Resubmissions

12-09-2024 02:23

240912-cvfznswere 10

04-09-2024 00:09

240904-afvheascla 10

03-09-2024 18:57

240903-xl8csavfrb 10

03-09-2024 18:12

240903-ws828asgnm 10

Analysis

  • max time kernel
    150s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-09-2024 18:12

General

  • Target

    Ransomware/criticalupdate01.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>oXALHwIqTHD5K0z5ImAcQ9VsX6Qau3WSf1hqsWow7GTxw2dG585iKLQKCaCLMkQJNX0u0CgyyDKFsq1jDdoc+v8ujw7XHZYm6Mr2rTEwhDUUFryA7PzFh2T5g0QLZvAwXrMvC2++rxhO1+GTlIp/BzWFLKwqqQeFrS1oc8z6QBGsm7kpWrsa/taGh5/hLa6TFsRhYTVvuMKOsMMTi5FaupThl5XVOa0/1144DNaQ4NJce4OyVx0kHrFoTDLNUwoV7MGByL79El7N2FciPirtBJnyNX/UxAKW2hfxAC51qsSO+boniR3cJyvXcNdZsexb6yim8M5DPUrh+pIQ7jtISw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1049) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3232

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak

    Filesize

    16B

    MD5

    b34736814b9d3a18807b582855db372e

    SHA1

    2a72803a7d2d1a67dc10a12ccf62991c3e2c8b27

    SHA256

    5bd5cb7f235a0c636f17edb1a6849b67fc9ecf21f8b156871104136f0fb7d576

    SHA512

    2a38c44a54ae12fcf37ee1f0586b1b8b2c727f0cd32907422d62ec2512384b955d7654fcf91b18b206a3395b55efddc9926d1956f64bf26a03ad030e7365351e

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    d96f62dd6729ea84d7cb645028d8ce47

    SHA1

    453bb767345664e6fee549026fb6b4ff27377c5b

    SHA256

    f848eb0a0c1f8ad37f284f187c4c4767408839af19734307349ecdc78efab68c

    SHA512

    683db71969d1ba561f38889c54779de36257e8b1d3e5664ea8f203a1026c994f5181a849ad032153185080b312a705de5fb4b7113e274f2f618dddb13fd4c9ff

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    e96f534b32edbe8b545bd6a995702bcd

    SHA1

    fc9c8d6ef5b959ff22eba68d0ae274d4ae05b18b

    SHA256

    45cdf1f0c250faddc93a0f38fa392c09a56c72bea843894fe89c223fb55360ac

    SHA512

    12b72ee10ddd075663e8e154ee20683248b1fe4b998b132a2480c0e4a3d83bbea74f444f5c87ee1c92a21642774eedeceaef1499625d9f31713d1e8825cdf2df

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    908b27d9a24fab5b5c97880e56bec918

    SHA1

    5ec8edbbd6c53063adc73bc5ca422f5bbaa611a0

    SHA256

    9d1894340e3f00a360d198e0a9e8f5c11a9628ca20464e7cb81e2e5c0084322a

    SHA512

    778fb2dede5b97786a8d0d0ccd21ffb6f5e2ede72be377129f4210114605cd7d2814a398578247272610f73b1c615726eee7ea598e965d7e3258c0645681020c

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    f26c3bfc469618753d1258ea84cef926

    SHA1

    e0613a74ab5074487a2481c7fa6877c1c7571fdb

    SHA256

    ee5f914e8bbbcc7bc41c4ba66a47b1ab23f0f99649d8e1e1ffa5478722750dcb

    SHA512

    5d42e11786cc84ec17889bed689c62ff03363e618ea7d6b05136b94ae30bf2ad7951e0ade87820c04d4690168fd040c3263ac0742975ec273d90fb2e2f0b6dfa

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    410ad5764b48a633b5c798ce87fe55df

    SHA1

    2cb278a3e2c3b3e540a3ff4294478eba488e23ff

    SHA256

    bd4e88b4aa1e92ea3ef194ae11cf3b12a0ddcda266a2f1a1a6f15c747573a7ea

    SHA512

    3c22b2a8fa72a2b79a9aca5393c2f1cba38a1c2f206160258c5a11892de99a33af8c1baa877089387c3111183c0ba84bd79601d78e2884810fe4e96e23095131

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    c9e70a164838ac0fd2949644462cd73c

    SHA1

    e4246da4da826a4ffab496c25b92dd2a7db6beeb

    SHA256

    14eb0060fd9a27e14a1cfae533996238c722034c4d5e8808401a638bbfd7c296

    SHA512

    a0a74578616423b295ac4475a358ebe6b5fbd1987f9fedad67580d6bdaaaedaf1ac3e24d8b647f4d42d43c825c449678b802e7f4e8e224d67f0714f0181e5af2

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    50775c14729eea8c3b426b05cde5b3ec

    SHA1

    d16ee6df9648498529770fc059697046b015f30e

    SHA256

    11252a6da97df2952733ccfd971ea3e94b0b7c89f3ddf6c8059c8893ace7ba65

    SHA512

    06603b9d22b674195173c2573c7c27a7a29bf3caa3ae93e109082e22e4087f5e3a6eb9653f4ce4c5c79f11a7c204b0ea8bc330ed749f8e59b6f7fe2ac6f2c0c3

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    b799e4fcd9dbd715435b779a2b8a921d

    SHA1

    d27204ec3870dc33fbdb2b92e205a46a7e20c16b

    SHA256

    3ea17c7320cd1bc10de4909f982804cb58ff0f5fa59105f574f9b5a6fe51652c

    SHA512

    349c3bdcab631d2375c7ecbc99636826b639f09189591904dbf0c09667a84e66751cbff9b2c823599b316e69bb0d8f71efcf526f8e624bc9f8a409dc3afffbcd

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    d26bf5697d015c71c96af8503380b73a

    SHA1

    04c454cd1373dbea6c9cba0785d7556c4b9a15a5

    SHA256

    f9182b75a0b61daee798c0a09711c1f69ec6ccf4bba0e33704fc08b3f872e136

    SHA512

    7723bdaf1eea9849eff4886773e77aceaae3e62f6968dc314b35ffec8179ec2fca99a0310ea0d74f5bd8c5573a4bf213fb174743eb5a7fb3fad891c04d394282

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    5ca25fd035c43a353ed402f986f8492f

    SHA1

    1a1bc6c82076f531c861f1b0cd17a03c5a7b5f3a

    SHA256

    85e899f3c93f72ebb3cffb802ef8dcc07613b0c50c357580152e612d05245c6d

    SHA512

    8af423796d358e8891477c2ae561c5c6d3e32db54351ffdb90388e312f3f0d8d30813425480f264e35e0f7b580c4c5c8d2dbd6055a65b9b726de9e1dc292efcc

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    6c31958f97603e99d5fc1fa04af5885d

    SHA1

    e7432f44da649929d7bdaa383b2580d67725e44e

    SHA256

    6f88fce56a46bd6f9b024d3a52d0296524f73d8ec556154e2943122cad3c7b73

    SHA512

    e1b3270f0055e31e2b3ba7311cb11f0aaaa81d4d34f39a0a04b215dc6c0efe729521ae76ec3e4fbc31969123243a6dfdef5a34d760fb117b64804e366cf17aea

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    f15b6136e8aabbf3ba3a66e71207eb36

    SHA1

    b6f7d23e3c7eb0ca7a121b83c031e32159636fd6

    SHA256

    8ae0c8781b51fc2b66765b3a73598c2aea82489f4af50596bef0f1cd83556a46

    SHA512

    aabd1749c0c593ec617589dfa1fa63306d20049f84345cdadee970747657fb743bb1ab01a81eac7e55dc83b60773776522c09c86b166f139d88297917104a085

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    c3604f1ba922dca9bfb80298e912e52d

    SHA1

    6af55de49a9c0b600cfa86970e1b49521af71f6f

    SHA256

    71dfd58b3ad1b8ba17910e917be01b4d4a9478c839c1c88ede83f595191c7a53

    SHA512

    6eceb8ecdbae2ce704eec3d2ce9677d7c66570e507cfc8f69ceb1ef903d9e04945139e7f27fdaab1701a00f12189761b7cd2f700cfaf356a8d3bc386ea57dd83

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    a606a7b0926203d6118150f6a6141df1

    SHA1

    bf0a44ac561c673777c29e14385e888e920c01c1

    SHA256

    99f41a88aabd99243d528da4384da21171898ee653229f961f85e8d98753a8d9

    SHA512

    2575cf1db0b1794b90c6743223bdd67c26f1bc64d745b6711fd26b24653aeefb7f44a87d475f5158e954500acdffff2eada78824e26849f5d597f8c0921d1571

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    b3c615d2bd898fdbad435a677133e45f

    SHA1

    460262c871d3737cdc7859c93e20c47bea98197a

    SHA256

    5c1d603a75fae67ac4d0ca836a68600b64839d9c6e651bf338da7433807a72fc

    SHA512

    2a9720c2d4038f44239c9049212fb28bce4aa89ed1522548962abc2bb1be631e430519d736fae63c7faf9ad5d0f58ad1414e55a5104d543f318fd48ec8ee3e8e

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    961bc5896276b969590f39b79e61e534

    SHA1

    ba0b159ce647b4d6bae45d4b4c511aec54b67fae

    SHA256

    568d259460fe28382ab5b2dda467e7f90f00d1e9e017195927bfaa6d72d1db57

    SHA512

    6f07577b87e8a853082e95c2ae179a3812d95c633473c9015229445dbfd1ca1f2319e47d86fba9451bb76f2dbc5dcd32a2e16971bb86b56721c1cf8301f017ca

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    16e5532479a0168bc098d99f9af353e5

    SHA1

    b52ff5705d1a0415c4872d6252b11447fed5258f

    SHA256

    6083a77d0988ba26127bf6fb898d6bfd8d0e23f4769168fed029a9213c3efa35

    SHA512

    cf92a90640aef193b8fa60af65f6803348ebd4560d6bd4c72214336e0d3ea919b9284afa82f206a0ced2675a428b9888e0dd5219f3ed403e1492629013890c7d

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    d5a1b33db3842e16532785fd76bca91f

    SHA1

    f4a359fbb0cd2c9c6c5bdd8ab42ee7c7c29bc273

    SHA256

    ac41ff7ab01217a32cf135da5fe3f4f21fb8e6eaf49886274c4350b2cf7fedb6

    SHA512

    a538a889a98d8561577d20a833718b471ed219a6996a0ceeb80b455bc81a9df25f334f96909079d83e8bb58f89dd99921a58780dadca1d74e2f64bc5fd70af9c

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    dbdfc32e7c4023ac40454dbcf0c88d5c

    SHA1

    c229f978ea7088f8ad4c84e22cdbc7ea5931e5fe

    SHA256

    386fb321a3d7c82687f24742d251d46ea0104db118931450e06086b73b58312e

    SHA512

    b746b8c44e752b19935385c5f02d600b4429fb842117ab88259ef7a30220f566c94156769dded4ef915514232167a15b1c6841f4ba9a86c454d9fd1e6164835a

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    e575b46de91db0a0f987e899f9023739

    SHA1

    602382ccf3e79379575310c32f77a8bf28bef98b

    SHA256

    b89b30d8a780728f505a518248406791cfa348a7c1e81d7a7a74de553973fab0

    SHA512

    fec7d0366f328e0d91258338a1e561acc0ff0cf843450a04e2dbf001cb4376b5f2112a95b98dde18c56d806f2dc5a4592205c5ba0de0cdb67bd81cd07e289ab1

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    52c4a294ebad70920d78d47eb28f86ce

    SHA1

    a7f0922cc82f37615869ad8ad8e3f30444183c84

    SHA256

    ebc0bea97a1c849c82d77365238945f14a25d04ffeca30061603e7b92195bd15

    SHA512

    c195581ef06aa0c935143d52713f064311148bbe10f0819d663664111129f08575ff81125bb8b81a0eb9838c478faf0e3e1e4e9fbc7d9e340e50896215c579cc

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    a41922d4e057f2343997e2470713ab23

    SHA1

    0b1c96a6c77aa836af23da931ab7f3004fda5be5

    SHA256

    fef7d6d7a8fa86855896d5665566725a3670b2dbbcc050ba401db8e392aec9fb

    SHA512

    214d629194c16575ddad1a0907405e78b5efabccef8e0b5c29769db3b8d703663b206a0b6c07d900b3ecbe0e73a95d7950d3811f7f3ca65726bcb24248a99080

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    a0747d80f49253c46b184d89e2561bfc

    SHA1

    7b7fc739d00f5d13dcfecbb6352d0918473394b1

    SHA256

    83e0b5de553c8a10601028a251f23796d1da5fd127c6ee14d59a853533790447

    SHA512

    93691a74fa55169233900ce62b120a89c4d1b936027f7ed93503604b9d4961aabc2866405a8a9f3ff23ac95d1bae45f872eee37ae97154e819ea3a79a76be856

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    b4f2e34f40fbb6ff25c4eeea343e9bbb

    SHA1

    f252b28913a3c2c22ae9df7455859005c0c42d4f

    SHA256

    cc039f48893ed1ca4d239ac62239a0aff1e8fd368df38146b5a4646e1606ec50

    SHA512

    280f18a59f65f65fa5fc5fb2581762d6a046c6d955928b5543dc606be5eaf582e340ad988de07d885d84d04add28ee6d445dd8343b8b866feac43612e0e9565a

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    d52e9896d83a7fbe4189658a91f68722

    SHA1

    cb91535544461d944441c8ed6fcca896275b6a1b

    SHA256

    fd61481e154b4a6439cd1933fe0ee601a51cde4c2a23b8304db02d416cb5f3ad

    SHA512

    b0f21f9db36948525032438685704a3d1775a3c42a5d207d8a4d7d70bdfd87d0c8e3d70dd4b79ae05739cb0d62b23df8a0bd64a127b27c00d5a5a24d26359a7f

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    61e2f616efcb7d38b506de855af1b896

    SHA1

    f2e266b4c1974096e1eabc496d616e4e7858a618

    SHA256

    6b13f46a5e1b35b30edf4691f676d69cfeacfab4ac3459ea5bb475bb1ce7bfba

    SHA512

    a1c43d190c43f934e748e5f6e61c0f6033dcf9114c6e73e08f737911b4b046d5ae1e125f9216106fd20d7f4fe0979051e5ec8748b4995e937e78c528811a6d53

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    a6598252f03554caeef807def9f94890

    SHA1

    8b3160291367984f5053c0d77f6f6363b5ae7145

    SHA256

    ab3c981cc99dbc11125062e2fc4bf2fa1f9d2fe72065a2bc111e010e0bf0332c

    SHA512

    7f12904aaf284aa4f28a4071aa9bce78cf71e3f8147527a1cd62099db7c41aa15f770695e849d42fc99f26625296fdb213a337b88a5820eec4ea3c984516cdec

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    49a5473ea9280faf0dece8876646f3ab

    SHA1

    d4af74188a7525f74838a3b8978b4aed8046dd17

    SHA256

    15bb8746e7b60168860565bc5a27b3800dd82b60033205d8e8c715afbe1404fb

    SHA512

    5664147be034d0a3ef1e7431cd55ecfeb3ac154555b40bb23889892e279cc6115305ef47e64094dc71409290db5f076e5c3ef296ff6cf0cdf1806c400a6c9cd2

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    b560cbb692fd90f9cd828130669c60ce

    SHA1

    8f7bd4d56c92830b14ed8c57ac6cdb70c29792a5

    SHA256

    3d78ef88c55985f4bbb313ebe044d90b9490433cc25f6a3342b9c5568c479d04

    SHA512

    1052baec78316915c551eb11189e523459a378c3ddfb66862fdf1cfabe5f11a9bfb6671b366b6d19696c8ee457aa244a2aa8f4f739c2bc710e1404b2c2d90cdb

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    18952bb13503223880ebfdc7c41d1aed

    SHA1

    608deacb93537e80f7c06a0c48c991ac1cf710c1

    SHA256

    5ea954e267140cc62155fed8be28d4025c90d82bc2c3060aeeb44cec8136427e

    SHA512

    7ba67d738dff12da7128f6b0718eeee4e08f0c549c71e93a1c58a8f53e3572cfa09c0d43b8afe9ebb7f660bf21fcff635e63314bd2a00ede620eeb3c22b3d3c5

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    c80b8bc62580fc0440f13f8e936d06cd

    SHA1

    9f9d31867ba70cd5290f84b710df9b9acceba199

    SHA256

    50467f10b2543a31e72c0f7d6e53ec00676f86f814118cec6a4fda9e5853c364

    SHA512

    0ff3889ffffda1b052fd31b5f726a917157fc534fbd454f986ae6a5667ee79973ba5667dd6659b60662e054bd68c34beab465b4dc50c13f4464753517d4b6b74

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    7aeb9cd1124d84b169574d1010b1659d

    SHA1

    aac764fe5936451cf9b16d5c07f07b20677c8434

    SHA256

    1e0c71c998617c5320844894831e74f65e2811505aaf65f0b173b9b44442eac1

    SHA512

    56cc609734f551ae4f847bc5997588b71f493fe272ad4926863c53a1ed2f531ea9dffaf490509e0fd527681be3f651a2a3677b59b8a20d98723fef69111b8f83

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    cb90a5c6d56b608792136dd74c933eeb

    SHA1

    0fbdf586d84fcbc4966f5a3c05f0178ab4a801d6

    SHA256

    0ec9d56653fbf0b25c863a16fde2196bb4b8a73ee59c5c852c5607ee37b9f490

    SHA512

    c110748b8a3adeba0e3f521cedfab6d7db58121694671283cf1284221977298bba1f9c118189a3c8d3e99beaf24e5df4ca43e391753df57f246db190ff08b0f1

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    587bc2c6aef0964be639d54e7e6c0967

    SHA1

    3b7694b99527ba7b27bbffcd9c3822ff0e50ac81

    SHA256

    bf919f1622328cd864b1f04ef3772449e821f09c67658e5adaae18499eb35db8

    SHA512

    a4bdb5fbc398e2c337c1e6a861a036f178b744de6dafba75be20233460a1d495b7b94b70357c3f69f00a3ef50df72e1eb50d62f3a465f7ed8d55319a1a84c99d

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    a2f48e33f83f77db4be311932ad5b619

    SHA1

    93b354261c7e291217b5fefb80a3a361a4e942ae

    SHA256

    1b186d98f4fcbafdbd6dac7dc6098f6064ee698dacd676facd8d896a3749e6d8

    SHA512

    0b6cd796cbe0b9c94e03ec3fac9b383e2a4a607ac051521a042a1985dce6c0e067ef991d621b30e896f72a724044a11a36e615c4b3e29a38cf9d29be2ef6a670

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    5d81a2eb5d610801295f39fd9069fb9c

    SHA1

    e8cf32826cd3122e42086bf9ab7409ae60e67fc6

    SHA256

    87f57fd07a3941eaa7719aab4532a0d0dd4896ca29aa6adc2884f75cb0bad68c

    SHA512

    cfc845d79baec49136dbdfa534d2aec1980864a7d1b1d6f39ceb668c3be2995e9582b4abe172c29c27647e5549e4c06368eed28c440fbab62021f598bfe1ef94

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    cfec632cf0a784f6ee3f7ca97a327e9d

    SHA1

    9063314414ab635c9fd2dd71da472bf12622643e

    SHA256

    b7a59ad1f473adf64d08bcdf97b1f85483c8fe0b96040daf49deee3a0c58f36e

    SHA512

    1dc80a9df224b8e488e0d7593acf347c79c9c2f942a8d103589358da3563f2f78e58d24f415248f148f2100fde02c2fac8e2dd8d032f7fbd94d1769e34f93158

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    26db842d6e15d037569fa9ea21921904

    SHA1

    bc1be689d023cb9c6d37038296cf7ce93dfc4eb1

    SHA256

    318ae086d904d8288bcfff207e5ff4d81d633a32d815716c304ac580d6449c39

    SHA512

    f48ca8f924356edecfd150cca95ad57c9b845f309d4eb81618972bb18d6619e3424961e98529c9712911c5e3847ed94f678581564a59a3ba30f1549a51ef1006

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    4da605d82e7c3db6cf65692ebae35ea6

    SHA1

    3fcbb1e2b529ae464fc34f9e427f5336bb12d6d2

    SHA256

    418051967b489acd22c9da7ea9a0ddd79c6cef6877e4397614076e0dfc349c94

    SHA512

    1499de6b0f8ac0b551999abeb7fecc93a3e441d546e62839751b775282865c61b5eec3b91ef753ffcb15f6aa5fb5e34840c5a6df465f3437344c98c1163a23cc

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    230d5855b21e424d453efb517d34c40a

    SHA1

    f867a29c2753da24cf0c4c203c24892b244a5ef8

    SHA256

    06554c7ec0c5434665bb820a4f48a42c8f5fa3f6ff363d9e4f9272b66b7b44f3

    SHA512

    1f90e6983b065f792f1c347c38533238c069c1767cb800a7ed2ffd5fa2a82f8500d08721db4032640735b3b7d89d7e63cdef3e5f6aa0f8cc2844fe6faf1b9359

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    789be0590d72b66a48c240f87f96da4c

    SHA1

    376907adc7a8b5135abd9040eb9801fe64df68dc

    SHA256

    4c2e3fb0f95d9c81736d6ff446570e9589d4ce6fafcd7a09a743c5c65d1e1bc9

    SHA512

    b673f8120166d61a6081d52cf0c50dc92bbc3cfeec561028e39268cfe39d68ee35e28c01ea62faa1994f1b02b275ecc1c5d930b28a5c7a7dda5897241fb0df62

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    485c05715e3dcaf335d1ccea0d17a8c6

    SHA1

    f0fafc254f36d11ad6db998101f8c6c03215568b

    SHA256

    3d6cdb89495554e52ef008e3e205e9d2cf7bebdd3c47a8cd1b8ed216be80f637

    SHA512

    7e5c708097d613f230c222ac233bebfb8ce1a6fe6aea0ca72f882cb9204a812365f01950ac7d96dc6013479ae4bdf8372af351c4a83a0bf3ab74e8ee4ab8ffce

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    66f191f0505d8ca2a170df57d3a6ec3d

    SHA1

    26a818216117f3bcb7a3da95bb397c15f92d92be

    SHA256

    b636cd0acae4a1440760e2fe483b34cd9c8f6e163d7909b49e36a7e35ae10b49

    SHA512

    8bb7950a17a5494b4a4682cc3dde36345741e093f10d2d5afacf70fbe204d81b3b4cc11d7751a64a1216715b294422c4e99087a49dfaf0383c90c52134869735

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    fbfe98667c114c77132e75c8959500ec

    SHA1

    da9c93c619a9f7f0493d0d3073b4167ceb44de8c

    SHA256

    f5dbe9689983d22d0ea5ca416c3b0fef4a330592d0b8c4e7689f9789defb285d

    SHA512

    d48b3b742a8a01c6a62336befd9ea0a02bb0e996b2d1bc3c496f2058c9f8d9b235af2e74b9057576552a4c88da99aa7a157f483eb35cbfa5d21eae288ab13c3d

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    deeae6549d3798b3750bae214993c9df

    SHA1

    5925c22deb18506880a6cc78dd26d3e300565b46

    SHA256

    f7ac029b30e58f20a42b64e69dbe4927861e68a8c9b9aff9204032e9f56dc878

    SHA512

    7a5ccc2567ade7c4367607ab45788e598b8acff9ef3da877973fe696eadfeb3bfd84c6d262dd8b3e22c0787f8c8437af0ad325a49375ae21fef6f6b2fafbbd26

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.fantom

    Filesize

    48B

    MD5

    01a11069f93cee328f60b9dada5f4564

    SHA1

    722725b9445ff425bb5f595fde6b4b94ac223874

    SHA256

    41dab125b5dc3002f6dbb19b4104201e70813c5ee140783c24ab1c2503bf57d4

    SHA512

    c892b87857c20d45fcf188ee18d34b674ab1bbf425e9944f1df123c37187a199ad867e62e3af3a88b7973dd7cbeb4f982311e098650e4f706158b01e0178eb8a

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/2996-38-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-40-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-1-0x00000000023D0000-0x0000000002402000-memory.dmp

    Filesize

    200KB

  • memory/2996-2-0x0000000002740000-0x0000000002772000-memory.dmp

    Filesize

    200KB

  • memory/2996-6-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-14-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-130-0x0000000005420000-0x000000000542E000-memory.dmp

    Filesize

    56KB

  • memory/2996-4-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-3-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-8-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-26-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-10-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-33-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-12-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-16-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-18-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-20-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-24-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-28-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-30-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-35-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-36-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-0-0x00007FF873BD0000-0x00007FF873DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2996-22-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-129-0x0000000005330000-0x000000000533A000-memory.dmp

    Filesize

    40KB

  • memory/2996-42-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-44-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-46-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-48-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-127-0x0000000004B30000-0x00000000050D4000-memory.dmp

    Filesize

    5.6MB

  • memory/2996-128-0x00000000050F0000-0x0000000005182000-memory.dmp

    Filesize

    584KB

  • memory/2996-50-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-52-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-54-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-56-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-58-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-62-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-64-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-66-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/2996-60-0x0000000002740000-0x000000000276B000-memory.dmp

    Filesize

    172KB

  • memory/3232-623-0x00007FF873BD0000-0x00007FF873DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3232-142-0x00007FF873BD0000-0x00007FF873DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3232-143-0x0000000000380000-0x000000000038C000-memory.dmp

    Filesize

    48KB

  • memory/3232-144-0x00007FF873BD0000-0x00007FF873DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3232-622-0x00007FF873BD0000-0x00007FF873DC5000-memory.dmp

    Filesize

    2.0MB