E000-memory.dmp

    Filesize

    56KB

  • memory/4744-32-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-50-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-51-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-53-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-55-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-58-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-132-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/4744-130-0x0000000004C70000-0x0000000005214000-memory.dmp

    Filesize

    5.6MB

  • memory/4744-131-0x0000000004B30000-0x0000000004BC2000-memory.dmp

    Filesize

    584KB

  • memory/4744-59-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-61-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-129-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/4744-63-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-66-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-67-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-89-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/4744-37-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-9-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-7-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-3-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/4744-45-0x0000000002510000-0x000000000253B000-memory.dmp

    Filesize

    172KB

  • memory/4744-1-0x00000000024B0000-0x00000000024E2000-memory.dmp

    Filesize

    200KB