Resubmissions

03-09-2024 14:02

240903-rb57sazdqf 10

03-09-2024 13:51

240903-q59avszclf 10

02-09-2024 19:51

240902-yk8gtsxbpd 10

02-09-2024 02:27

240902-cxh7tazflg 10

02-09-2024 02:26

240902-cwxc2sygll 10

21-06-2024 19:37

240621-yca7cszgnd 10

09-06-2024 17:07

240609-vm7rjadd73 10

13-05-2024 17:36

240513-v6qblafe3y 10

12-05-2024 17:17

240512-vty3zafh5s 10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-09-2024 14:02

General

  • Target

    Ransomware/criticalupdate01.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>g2P+SEW050eNeu1Z83Qs2Z2CsSZSlh7q78HC/+ZvA49N8pn5TY54GB778Zf1982wu0ki9+F8E+qHHL3hI5VGHXOAbF9fe5iQEehHp+a0YexUmepbAGQ4aNvq4hRqfgzUbeHwCKDh37yX9HpkDqmtv0VlwA3fm/eXx2WwMs8Jf+croZ95ZMoGybJAEmUwbwH62oiu5Up+et8GMe1lRb6d38U03M3Sy9aSA/6kIt5s+D4laYHmrEqMsuWEU1NWeyx+dHpL0ZjGOqgNUf0uzltvBUSTqt73POSEgOhrq3Rq6WKA83p235WRbkycrxdSLnC+k8GaEKLf3r24D0S/yGnnSg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1030) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:4216

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    8a18eeb4cb6ab6df47191fe5b5e21a1e

    SHA1

    3218a4b8b645b7d4d30b0e46df7101dae86cc338

    SHA256

    4209dc61b67bc42953ee0f8c7482d5355e9f05575968aabc65b82d4550b1c8d6

    SHA512

    1803c4c594148936bd739782deba0c5670176ff022398f8f6f5878b4b6ecae9baa4ca4efff4986090ff0846e6d24df0b0f34bda03eef3121fdd8cadcdcc366e6

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    191bfef1498f758061f2798be5bb898f

    SHA1

    cfd294bd9f506d1c9c7364228a99d01237746127

    SHA256

    519148e34919ae713257357c0371dc3799f0f3e6ffccb42296a8f00eb1a68ad8

    SHA512

    78dbdce3f76d47d4a6e55f01041ed3a77fc9773ffc4c2ce809acf23417fe736627d44a55020cd435c29c94a4208e00a4d5662836c456e75fb864086d14b2de69

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    ea93efe16523f802f59616315e829713

    SHA1

    8903192ba9c9bd0bd021e1caf2496c461f884ba4

    SHA256

    09d4e3b9a3a9138a9aba1dbdfda34fc8d388b9ed3230a15d54e44a9dbdbd29b7

    SHA512

    ad6238eb3c700b830ac192d1f2c5b3c88b4fb44cd3d13acbcd87ffcd98ca9d324d340d18647cc3bb11cd9dc81851e5c908c7209d8f3999db1b774b56527ef767

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    5f40f82bb7c048f55cd439aab5cf8d54

    SHA1

    076caea787219d6883719f87e5e5a46fd06aa84d

    SHA256

    e56b32a1d90a4663f08a339338581e36130748d3d0356c13ed1183fdc013c2eb

    SHA512

    8d3ca3506e60216c6a8c88124385db0146c2b2c58284666d4e6723271e6174cce86e608337d603aeef35cac03664be2a32836fec0d0fed41c09900bec0c93d0c

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    a8911f0cf9743ba3866315a7d565989e

    SHA1

    0faa820a47693242c044f81f221ff804c9e27b92

    SHA256

    824346f5a5a8721315f9dd19838996b829f4e2c30e7b58b88bebaa9d9202b47c

    SHA512

    9e1628eeb090a14f2de8ffcaaba4f41ca983a464c390637a46280797fe43eef8ba81a4755d21e5d9bdfe5eba4baeccad5fca55720b63203341d958b64d8d6fbd

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    606c292491a60747f05f48092b4008ef

    SHA1

    999234c3f2f6e08a804651c4c48c4bcdc105e3da

    SHA256

    6c835abb8a53ebcea5fe5b6463f7075c64bf785335c3cffbb5324da915b66cae

    SHA512

    03d614334b1b5329e7038f7ac5eac6fd1c5421f9fdae9b56d0352344e5c607fc02f4a9b1f6f8b7dd3b11847724c2b71d95c9e67702694f76d0fd191277178903

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    be6dbe75c33d7b805ddf422e6fd1899c

    SHA1

    0b1c58a23d63e1aaba6eb3617f35249f9233ca2c

    SHA256

    d85705d34faa1becf6f0624e7b133ce2812cf960381fa185afc9ba3b3874b34a

    SHA512

    4e407921f5e5631eb4ba3396f39b38d86ad30e34ea25214d1f184be7e9d23abe8f96048a768067ec4bc93d9698735c95baf5f5dbaca9333903eb48f28ccea70b

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    aa2d5057f1970d26ef67142b7436f693

    SHA1

    4f33ce716dd16316d4d1cfe6bb10534143a7e8d7

    SHA256

    437f6af8bb09138330fdc0a06a5ad5113a02f91387195c9f803d9d78e69d984b

    SHA512

    c0baf7579ee7091bd76edcca6dce018ceca5b249fe11073171a851798073b5794e9bc62457a49ea23b3a31550ded4129c5d0cd1b0b1bbc95bdee7d5ff498b29c

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    45452695e89ad1da819a78f0e16414ec

    SHA1

    a5c461d0c75a447d5ba5966dce74266deb3804a4

    SHA256

    65950a965eeea1970cce834ab05e56bd02554ba85a989342c78907ce2aef5c17

    SHA512

    a2d835613232100e48000ca02cdbb8ed296c621fb0a501c8a97ce0118cc8a60e73a49e4b3e56aaef67ccff70abb822b40b8b2943fcbd74aa30a711f15ce2a92c

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    656a76ba7b68187da4d95d0f655e173e

    SHA1

    1ac4c15427609b1b791261e57b9c1ada2b463190

    SHA256

    26f3d4b36a8cac307d232f2923a9ff2b353a994f8aec09c0fe011380aa2ca74a

    SHA512

    b05caf3263fdc5899d33a2172f5e77cf1b4b73e278b42773f224916f91c79efc3492e9dd18ae56c61d375b943585fb2d0a3c9bb253cb11bfd8d27134f352a38e

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    3853794fcc8024e30a21ceac7df98443

    SHA1

    898aa96ec2f507b3b6cc8db682d9a2500f9699df

    SHA256

    ad539c5f42bad197ac8c023fe9d3d5dbb62a3957fa92d53d96f1e6b35127e231

    SHA512

    d2040f709b7d753fc89656eacf95bd0405e5002b36b302c49d559ff5886ac26cd05784ec59cca91134a250d47800cbaa853e8975e86bdeb449d14af45c0630d7

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    966f7df3e8e3f21a2e0e0f746b19c3e0

    SHA1

    55ba646e0116ea8921ddd809689651873bed65c6

    SHA256

    39503f0a32dd1baee471462865574c19df67617fbee1aef6af13ecfd9b8b3294

    SHA512

    4dd0836d93561f2b3cb70b0904a3760669f045c695553f3f00627370c9088403eaddb738a7dd771d8acb860758329ca0c504eb6b260804c955d7287b5b5214d7

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    6dd413aa84cbd61c5e1a386b57389b1d

    SHA1

    443a048a33da9b0353d77db280f8a3bc16df0315

    SHA256

    69b5319218bc703501e7f78009ab1cdd12ca67e051223039902841052113702f

    SHA512

    03c284461efb8c6a03e1470ac2f07faff83b21f48d849888b28818892373922ab15d4bf75d1be90da5172ae27024d938f18cf7f89cdfe68994e3f53fc3727870

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    319e12fc97c865c584aa1c6f9a7d3a50

    SHA1

    3bb52090d1dd4ab0c2fc8dfeab6dca9fe306e5d5

    SHA256

    e9fa2759b698fbed92f81e0ff1c18ad67191144f3f6c5fe9d90e2ff0eb2bb545

    SHA512

    6c11125eead0a3958bfa094b69abd94797011fe0ac19f87320e1de7571a1de6fb099bf4e4a15da633d65f2ece78d15f5818ee42ac4110eb26b574c94c432f80c

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    f577db3234d58118b03f46535243b00c

    SHA1

    752a0802c954e7a6ac2ee51264922deed03eb845

    SHA256

    35243e8893b3173d92f0eef54303828317d1ad53a220640d03ad0ac92c194abe

    SHA512

    e9399873e1ac14460ca570842d4ad4939cb8675c1d62085efaef1f77a834b369b6333cd0f57dc5000426a5e6f5bf35bb01c40dfd3433cbf69314131031e3cf42

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    e4a461343c87f239136b92b77da5d968

    SHA1

    2dacb34767f3daced67bc33fa6a0e955f3e5ff70

    SHA256

    034d7c235d2e0decbc2b2982708439254f3e932e8a2034a598b43246c3aa5d80

    SHA512

    1a602ee262df68534a5be2ade86cfa393f8bb87b2e0cb356b2e1b43e8c7f5db66a4542034f190a49168d053008b65ac428e47d2257618609221017a2980aa243

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    bf7c471347fe0653dc9e68d659839fd3

    SHA1

    c81f2a002fe8888d7a76d19bccee9949ddfe2911

    SHA256

    2d2f9b2d97d12505ec0da769e2bea2b39061241b72295d3a0de4972727f59e87

    SHA512

    7f0b39e53d9a5ae14831f78999ec6a103764a9d6e2fc9314b596b0a602f8eabbab4c417d25b092edc8f7d372b36aa1fdc29ecee3c079d0845f589d80e38155f3

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    701fed30c0490ae6ba54e3673547a65c

    SHA1

    e1e836a3d9973cb1b6fdf2fe806d29ffcb2619f5

    SHA256

    8402dca3d228fbbb437ffba295177026b219d95ef70d2d5078e2a31aabc70d9a

    SHA512

    70692882f07f1bc96f928fab76d7bf49baacd591d36eebf6d79a1d46ea8108344ebe73f245fee6853982553256c239d8b457d004467b72a70c05ab542c6fc200

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    d29315f67b2fcd7e3954e73a974de0f7

    SHA1

    30a04fdd3acc5c0b2f917fefc28ca85bed90d518

    SHA256

    3f91b35c8ce7994c8e8bd3f68a42e18ef822581a3f6179c9ed23042b8743479a

    SHA512

    9a0f82b1216cb9ec7142f3192c42fd135baa2031f31c835775d54e19428898555c25457484965c74ef3b367da99bfa6df3da1067f329a5c5b412a4d868dd3177

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    e43d2f311325138da3cf7089a11a296e

    SHA1

    23dc63a34d4f098a3609af61d86ab4d8d6cb3c58

    SHA256

    c703827732a0f76bb3c62f91c7aeab1bab73c042745cdbcb8c7d84329139d42f

    SHA512

    89b185ccaf557cda738cd2e532d5063900ad585f37f428116af81777fdcb9ad48db5f2248be83b0df75206b207ecdeb2f527f06f2c97f33928852fd8fba92e1f

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    3bfd4dffef388f7c0b8b0afe9a35189e

    SHA1

    76205a9f1a1950724242d55697b92a45027265f2

    SHA256

    91a309d794c21eb102b2dd94d7b00f0a3ab5ae31f2b3abf7293ecb5a9c7ce950

    SHA512

    c56a01e61449357a6a54ece5f7d792237c5307e580966d002f4dc8f9f8ed0142eb2576906e978992856e8a6cd8827b70a4f8562113c61ccb59c35a7f2ab72198

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    0181969c63ce309d03e34e09afa80fa3

    SHA1

    2677811f235091abd5e98e2dc7958aa74e300bde

    SHA256

    59951ae85dfd38365da848caabd259b8d263c8edf6dd4a9a851b1a6f497fcef0

    SHA512

    4c15dafc7c617bd019ab2992c401b064a0e508e1fe0ead3bf750057bea364976cc8b80a0edd4db6a4136755a66d901381a97630d95c597b16d47d1207a4f49f2

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    4702f870e7b4e3138c8aa239c38b3539

    SHA1

    2d696e8dbd6a4fb14fa131cccdf05b5c977a2e40

    SHA256

    149eeb5762c3960cfa336d71616099e5b62c5fce93175d4e16d22511c4877556

    SHA512

    a918b88b4b178810b3f663e1cd4ebc8b32bc68948bf8a06e857e8d07f7b5ef1e7e9a1509709515d3de2df489397e7b7df40f606cdb6869632caff1aabbae0c61

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    6aa73e0526e88a62465a55ce447bd1f5

    SHA1

    f203d91661c12670e5ac6b7774552db86741134f

    SHA256

    54a01db9d0f97c03d86b482643dc17e74b8e0cb46a591825f21ab987c0bc447d

    SHA512

    ba6b3ee2fc06cd0599b0b852bb7494b6072ce2d3c60895d2e99e8e6c12c39552d4e6f920a42f072ecc78fdf4ed5b6dfc8a9b2f9078b569248db374071ecc7980

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    d16f9ad98ea22bcd6536c6435dec4e12

    SHA1

    72486b778d1da35f6dc8077ba4b9c4b253ed7ec3

    SHA256

    44a82c25bbde0c370cca03694508dd1b4063b1384c1e25006a193ab8681ec25a

    SHA512

    b45e3ab11c398edec9aafa36bd839ceb0fd1a3deec85295fbe2ba8910b45c0d902d094f4f8e381d664696a61231232aa28bd45338b7ab363ee848a820080c51c

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    e22affef06647a24b2ff9e2528ecd7bb

    SHA1

    67ebe795eaf7bc1094899f754176191a9148ba85

    SHA256

    f9bfa3bd73fda1375507fb265c31b1b0161e14985d4872905346de6062bd22bc

    SHA512

    347fabf938f5d798871ddd222a40c5b1cb73ce36b48e8dccd7262f7962928f78cedb8de620a2ffe50dd5e2d66b18d640e68e993dedeb73bcb627753c7f45dc30

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    e421561f317f472a909e5a42dc964716

    SHA1

    a4c0655709587ca455b2734e336559c1781648d3

    SHA256

    1adc0f077fcb23424495bc8ed3f878fe8e5f3c6500094cf110b32aeda22eed98

    SHA512

    bf94defd4864cd8589a4a97571e6f9ab49c764e6d9e3ab54ee90a9a3884d27bfc5c301dacfa50b98e6455298b6e736eaaeeef822adf0ac11cab1441d8e28545f

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    8f620bafb5e985ff67f3b0e2f361a41d

    SHA1

    74ffa8b7d5a47f6953d4e45aa533ee67db0f5b57

    SHA256

    097a7a625263fb82d607604a42c17d546d2a522477c58c0b2072db0893bb2c43

    SHA512

    f9c4bd835e440be6a040e6c251d91a65b2f918448942fd205c3867d69a3755fc44e2b6d8b8d3c5ed875051a998e28cec5a2787bfc5ac7156738685f082a23575

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    43350cfe946720983e532a9a48a6cced

    SHA1

    45f96f389f5e713aa8c6702d0d0132242facd133

    SHA256

    a3923db6912918a96f434d4af3e81cd92495d6499f7ae41f296c1cdadb14165c

    SHA512

    8ed695d265ec5d8ebcf5cfddaa3976554d95cc5936908cc10d42b9c99efb08e8cbc93ea7386d8b9017b4d3ebe6c9678324486ecfba4955aa5aaf9b69777d7a29

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    5919fbad5a2fbd6daa12c9e152eb6097

    SHA1

    5dc1b1d1ed5458cbe0e03726e580b50f93618eac

    SHA256

    fe25e89682ed04be5a3653a0fa710d8fdc00acf787a89784e3bf9021577b9358

    SHA512

    016d98f688788a5d70b7c67c4fc6f61d1f7f85f46780954d14a1399208033df9ef8dba45a5d88d92073e54dbfcfb0f09633bbe03e8ba88de251f9fd68ff3fedd

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    d317ddb2ebe0d1d02b2eceaab9bdfa02

    SHA1

    834cd488afc44c24f32a80aaad8c08e8ebd682f4

    SHA256

    000f7fae665e15994077345641b4839909744f244bf12f13cdac85062406d57e

    SHA512

    95c85e0050ae32e3731dd9781ba65a1126ff17beb372cd6e02771d1a1b28885837d7b9beb0d0ffe6cc4f9e05315ce0b74dad95b0b5857695f18d2aac2246bff5

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    60164f042791bb971c3e3d6fbfc4e41d

    SHA1

    8d7dd4274cd4fed2c67df9791d7cafebb4ba494b

    SHA256

    6b86cea8f98f64aea923903ac2106dd88969472bece56b0707d3025b80fc56d5

    SHA512

    5a2159232d75540a56b574016e8f4dd9a0856d028f8d4e0db783d6f491a036f9a74a786af0524e294a349ae7587aa1e41bf0b4a2a170d85cca28c6d4e42c12fa

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    9663542d74687cc86bd68dde0a9ac2b1

    SHA1

    d956e5f066595917791cc9f499eb9a0f14744944

    SHA256

    c2ba25f50ae8866a835e5fe7171220be126207b5ff88d57c29916f84cd8ffa69

    SHA512

    a00ae02636d821169b0e11ec3116678dadabcb285d3425e2e9660eb5729efe5ebac99c830e17b5e4c92fdbd74adeede1de7a06c76a2ff226dc027e5baf865e5b

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    bf5ace92788b32a4a4652698f764611d

    SHA1

    4d3d12e581117406a92d793a89e216e0ddc6fcb4

    SHA256

    6bf887436b91cd0964a296a8c3c67adb071782483d2e72bebc637785c3a76c31

    SHA512

    80d2c5e8f5d94bc4ae79484f747b0888c478cb67c84a1d700f8aaefa48962afe9550cb0be4dc2c7b72344b7808e07e71b6a5f87ea251b200669c0c7c0f1edaf2

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    cc52f7f7395d9aa9019f65b2a11f3f75

    SHA1

    cb3fb6ded5d2c6879b8c9aec0d5b813aa6e4dc8a

    SHA256

    c936bd8c0eff8b11dc50681d0cc012ae7ed9e8078b7d9dfba172f74844ca9d34

    SHA512

    d62d1a3b267ce026b1ddc1d92b302c230136df9fe78d65f41c9aba38240fdff3856859ce1bab5ec2f4d42bb57400bf331c1a42f8eccd482fa94a7078ee65a52c

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    f1a470ce9e649cd8711629a3b2628b07

    SHA1

    1517b5543bd96eb132f12c08e621e24a5c01baec

    SHA256

    6a3f6301a6d60c2f15c98934a0d9b1e6df61a06f55e5d82ceb7111e9d87b2bc1

    SHA512

    d9bc3a7d87d06f8b5a39b13f876a442a2c71c70b5690bc792239a15feb85b46ff35ec56d2725a4fb4bf3b4da250dc74615b1c0e5fc075cefe7bf5f6d121001db

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    f66b5adca3280b848f31a6cf767a6513

    SHA1

    78e5378c8ad93bbcf95074519baea0237564aaf6

    SHA256

    36f99ccd5adb975efc07d0588d8bea8cd347c9aaf2dd9f7870195e0ff30276a2

    SHA512

    ba98e5de7f729584eb549f568e3e2f2c997388a0b814db42263a0430736846f29ee19c5790ddf4fe052e29d5cc6c92cbaabd5403d956e196a303081563f51a0c

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    3cd59ea7651bc739a060c5aeec67c65a

    SHA1

    285a14bd038172d69e9e6392d69af16bd8ee37ec

    SHA256

    f1c3e4106b3d6b9db30a24a52041ed9f717828d6bf1bab25863d5286fc8ebc6f

    SHA512

    d781094d245d045000aaee0aaa5622a2c0bda9eeb40dfc7a625498c5c6f95f347791a28ee099dd1402110702af3bd112eaec6d1f295cc9ef037d955410319655

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    904ce9500a375ad467e4c0cd37a54168

    SHA1

    f2608c41eb3a35b395e8649f701e6b75cb71059f

    SHA256

    b14de74866574f444e4d25308b3f60e48c92fe29bb9d879c83363f967dd8f4c1

    SHA512

    ef075b428f5d27202fa5a6cff4da8badb1e893efa6276450bd5144fd6c92853d0da20889cde2a200c466ef8d6e40c09465b3b015ebce1ba52c8aca2c47eba155

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    24eecac0a2cea730aaf1e7c7941fc913

    SHA1

    e5aa0a4f70b051dcbeeef132b52dd534fde540bb

    SHA256

    678c5d3d4dbf0fc762e5847235b2d3fc16ce883f7efcf6e494e0b4229e03e97f

    SHA512

    942f2ee4cb0f7d3b6a12c8741b7f58f59598b3124927da838e8ae2e4995583cba52bf4f3a131a25988e770cfaef8d39712f5b469a8b3571741714ab465de07c2

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    618a02157041f1ab2b43017604579d31

    SHA1

    df123b772bd8bebc00c5962a90b6e3f51db60055

    SHA256

    8b3ca0b90c81ab819dd6a0bdf376ca7bd5c4f2d93bc3728688a78d36647900f5

    SHA512

    5fca00e01b52d9ba88e54a37a670b5b883ea947c127618a67e13e53178aa0cbb4a76b7d2e5ba9a3de55ed4784a94dd7a51721a3630324bd6f4cd3bb7d9d2f7cd

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    21ebd38de90153cc76bda4094a45024c

    SHA1

    1bb2b545b39213ad4819c50449f059b6375023fc

    SHA256

    61ce49e2a1a63780e1dee65231d05b2c185434fe0b28d198cdfc54609f63d422

    SHA512

    8b5f0ae8deb8fe1d5fd8a79535621ff75695a5e2f8c24c4f9d0ca54bcd8bc3aebd272cbbba17f75973be1767d1cc333c41fe224f5ff63f2f753fe5ac728a7f08

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    fc7ec30db8ed30f61e3a78fc9fdeb15f

    SHA1

    b38e2492a3aba7dc5ded9d4cc14937a11eb81bad

    SHA256

    47eabda8ffa8f8fc4db16414a4b9ae1e9cc9a67eeb6d496715f8d5ee8c009643

    SHA512

    d1f747a0d1bacce502db3c960810ca4b50e91351d4e7b1d4e59272e234e7d0c942ff3737b93b7ae2016e8a68ed386717899a14d64d185c094effbb2d6a871965

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    37a692868bae955f47e3a49e71d0fb4e

    SHA1

    9937077d6ff0d80da2f53bf68b64011f3b8d179a

    SHA256

    f515e5082e26bd275c1be999ed86ec94de66b1e5a1c68cd6873970ca02066cb9

    SHA512

    4b846d6bb78ab08418321a8677dfa74cd0a2ab39c46a896366fdde4ae6b15753be07dcbd278c8cfdcfbb3682d4b06ff07e7b7fec93e8f410667264e1edadb8e0

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    a365d0a4369d25128f7e951710a53b21

    SHA1

    4eb707deb7073083d2183af9156d8f908d7d5ad2

    SHA256

    a7ce43da2d85326af86688c0b160f2be8188372cc59ca5c02936c5c2a22c214b

    SHA512

    bb66e942b9d1723a0697fa56d7a5dae0ae6c1d66568dc2ff810dfef7b75be23a80101d1d99ce96cf361ea96bf01079793c97e55ca6aa8b3b4151d8aab7ad1783

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    f00bfe6613d8d8d6eb504b50894dc57b

    SHA1

    f015a2b9a0af60039417895b0daf2c1a09bb1d59

    SHA256

    55ba205e5aca6982621f42e5e7d310861ea8dd26278af52227b529de2deca577

    SHA512

    56733569b26393fecc5d28a0debf98b9ed62a73e61113fb50e412f87ea8258c9061f9b9d8508fc0e4d7b0e89954d0820159fa28d49c560fc334c830b36934699

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/2024-42-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-35-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-1-0x0000000002480000-0x00000000024B2000-memory.dmp

    Filesize

    200KB

  • memory/2024-2-0x00000000024D0000-0x0000000002502000-memory.dmp

    Filesize

    200KB

  • memory/2024-137-0x0000000006060000-0x000000000606E000-memory.dmp

    Filesize

    56KB

  • memory/2024-3-0x0000000075300000-0x0000000075AB0000-memory.dmp

    Filesize

    7.7MB

  • memory/2024-45-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-136-0x0000000075300000-0x0000000075AB0000-memory.dmp

    Filesize

    7.7MB

  • memory/2024-135-0x000000007530E000-0x000000007530F000-memory.dmp

    Filesize

    4KB

  • memory/2024-21-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-4-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-5-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-7-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-9-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-11-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-13-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-15-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-18-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-19-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-23-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-25-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-27-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-29-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-31-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-33-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-59-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-37-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-39-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-0-0x000000007530E000-0x000000007530F000-memory.dmp

    Filesize

    4KB

  • memory/2024-43-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-47-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-49-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-51-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-53-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-55-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-57-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-61-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-63-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-134-0x0000000005230000-0x000000000523A000-memory.dmp

    Filesize

    40KB

  • memory/2024-128-0x0000000004C30000-0x00000000051D4000-memory.dmp

    Filesize

    5.6MB

  • memory/2024-129-0x0000000075300000-0x0000000075AB0000-memory.dmp

    Filesize

    7.7MB

  • memory/2024-133-0x0000000075300000-0x0000000075AB0000-memory.dmp

    Filesize

    7.7MB

  • memory/2024-130-0x00000000025D0000-0x0000000002662000-memory.dmp

    Filesize

    584KB

  • memory/2024-132-0x0000000075300000-0x0000000075AB0000-memory.dmp

    Filesize

    7.7MB

  • memory/2024-131-0x0000000075300000-0x0000000075AB0000-memory.dmp

    Filesize

    7.7MB

  • memory/2024-65-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/2024-67-0x00000000024D0000-0x00000000024FB000-memory.dmp

    Filesize

    172KB

  • memory/4216-150-0x00000000005D0000-0x00000000005DC000-memory.dmp

    Filesize

    48KB

  • memory/4216-642-0x00007FF9F9360000-0x00007FF9F9E21000-memory.dmp

    Filesize

    10.8MB

  • memory/4216-641-0x00007FF9F9363000-0x00007FF9F9365000-memory.dmp

    Filesize

    8KB

  • memory/4216-155-0x00007FF9F9360000-0x00007FF9F9E21000-memory.dmp

    Filesize

    10.8MB

  • memory/4216-149-0x00007FF9F9363000-0x00007FF9F9365000-memory.dmp

    Filesize

    8KB