Resubmissions

10-05-2024 17:13

240510-vrrk4sgd7t 10

10-05-2024 17:09

240510-vphv7abd29 10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 17:13

General

  • Target

    High Priority/criticalupdate01.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>QAX+pGIzCilAG/rkGuVikjnI27mks6Y1MP17XGimIUSVn3yTgYi+D5NLM/lDlJJS2LmJntI73nq8QRMVvOiLNxtvwABJyRZpMRUiosoxNDBlgU2mh/85Gyi2e9IWzgPuNyEFTwsh5nmt6340Ysj3DgE/8LtN+WXJ8TkIjC9ppVoalXcLXKXzWAph8zQfu7opb/bGRJjQBiCz5TJMmlwKq0NCQ0KMjepOtJFPGnoQLH+RtlcSE3GOZ13qBr4oL+epOqZS4cxHDeVBK3sHolSgvCKoaevllcYAt4h6s9u2S2qe2LX0uVoa01ybkQcRE2dsrQfqbGPVpkVP7xE28JJFNA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1352) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\High Priority\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\High Priority\criticalupdate01.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3128

Network

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak
    Filesize

    16B

    MD5

    ced91f18870484118e937160e595e6aa

    SHA1

    1138dd5d1d738581f714c984777f568ca3bdf4dc

    SHA256

    aba404edcaed024c363ff7015f34b83bdd5d64e3e6576181c95347ca62197eaa

    SHA512

    01c51be89e5ad73df16a3bf4cda24c62da0ed4b50fed3266205a582553688393be3c447aa94440137fc6e8673bd85ce96b783aa2abd006736eeaeefd81938785

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
    Filesize

    50KB

    MD5

    c2238772f9959e58476f9be85f8f2b9f

    SHA1

    3e5e46a09feea22a3f5703d64c3412862a918b0e

    SHA256

    088eb356f05cd3dda67f728bd84ccfa8cf560336ba9cfbcb07516313492a7780

    SHA512

    e528e637182dd5fb0a634a8d6f1ba1e0107588e5ae48048b82f28925731c20e261093bebcea404b700589536ea1408a96aa3710f608eee28c5af6e23e074ce8c

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png
    Filesize

    1KB

    MD5

    9a14601942efff019a3f0be298253010

    SHA1

    d41611f52f32a5499a2475e0f11b2c30faed6c0d

    SHA256

    0a0b2a4d9a8f8980e53e67da844d3fbf5487d97f8211efabe8375c80e1636585

    SHA512

    3d493757cad48c781095667cf0e285c9f4e9d69dc494b0a6bc3bbbb637e695a8ff099a4c72d2d79ab30acf978abefac637d3a2198a8ac57bf6333fb05a3d13fa

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png
    Filesize

    3KB

    MD5

    9369bb43635884980b0e36b42d793548

    SHA1

    f92896296866bf1aa2f0af6a2ed73221819f6df9

    SHA256

    68f9e40f1856811fa1dd8caa3e8e8c96dd5b93d4ff1110e276d3fdac3b1f9a78

    SHA512

    dae59d876b76c7b001d72636cfde37dade3df797d60eff6a639f820ffe7c1cc512823f3860bf3f12d3ecf4a601d7797a7e35449c42775990d447cf127e97e3cf

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg
    Filesize

    720B

    MD5

    e0214fc71024e60a29405378f8dddbcc

    SHA1

    ab1e28ebb195abf62f97f23922a2fcee2c161167

    SHA256

    dbbb1714146fd35647aac5a89e4ac34ab3c85b1ffd0bb46273746d313e39912c

    SHA512

    1f060d33a04f2b74b040089a616c415d3473d97978e798bb7f5b2767e7332c92e5f0068bcb5f35b912055bf1cd14b8a507427e829a112e316c3c1561569acdff

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
    Filesize

    1KB

    MD5

    3f4377fac0937e40a25a64dd43783790

    SHA1

    08417140988c81f42f8a9616d93c234ccb040693

    SHA256

    21f6a5498977d2429924874f11bb4180235dc2c37e58f86ebb8f77d541657f3e

    SHA512

    da42bac2c8328fd97e425cee6eb98e64b64c5ec74eed27bbc9fec502929be61de2d9485059f45817ebdcbefb4d2aa4f98e04b80d71449af831f8673d62ad6f50

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
    Filesize

    160B

    MD5

    823a08b9787cd0682ea827df02ab8eed

    SHA1

    bb52aa9af57d088217046a7adfb437c2fe80d26d

    SHA256

    84ad7e25792c4ae0cbe3a684336b2ae87940222ade3f7fb9c66f963a29726d0a

    SHA512

    b93559af2dbf0f2051a35449e86f528ebe3e7164bc3a6e85b1683fe138484c2aba2b2363f0885309dde6ab09ab1ae6034c2445dfb7f8612f26c54af3cc18024b

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    192B

    MD5

    8d396bb23ba96e78f7989a30e8703a92

    SHA1

    a5885634e507285b7b439b525b6faee263628159

    SHA256

    2c9a32853276716513ad727a40490f81e91af21c801cfd0ed562115372374e30

    SHA512

    586775a2993a8917390497418bdb0848f5ce27c592fe0f27bf55545623d4d53fcd5a6738d3f5bf7fba4428586c26a2cc0f0879699d1474fa6319d776dd3aec4f

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
    Filesize

    192B

    MD5

    12374839880220e10c11c740029fd013

    SHA1

    b70fd5d43db94d57aa0697f63f6b760bcd82cd5e

    SHA256

    453e7e269b1871028c0be702efdabfaa7d8ca85bc812217278e7af1f854294c8

    SHA512

    5295bedecfda5a3452182c51fd40fe3b359f64ca591c2338af5ba4c8a0a6db3c8a04449073d5f1f13bfb24f1fb312316cf46c38fa8c025859246752ae8385e10

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
    Filesize

    1KB

    MD5

    9c62d3d813df8c152e5fc505dd8ce52e

    SHA1

    549c4a00cfa1da883add7144c4b79e723fb58b26

    SHA256

    f1d52b34237015a970dbf18ebc2f3de1df77c15154871cab9981960bcbf5b082

    SHA512

    c0d139f84309ef7cba38b213fb100bdaecbba2e2b241bbbc67e9613587bda3fac18239ec78b1c29dfbcda3342ebf0f93500e4516baf51ca9fb3b5c087eaf6674

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
    Filesize

    31KB

    MD5

    6c0ad21039027d7f33d693d7477ac860

    SHA1

    34a68f21b5c668c112531fc2b11930a7a89590d3

    SHA256

    73d2bbdd12c94641b731a8c426631dda5ef85184fd1625a69e896f482b6bc0fa

    SHA512

    cc38f4fc7a1d1a2cc69b8eef50ac064985d3676e768a16dd3ec1256fe1774d0d94a14a520c7da40cd14967c2d9f4fb8432409389e398f09e13f887b78ec265f0

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
    Filesize

    34KB

    MD5

    3e3ed38e3789497993e86e32c1289668

    SHA1

    daa12afcc723e7ab581a0d8f3c8c233093ea976b

    SHA256

    a75f860e6696cbd59446559b7b2127793356c227096975c4f1d2e09181046658

    SHA512

    4df3d76bea94d294419af0ef113b1c009d580ef0d5077fbb49633a67388f4cbd946cc190ac89abb65380664c846e5b92b97297432a5b7f2974a03d1e611c2d83

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
    Filesize

    2KB

    MD5

    02b61aea97a3ccf8a47cd6f8ff22d271

    SHA1

    793a9a9b076e2f1b326ed1126dd6ac26dd0cc007

    SHA256

    695f4e6d8bace1e7f14cd52f14bebecde13f692372676b9c4bb1f7f50d42fe4e

    SHA512

    65776393906eb680acb3a0c2cef3e7ee6bb10ab538fafd6ca556ae5e686ba1b8cfa90d9a41a89b9e35da658eeaa9b6ff61d2fe0e3cf19afe535cca67fad32941

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
    Filesize

    3KB

    MD5

    8fb1641442be6731c05f4a2422410617

    SHA1

    45979e69016d7c7907b6d83892ca4ccde2a2704e

    SHA256

    ea1eaeb385bf0edcbb0588196ab7c93c4011ae5eaeeac9f75b8543fd70ce8364

    SHA512

    4143f6f5cc398d4b05a65e722a44d290a58444e97be697ae7b5ead2c64ed94986a12ab5cbbe9119fb66b701ceb8893728455ed663319f80ae98c1a8fe689297b

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
    Filesize

    2KB

    MD5

    f5a6cc7718958f2c0b9a5cab282d2337

    SHA1

    e4d4041a7fb83485b16342d7c0bf702d362f6904

    SHA256

    3e971111bf8e021aaf3490cebf83ddfe76f30b60d8a375bde3689678c4d8aa9d

    SHA512

    4986be94bfec75d3865d94610bf61984b075b4f93c59f8eb521e806264fdfe0771f425990ca126bb1da708ca5ec403fc2ab2edf7e7e2e7148863ed75d6da849c

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
    Filesize

    5KB

    MD5

    2062146e09be4101a1caae65246bb918

    SHA1

    60da7503b2feccd7ad68a4dbb0bd1108632bdeb1

    SHA256

    bf3516ad8b30a495455241541e62de018fd345a46e797a5d99a99886df91a200

    SHA512

    f890f6aeecebd4c101819b2a7ec68ce988ffb79b5ea866fa08b6865deedd5920d4b717116da9565d5a7b20419ce90ef902050a0dbfbb59562bd25aa2cdde0432

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
    Filesize

    1KB

    MD5

    7519b2bc824719e694d301a69789c138

    SHA1

    6b356926766c518494d1dd495e0de2226defc358

    SHA256

    3c564b2344e00cc76dcadf21210c43399d30ccb041c96a01b9971dcf0338f42c

    SHA512

    7994b72f58bc08d6bb25a7274e1ad216d7ae833012c848448875f08c3bad42f56cd142b30fed205d1cf3656ca1186dd4e337ab9440f8a3ca5a7db09657d1af33

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
    Filesize

    10KB

    MD5

    50b5a233d7000863b2d073fd899173fe

    SHA1

    6c904c56a735c31b0f0dc62dbe0ec21953606473

    SHA256

    8256d194bd69ce9bddcf9e307367379e7400d2b3d705982210cdd6c8dc651116

    SHA512

    d4da98fee77a4a6aeb9edb36ac20593eba810b50d00cba4a7b189d06a811fa1a7cc03f784557d8e675fecfe2c2d6a57f3a72624475c5043ba4c80bdb8dced1da

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
    Filesize

    3KB

    MD5

    95753a0260b3dc4cb5162044b6526210

    SHA1

    07e1403f59494ecdc91f33d5065e7b3da6791cb8

    SHA256

    0d6314c9f2640b73cfd5245a3b60d7f26d14166917c39e896166be5465b6b48c

    SHA512

    d96662c1ec95651e79e14f32934a143452cda07686ac5cdeffa972a6427a1f72d74175fc9ff5b730afd8fd6fee6bfc389837a9ad5e24b548d51d325c03e15f1b

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
    Filesize

    176B

    MD5

    ccabf3b10be4d97efa91f803b56a55d3

    SHA1

    46d3c841db2e31421f08c44193ddfd0ff84dbbeb

    SHA256

    d3c590879e2acf5379c341680d93bb188384abcf888d28d4b753e578b87ed0eb

    SHA512

    36e0dc486f3ec1dcfeff8c8cd453a47198aa49e954ab569821c2692eaf873e6277db3c92766f84428d63070d445caa4b8e447cfd3b7207eb6f2f6c9dc9b97837

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
    Filesize

    1KB

    MD5

    6b76b2a71c3c5d86683d1c68b7a4a2da

    SHA1

    a1d0e6ed95150502ba77eac466b8101193d786c5

    SHA256

    11cb5d20134a530dd64b4b4e7f34667075924aa7077f603ce59f88bbd08e8354

    SHA512

    610fecd25df4a40c28eb0387a66d4e4a66c908fd22bb92ad19b725f7174554c8f2a7d0f6b9bf337c7309e6a95ae35e3e880cc66761b387dbdae556d713125d90

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
    Filesize

    3KB

    MD5

    879e7947b52befb142625021a519c9c2

    SHA1

    6a13c5ac03a5bc7e6f73a06ccd7590346d7986c3

    SHA256

    60f0dd73fce73497bc4101a54f6268e53aee882c5dec0ef50b489c0f09df4e0b

    SHA512

    c8db2e4a5dad31f1708e727f217eb5a5e34d3d22a1f7dea1cac16935b025fcc7f63a4b16f27b92dbe1f2687e79ed9655fd6ed0bc70406b0e3ec60ee61c9b4585

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
    Filesize

    1KB

    MD5

    af793c2fb8f40323f0c05dd878d2ec20

    SHA1

    3ce59ff71e1becfd584669742d3a61b094b4c6b6

    SHA256

    0923ca11577c9e58ffb86f645109e8cf4b9aaa7c55db54ba8dd9942bf9f73294

    SHA512

    19c8e1d1de34634281a5f2e32bea896d1b921a0f679d0166ed67b860c2e29a66e995a9c32b8d6b8cc9222c9782ec545bc436ffc078d6acf656bcf35beea0f9c3

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
    Filesize

    28KB

    MD5

    f7d64af96c3d6270711c32b33281a026

    SHA1

    08c8e8d8a8b679063b1ea947cc4d4cf293b24027

    SHA256

    4d92ca631f3e008415d9664557d0724b92283f33ec6d8fb27d09c41c964b7b49

    SHA512

    3f82b674ddda0b8a047d9d6c2fa57c35490a700fb4c4cee6ebab13672df2331de18cba36bc999031a1f5c235bd2568cbe07c00cee8825dd6907606478dc7f7a3

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
    Filesize

    2KB

    MD5

    8ac60eda2d6e5a35278ae4cec0900173

    SHA1

    090d2b6672bcefcbbbf2afeb197a24323edb0f43

    SHA256

    542cd7688532ca4bf71358180f406b53bd00b2b504e736d0106aaecbc346bf50

    SHA512

    85dfa9e98e95a8a1d47e64fdb025c9e2f47eb6686b5fe364f149131bd7c21c1cc076595a1a937eb6275df7aa29dece50df1aa2fc3d6568c36b2fb3f1a2f1007c

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
    Filesize

    1KB

    MD5

    66edfef2b4471ceab23547e5b887f5ff

    SHA1

    2af651309393f4d4864c9884e08f33db920e14f0

    SHA256

    46a424fda1733b9a233e39b5e561d15bda5966a4c6832e4449a707a52b563ffe

    SHA512

    89c760838069323d72d83daa7982303ddd323b9b08aa9322649625486634abb09d11f52b3281b8a6318af5ce5937e260102065e536fda27289b6ed76ebe58026

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
    Filesize

    2KB

    MD5

    bf72fff23973ce4731a4e25cc92a509b

    SHA1

    ae2d15bc0ec5b6a921d79ba81ab4705bc7dac738

    SHA256

    1a0917e977f3aa1f01ae0739b9a15600e99d6b9f51f23a98066fff23e26e2d32

    SHA512

    441af8450e338590399726d9e2e6b54e8259c069c27c6c5a8697136ac678adbd59d7bf66e1cd4823003fd0ceb12934956a7807c8a08f2ac9d0632bd927f6b87c

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
    Filesize

    1KB

    MD5

    fce9d1720f2faec54b09115147c44604

    SHA1

    fe916264f2cc55bd7c5de8234cd2d95ee79b291c

    SHA256

    2852dedede95bc96b5fda31421a97d2d8c9c78d048040fe6b235d4abe40c4fd1

    SHA512

    9682dc6c43d45bbab98f0e9f3183ebbc3f244a97cc6ece80f9c35d8fe4636d3ffe5a591ec2ea4f25db27fddbf597cb53f0a80c75b9fac9fd15236b4c1711cf06

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
    Filesize

    1KB

    MD5

    b5684bb006bad1b72069857f9542c97b

    SHA1

    53eed80f12dea35f959b9a083693e3aec6d9efa5

    SHA256

    980b586d5dae48b8bb03086f4b1f9ba996f88796936d079b403650d7d88bfb9f

    SHA512

    07e0e2d1a787936db938ef8bd9e38e1b60b1d661cfe4f89818e47d36463ef85a1b25d3c8e3ef681ea458f0b5fae18ef5c5713aef7c74132984fb96f5c5e76e38

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
    Filesize

    1KB

    MD5

    0ac69c9907c287ef299054c17d137777

    SHA1

    481ff47a2e761f228ce6115e9a0f2897d2fe6e84

    SHA256

    227d54eaf0eeeee6cf0a48100dfd5ce45ca815762a3a466b2c06d228dbc248e3

    SHA512

    948ef18f117ca556453e5ddd966aa1c4cc7344ceb9a22357f6da69f09f19263a0bbae9de80e89558e1004ef073395add6c612d5b55536d40750ecae8381ae749

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
    Filesize

    3KB

    MD5

    59b0ac72dc270c128f0939d032df2594

    SHA1

    b79767d87aea75adfd354e8ec93bd4221ddfbd04

    SHA256

    eda64911972c9200662dcb3b03df9e77067f6bc562cd5e2410777282d281239f

    SHA512

    3a2558dacef58a3d9f07e9906e416f9b1055d23661ab9e1c0d70a16a9a9e407d37df8f397dd0286b4495edd257ee265551d5dce46ea3d9e8d18368bcea4d42fa

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
    Filesize

    2KB

    MD5

    850aba1a30936cce98abc14cd253fad3

    SHA1

    7a2657a79f238394034fbb3eda2afc2805bb98a2

    SHA256

    de3cbcb0e7b69de9820a397f9b4bd2ec2ed0661a672b618f77c698dee12d6f2b

    SHA512

    7a0c28b7be653fe6f80007f2a5ac8eb1f361fcfd2ef1c3dd436cb91c7f7a528ea89da67f6b4b7c5556d2a076125a30342db54285bb1b807311c0fc2ce5ff3633

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
    Filesize

    5KB

    MD5

    1c1cc671898a7fb22264392d3acfeb8a

    SHA1

    f573bbb760d3666a6f4c63adf0b16aa6dec0b872

    SHA256

    e56700c22b492a609f0ef52f71e114bab2f96ef02b300c8590f4b4c3a6575c60

    SHA512

    dd02f84d973f89112a5ebc12b95848a680f6db15d27c50bc02e7305c907fa3f6c00366458b2648fb9132b2f739d8dd67fd0f8cdb0938a79b5a083748ef18d901

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
    Filesize

    3KB

    MD5

    1db008d79a52b273f405c19b9b30e8da

    SHA1

    8f9c046a5185cff5f10c304b567597e7c9146cfd

    SHA256

    9ead906d741d2c7eba29123d3fec374edb6b5b2eb7bf062cc6b1493530d4aa14

    SHA512

    26107e7847acae65d83b541896f9b9d5fa7959d0634f8380da3d2a1a06abc8cd7ec5c6b1700f38eef61a624dad0de8c9e6e32b92c799433e335836da76404b95

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
    Filesize

    2KB

    MD5

    6f76bda0cd4cc69019fbaef760ba9a61

    SHA1

    2662442908ecc0a3f1ab9be3be68fcc8bb346a3b

    SHA256

    f2b12dc0b40a379b82a56853ae5ebfd8697c6e1be14d72aacfd8898852e58658

    SHA512

    526062f5259c5388d466fe9e3126a30379968cc279ca0b99919219fc1a5a0ffaa9d4711b87e45487d36b0652b1363fed92a78ee3152e2013b0ea8c68094d32b5

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
    Filesize

    2KB

    MD5

    b62e952b34e661547fc95f2b89b06b3c

    SHA1

    92b3657d4abda33b5aeec0303dfa492e692cd33c

    SHA256

    7bc07ce141c5acdde062fc378819d46f4a5bc0d84981a8d939840b8bfdf585e6

    SHA512

    3946b0fc661006778234ed5f79f1ebd7cbd7fec1598390c289686f080ab59c4d3488e6cd0df8ad34c590acc7d75eeb6da23705eacae949dae772d1eb1b66d6c1

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
    Filesize

    1KB

    MD5

    fed4aec658ab7dd19e833814bf3f852c

    SHA1

    e1f2c78873f72b89a940cfb24b3f02e577fae100

    SHA256

    380fc52241621a4789a316e1e77eace59d1f04bfde7188821db80dbe2a3c9453

    SHA512

    6fbecf8673c65c4b486a40c036fb2920488ad027c8486f5fb1b07b9c931b13bd7dadb29ee08c2926154b1ac5dace8dcd090625964c95a801c2df566a37c5d0af

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
    Filesize

    1KB

    MD5

    3250df892800e3979ca4c732fd52a0dc

    SHA1

    5b2e96e2bd034d42a587eec3e8ba61dc15b8e30b

    SHA256

    3098970e0568bf7d7f6d5d54463108036dd5dac2d0c8351dd6142dc09a004ba3

    SHA512

    56803e0abe7a90fccbdddd658dd5a1695204cc26538dc73f805404f49439aa79b3a4f1b35ae1e9b9abb348189443f579af634423c6eacbc43dcadda891c55727

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
    Filesize

    11KB

    MD5

    ab4c835363482b2bc70771b68ec7962c

    SHA1

    b5334eab1c6eb5968bfb506e3b2bb8c60421069c

    SHA256

    2f55e0df7b03ee2ad6d4cc416125cd6b959042f319ee0ee838229e8f1c9bb77e

    SHA512

    fcf7f28136887d0976e97e0e481c963bbe295c5a680ca0a7b7e6f4aacfd123085fa64f306f8d026f44fdc56e314a2794da2ff6b0a766a00360389fdf4784707d

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
    Filesize

    1KB

    MD5

    cee07f393b21a6b035b57c1907b11478

    SHA1

    ebeaba86e15de5a353e2870e3dc98bca05205ca2

    SHA256

    c173f5595339ee7c843cb2aa8ffed103892900b601e570be24b2c04de228654a

    SHA512

    cd9182de02dec87229373e596f6a78fa6dd91e617ebebe613be2ad23095cc480df7456f1d8ce033b3f1c4dbec1b3c162709f2047da5a0776186d6f2a8f3247c2

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
    Filesize

    2KB

    MD5

    72ab84442abffe2b95f7aa942ceaa33f

    SHA1

    9be15203847cdf4ff67e8bb32c8f07e4a662227a

    SHA256

    7f64b7d74f9c7aa91390c3abc8f08f6e94e92a027beb94f305a287b64af4c526

    SHA512

    8f1a3cdd49fbdf30f8923c0df788866571aca99542b0a8c600111d28be089094a5229a5327236addb52ab54e6c890a2245298f45452597dc8846c3e865767583

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
    Filesize

    11KB

    MD5

    d4a5f1ccbb1d2c75fd15f40412abcf43

    SHA1

    a6d316e1164ae9d99bc4af718105c367ec1eb100

    SHA256

    fef645851ae78d615c06a55b455bf4456133dda034d8618b033cfc7889f7e71c

    SHA512

    205f1695e816e9c83f216c4eb2b52f5bcd44de4c90f9390a29ae229f232bf35ab22c76a2da570a1b6bb0e05588a97a0c02e725924c4681411f9bc9eaece6c1c6

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
    Filesize

    11KB

    MD5

    b56a3c4687834fee34955d7c5ea9697b

    SHA1

    25f7d5dd3046630d2b5f2dbb8f5e1c776c4c1967

    SHA256

    55432aa8b6923ebb09a4db53958795ffbf3f584fb2ac6a586113d49bd28ac186

    SHA512

    9960e6e3c76a41ca6b999533851e0162cfc86e1d0fd9a7529e12864c8eefd6f6a847beab894f97d426ecfa79dd7c6f51b5a8525e80bbd4d03dba264249b9fb11

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
    Filesize

    11KB

    MD5

    e39eb78f383e33525566d06680a601e8

    SHA1

    4f805634863fe6f102e6ddaccb8636d61b8ca0e7

    SHA256

    9822ac35ed921d1fb07e5e9256fd174b0bd93f5a9dc6bbe6f70a2f752581c4d5

    SHA512

    2e1c4b95fc5d5af77062a15f474ec8a201661cb574812e6e238cce4086acd287ef1a14d102819bdc6a116c2952d46dbd6a046a0838aab0de199ab73d6db45d16

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
    Filesize

    1024B

    MD5

    45daf46d6b8c493497869ca30dc040a8

    SHA1

    7eef7b2eb4a140258e575500dbb119160c1f4378

    SHA256

    e4d6f8b0b4296e1fcf3184ac9646f1e582968b7097e7ede0c1bc834eb4d00d0c

    SHA512

    adab95f91baa1fcda975c79632591350d9d9d6a6b209b0fda38d03e4c61207af10fcece509a4af1e546099388ebc4ca203fa054ebb7884d26618ddedacd943fb

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
    Filesize

    48B

    MD5

    e41e35e8d61f82f8dae104563fa2b28f

    SHA1

    ac85f37a7e7a623e3a179136f2837e9e2fa79a29

    SHA256

    8dc7a08ec08b1e02706c2a361b0580d3f10ae928c5743d30d38a9ecd057f4f80

    SHA512

    7fcd17bef7411b708223b16b05c26bf14c45263d9fbf29d90612584d579c7f5fd999049eed5eb246fe6222da936fed468dc320ab56d4368a5c8c4eb5c7ac844d

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/3128-149-0x00007FFADAC93000-0x00007FFADAC95000-memory.dmp
    Filesize

    8KB

  • memory/3128-1928-0x00007FFADAC93000-0x00007FFADAC95000-memory.dmp
    Filesize

    8KB

  • memory/3128-150-0x0000000000F50000-0x0000000000F5C000-memory.dmp
    Filesize

    48KB

  • memory/3128-151-0x00007FFADAC90000-0x00007FFADB751000-memory.dmp
    Filesize

    10.8MB

  • memory/3128-2401-0x00007FFADAC90000-0x00007FFADB751000-memory.dmp
    Filesize

    10.8MB

  • memory/3788-43-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-137-0x0000000005470000-0x000000000547E000-memory.dmp
    Filesize

    56KB

  • memory/3788-12-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-15-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-24-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-5-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-6-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-8-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-10-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-17-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-18-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-20-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-22-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-26-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-28-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-30-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-32-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-34-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-36-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-38-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-0-0x00000000752FE000-0x00000000752FF000-memory.dmp
    Filesize

    4KB

  • memory/3788-44-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-2-0x0000000002560000-0x0000000002592000-memory.dmp
    Filesize

    200KB

  • memory/3788-135-0x00000000752FE000-0x00000000752FF000-memory.dmp
    Filesize

    4KB

  • memory/3788-56-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-52-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-55-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-50-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-134-0x00000000752F0000-0x0000000075AA0000-memory.dmp
    Filesize

    7.7MB

  • memory/3788-133-0x00000000752F0000-0x0000000075AA0000-memory.dmp
    Filesize

    7.7MB

  • memory/3788-58-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-61-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-62-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-132-0x0000000004C90000-0x0000000004C9A000-memory.dmp
    Filesize

    40KB

  • memory/3788-64-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-130-0x0000000004CB0000-0x0000000005254000-memory.dmp
    Filesize

    5.6MB

  • memory/3788-131-0x0000000004B30000-0x0000000004BC2000-memory.dmp
    Filesize

    584KB

  • memory/3788-66-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-129-0x00000000752F0000-0x0000000075AA0000-memory.dmp
    Filesize

    7.7MB

  • memory/3788-68-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-136-0x00000000752F0000-0x0000000075AA0000-memory.dmp
    Filesize

    7.7MB

  • memory/3788-48-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-40-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-4-0x00000000752F0000-0x0000000075AA0000-memory.dmp
    Filesize

    7.7MB

  • memory/3788-3-0x00000000752F0000-0x0000000075AA0000-memory.dmp
    Filesize

    7.7MB

  • memory/3788-46-0x0000000002560000-0x000000000258B000-memory.dmp
    Filesize

    172KB

  • memory/3788-1-0x00000000023A0000-0x00000000023D2000-memory.dmp
    Filesize

    200KB