Resubmissions

21-06-2024 19:37

240621-yca7cszgnd 10

09-06-2024 17:07

240609-vm7rjadd73 10

13-05-2024 17:36

240513-v6qblafe3y 10

12-05-2024 17:17

240512-vty3zafh5s 10

12-05-2024 16:15

240512-tqd3ysdh3t 10

10-05-2024 18:05

240510-wpghssdd27 10

10-05-2024 17:48

240510-wdyypscg56 10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 17:48

General

  • Target

    Ransomware/criticalupdate01.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>T5Lknf9u35QYzMs2UJsDJ/HRe/9wR7iwGhStXkD/iQ+VuTMyAFHjd8+gfnGLGvxyPJQ5+UUk3SSQpNH/swZWnjyXj+ItQIO4fiIQxhm0iTM6+0lB48gdtvqA6kfN+8Q2LsMf8nHC3YduHLUmIQEGdJHNQsPyQX7HH+9KVd8REr1G35ejHIAQGKCDSAui/2OJwNm3rWQzk5FNwlDaUr20rCVmLA9E3NAe/Yf5G8kgt70ZEsR4kv7mQtc5Ix3qBh+OAD3HYs6iodXppVxG/OZ5Fep23+kPFsrTBYkZqgKKj+D/kOXduegZ1j3MUx3XpqKIPdCm5K3Whp0TknCzypdWlQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1021) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3944

Network

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
    Filesize

    1KB

    MD5

    3e2bd68a82a183a1dc0170b3bd6ce2df

    SHA1

    91e729716cf44127e36dd4fdb594305f20c65c92

    SHA256

    f59668626d8a70bbab214760b45c473b79b7f629070dc636ce8ef267bae1a236

    SHA512

    d9aa1968a10f555f782b81152721bb50caeaa0ff17e435ffbf0fe5dd653e1e1c4d351ee3fffd6bc02a70332ca2ee3009dfeea92665ad2cf4ecf6cc10c1a21a1b

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
    Filesize

    160B

    MD5

    739377699cf06679c31efa1f2a4c1f14

    SHA1

    df1cccc7b908336c28dc981726b5ebe3e231e527

    SHA256

    edcad32a0b92702080a9b1a624cfa2859a2eeb4534ae812846a9f8c55a2fc277

    SHA512

    70700392c0ec063f186849d7591852723ad8c8ef93c8bffd0f073dde50ffe7ab8d22f45b41c03174f79fd78f1f3d2d8e4e4de3404f411d6c5932662c0559b096

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    192B

    MD5

    03d4c546169fe12c7edb142c823b7814

    SHA1

    34e7f5f48c6950027234c1cfb8130a71059161fe

    SHA256

    0d202109f42c98cd83e9901ae915eb3f16224afa066867aa07f2221ac6b3223a

    SHA512

    6f431a8a737675c97312d92ab08e9e068047b909555700698fd5cc7222fc881353b05194c30ecd5ae4cfd43d34415ac8e38023cebb852b099d396c7efb4b20eb

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
    Filesize

    192B

    MD5

    ccfa6de19d922be4bc10ef7cd5077e6e

    SHA1

    baa55919521608c498f7138209645a907d6fce45

    SHA256

    778666e50151528896ba678e02fede327df7b5878533ba857b5aed68d2d35ce0

    SHA512

    96bcefdf742380f8e1230b925a3e17a82273d45d365411c7c8733294065093011d90a5cdc661fb52b1c9db41afae3bb932dbed0d2435d46f34cad89e63d0dad3

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
    Filesize

    1KB

    MD5

    cbb73be5c58bdf680de87dfa0a2c7775

    SHA1

    58aabda85f33ca6fa9b9f5a4455b8727d6ab3809

    SHA256

    461443574ecb7ebed029869bcd2e7e8ce7d55f7e9370e1311a95bf48424df43c

    SHA512

    6c1ef1fedf30e99171c0f906f623ba33ffb6c52cb6317e0bdae0c9cf1e45bf7a2a2a1975fe7bf1ee5bc5222a0ea0d1225ad0bc4a3e0157f13d91aa66c77f8990

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
    Filesize

    31KB

    MD5

    74f161ca4dae67b4b42cfa4aa7a68a0d

    SHA1

    93c62e2f6455a3eb39059c28314841bbdd68c12f

    SHA256

    2fe1e95c9883e872350c0538f8ae0a327be3813fda28ee03d80c9bf880f44dcf

    SHA512

    f88fb7f635cf8f967dd7e46211427d2188b7dd3819f4173ef0d8c85ffb93fd149689db5621f5c541663f4c60dde1e2538265dfe7ebf1c3f84fa246af7ad6c0ac

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
    Filesize

    34KB

    MD5

    328207de3763284c0c8988c073b39a3b

    SHA1

    19c3bbff7fdfbc4a934e4745c5be230654687a22

    SHA256

    7cfce65294333dcbb05168b9b323a1af557af689d9c5bbe7bcc2a52f2b8c9a95

    SHA512

    5e0b1b82334a80c6e5f44be1dc08b1426a283b7ea567c9778f1c09a759caeece8a5bec0b36c041eaedfaf4f9cac922650725f33c3d342907a1ae6f48fa16b457

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
    Filesize

    2KB

    MD5

    8173f15efa0cd99e4c25db26ff1ffc8a

    SHA1

    d8e61da4d368a60fe3c49c05c12df87b107ef5ec

    SHA256

    abeab898a5d09255e4a858e3b56be50f600168a599f5172510a14629fa6a231b

    SHA512

    a80507a18160bee9c948cba6496e78620d08d9d97e25a1fc9793e8f16a344c0a25a829f9e4fbb75aef8fa486c80f55ed5c3e72ff148ca17da14f939729409d65

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
    Filesize

    3KB

    MD5

    7708ac077f7158a900d06ee08d6ee963

    SHA1

    4dad1d47dedeba9dd2f77893ad1a4edc9aa90580

    SHA256

    3ec22104cd76f4b80822f8932d0ba772f32c614c54af54cbc84f9a3aece4ac3f

    SHA512

    d0ad18782a4b73bc2a9c82088221e180151265c778d5a56c6291aa0e2706475367d1b53777a4f16aa3b8b99e7ca070aadae80b253c6ebc361d5384d88ff75e85

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
    Filesize

    2KB

    MD5

    784fbf014720b3a77490db183f4aaa7e

    SHA1

    4e8c16a7108f4e8abece9f3446a3e73dbf4fb721

    SHA256

    db5e5634f576dd645b6e7832f7061675df4d1535eaf13da5a13ac558eb3dbb6f

    SHA512

    156462f036133d2c851e7e019568da613cf09e5ccf93ed898b678e93554b331ab114bedb700a7515f06028f80e9c6b4831301ea5e8fee4d39084573215ac1d35

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
    Filesize

    5KB

    MD5

    da9eb73d6034f5964414e40990262efd

    SHA1

    43a1ac9b42566ed60a08660474db18d98ef79f9b

    SHA256

    d452d5a585c8a9b71091c86a09d0e8783d6cfb4e98bb0d21901907755bc6a45b

    SHA512

    11cb6768f9c5a47e7a200072a9e51aeb844dd151c80cc079811e0db5ec7e38802f3fb21a183c0f8f76069a99ce74b06b2c857412efc5ea2b77aecd8b4ab9ad56

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
    Filesize

    1KB

    MD5

    2d51ef8de66453cfe7a76c2310eba24a

    SHA1

    d6311509b55958d37dc5e87e838a133a80fe196d

    SHA256

    a8392a1ded367bd1abea194e7dbdfe6d3c94a7e3d4cdb5bf182a12692ab2fbe0

    SHA512

    99f5af9be1aeddfe65033ad3c0a628bddb3c7543a323fff735d5c02aad256a4494f8c238a92051d7e646cf8bce3bdf11d45138b6c84294e4a237d2cb4037e41f

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
    Filesize

    10KB

    MD5

    189136d2f7897cb74c1161519228c849

    SHA1

    dd6e6adffe57a5602779df85039f914f485eb308

    SHA256

    4de57f60717d4a0d06099d53ad7eb703d09c3ba7c6a81cbd42c5ae7acfb83133

    SHA512

    a4f2b6981e54cc7475be7dca540969d035dbf65d6c09259960c8546645a61af19e8e4ab0dc4ce1242766465d89d8011fda5f0d07c8d33c16c3cc86b00c0faba6

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
    Filesize

    3KB

    MD5

    004b8a3d97f8448ec6f20b9c50e7f12d

    SHA1

    bb816e3293f4194426c7b7589aa774a151d1d426

    SHA256

    7f65c8b5343253760a5bf4411d7f9a4150d3155334756dc7fc1f409a2ea289c5

    SHA512

    745633df5758a08ec37b00fa9777fcd03017a152bf0dc8abb1c7fa5a841f6b289e55955b84971ae4c353bb78154b819f0305dd85c433eb96127f64f0566b994e

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
    Filesize

    176B

    MD5

    161464276d30a4e35d89faccb7947c2f

    SHA1

    daf2d407bc16492a33c891d4decaaef838473556

    SHA256

    f792d3d140bd1599ccc9e5ec21209eae114acec0b9127f709c375a7a72df5250

    SHA512

    91fa27e522489455e421b676bbe0016d82082da99ce89774f3c92c23db811259b7c4fe6d5ae40bc07c9e83e94bcc9b9239cbbf91fab59f67e5663529f32c0801

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
    Filesize

    1KB

    MD5

    9ae970b84d71e03f858e27977f984af8

    SHA1

    49c748a6a46198833d3938a76386b9d383aa200a

    SHA256

    a94c3e5672d8eeb604766e2f23acc1ee77fc9cd1f2fc779356a896183f492ab8

    SHA512

    2855bccc4e1b9c66be603ca33e9efcb18d251a2d32b498fad52b897a9962c7b13d09ab2eeb1a9201a9289396e354f97912beaa8564af04ad365f31033573d616

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
    Filesize

    3KB

    MD5

    264a90b6bbd4bb99b1da5c7c2bf4d90e

    SHA1

    52784af7d943121e3fed20065663b5bd3ba834ad

    SHA256

    59f50f2992a7127d9bafb6550a0b2bd40e73ce663c34d4e3d533debc4ded5aab

    SHA512

    268ca2a5283bc98b4a196052f130e91e4286b0152ce87061fdaaa4bc01e9697157ce0a5138430a2c56c90e7c3bf900b097f2857922f9bef3448699e766b81578

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
    Filesize

    1KB

    MD5

    c4d53f9da3b141b13d03795fc0637865

    SHA1

    ce3b6f85dc37a633a9f7556eab17833da34fb9d3

    SHA256

    87d38a19abe944239c2ecafa1afbbaaf366af3cee4312e0cdd50cf7022392617

    SHA512

    ee5d7ef86bb252a883ed97ef79a3fcc0f71a9ec5c264a727b7f9b6e5b839621320bdebbd625a841a4d07f7b8e341f33be123c153d693585caec7a3dd7d3014b4

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
    Filesize

    28KB

    MD5

    34ed44ee658a1f039fa63038bc5a2ffd

    SHA1

    fc049f5fa932b82149b300448e2027fa29975d26

    SHA256

    d517ccee2065d216a817af37a1dac1ca66a53135802e05a4dffd6b40aa5236b3

    SHA512

    897ece615089b0f8b9e1f587c162df9bb172c0eba2a5d8bb7e07ace65fdcaffeacc81c71a98117cfdddf693e965ad52213d88f4170568eb31baad9b54fba6f77

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
    Filesize

    2KB

    MD5

    24f86d5d0f85016f87487d28623eb68a

    SHA1

    140e815083c5b21518d5019a909c76e124833265

    SHA256

    31735611b581937a45ec29af3f929b6c5f017dcc95be473c7867f95ecf29afb4

    SHA512

    50ca88aa972e2b6c7e7b424597dfa31a65fb526e053a81458c6e6a21a6d6cb066e70e6657998e790c6cf60fb8e1b4bf0558d6428ddfe5d76ffdc330ff858154f

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
    Filesize

    1KB

    MD5

    5c880d74ba4353323efcadd805457225

    SHA1

    a2be93b645dd539cdb999224c21732211bf7cf4a

    SHA256

    a7dfd1cf54013134dbd70524e61fbc86b5cfbbdf69d511062fc2879b63bc7495

    SHA512

    fd3747e5cb670f5d9ec76bb75d4675ccc91690f48567381625324353b9d497dee9e8612fcccb8562f213b7c3deb66046d781be087551abff1b80c8fe87da1dce

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
    Filesize

    2KB

    MD5

    6b1af0e09dc3257917ee7d68fee1b5b4

    SHA1

    4e56d7dadabdc565cd498c11d0fedfe78242aa4c

    SHA256

    61672dfeb6984efc2e94af9ad262c2ea48d79333b45049e952438be677689a9e

    SHA512

    c04e1135059b1bfc1654de16fe71eb408099443ce470fe61152f75d6597a08db58084f718de7c5b4f2a146884ea76ad1b2eb91c59d46a9c71f1da886b56d2afb

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
    Filesize

    1KB

    MD5

    46cc3264674e59ff50450305274631cc

    SHA1

    c2c59c3e49bf2ee2541d63f5ae7fad2f21bf4570

    SHA256

    6264e3e0ea1476563b2799987dbb4355186ce9dd8b50e3029e18d8097c8e827d

    SHA512

    b8ff7e83bd817b4f43677e52dbe8266cb388738ed6990e23c8b796a9a93e30779603660e8a138c3336518e8d360a1402e364e63d19162400a2798f8bdd96cc9b

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
    Filesize

    1KB

    MD5

    af1b164a4488be32fbd36534ddf85445

    SHA1

    19fdd72ea55a049486b4599413663979bcac3d04

    SHA256

    7582b3a668eb107b57686cf453596512061d1797749984e8b9febb97d5f8e458

    SHA512

    b56acedd4ef4fa3571c562781b74077ad2f70605b8f2be37004c07948501341b50cc5e5abb393e283788cf929fcd1226e3bdb4d4b2fc6edf1a515581277c831f

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
    Filesize

    1KB

    MD5

    9516a50d4b59cc7b81835ff7df98ac5e

    SHA1

    5c6eb70a6974d4cc3966c2fb43ddb894e9acc73d

    SHA256

    5190f2e6ccc1397877d1ae96b341c78ba8bac2d174a16111f150432a4e3210e1

    SHA512

    4781e1178abe3ecdb5f1427ae953ece9843c67967e76e448d39f13a44785d45208af6bae143d901256217c1dfc6d22879bdadd50498b75809c091f4b1857e55f

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
    Filesize

    3KB

    MD5

    2162966fe223bdd9f549997da8dc0eaf

    SHA1

    4f446c0a9b299db70b9d4049e6f883c8fe95acfe

    SHA256

    515fc0c079ed89a0b95a32529445d8b6a2eca3e232b46a0bd432014924a07a92

    SHA512

    2b4745f26e2dc8b460c1bed365d84fdc43eb9dea4dc1d4ae8e03ee29f9391c14147ff42b54ed9e5b50635cbd5e0cdda56b002e37ea1ca93e01d6719b19f5b029

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
    Filesize

    2KB

    MD5

    0a9e0b275c602a6a65beda2624f205c9

    SHA1

    6ffb3d97967e1b0795a63d3d2d89e156c5d13a09

    SHA256

    4e946c775810a3f047063e0ed400b12578689b952308f821531597e30cfe5e63

    SHA512

    e85a5d3279b3d3a56fe318c63977017c2a24f313bc5d448296876e1e033447755ee6d91bd83f43e468130858d69cec122d82cf47e1c4f50082cb1e2b581948c5

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
    Filesize

    5KB

    MD5

    1b42a8df14906594e5f0ac3892161214

    SHA1

    2c8f1bb8e6be451da937491b078388a17f405617

    SHA256

    41e37e2b156141ea72bebb907f5ca756b73fa12b2639236c36d3ba6c65a1dcc9

    SHA512

    89c35d73417b95ec8ec6ad37050c03be88e75616ad13da55e2e6d4bf53a91d654a71984ecc449ad80560f9d1c98977db1f4d14f8055ce27939d52be2bc70f416

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
    Filesize

    3KB

    MD5

    da773406085b9d3d80e68e735d4511d0

    SHA1

    3f2e5d6f6267905405b8485cc6e24983e6906d5f

    SHA256

    3e6e38d18f000344d18fcda15c40096f955fdc6cfc06d711f8bb72bfb7cd8746

    SHA512

    42d9ee0d1cee4878526c9eedd1eef2458b074cc1e2e4c1c521f4164f0c16915262db7210c149c42414943c7f0f259b6c2bad69d524edba87b2ae5e6ec5154da6

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
    Filesize

    2KB

    MD5

    e0a144d359eeb0e8a40704482711a3f8

    SHA1

    0c11486c7d6f5f610a9a96f391862943ff11c3a6

    SHA256

    b8a5b528873dff50456b43c5d7da6dc0f37b5bc56fb4c9f9990ef80e73efd10b

    SHA512

    ddbc289daef2d8980884a3cbc4ca73a543f18bdab067e84fba701dfe3926f84d87deb15921438e58686d6eed6a1a8e906c3cdc493a570e8f047ce5cb6a6a0e65

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
    Filesize

    2KB

    MD5

    6e5709e4ac8f0dabf24d25f912bc6b18

    SHA1

    3f19b9dc85f9f84cbdb7a0b6557cd5233f506130

    SHA256

    bc8b93f39707be195f9b7a6ba8603c1868fbd19472f24d21663298ff122b07ab

    SHA512

    65cf4deb25fd34eb5efd0a8827863d0820081d2633b8770c6a9a825f216ab153244de422c1098daf123363e2626b88454edaa667debf1a9bcf9d0e04a5f8d44f

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
    Filesize

    1KB

    MD5

    a456e7d3435a80dcf7d230a89cc06f50

    SHA1

    3c3038267c3bf23e9a4290c109c8b5fb0b1e7157

    SHA256

    48d214bfa882e35670d96370cb9ba797d3ea1c73d9368ad4fa1e22800f5c4702

    SHA512

    5080a36dbbad3876452fff856800a3e28ef49c43e41fb20d10d65a866a76935434ada241c9c3dca871b801608cd50f06a41e1ff57d17f25e9454f6aa73a40416

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
    Filesize

    1KB

    MD5

    1d71b08e366191a3e80838bcc1e27bc1

    SHA1

    d5b786df4b6d8552914693687bf0dcb62a3821be

    SHA256

    6e119cd3190794c198d89136b41a73349e0a8f19feb5c7fa69c7da1e59fef895

    SHA512

    429eab16823002e06cfcd7f2d4a4c1612e0727a43f0ef8fbbed7c455485c24a8e8bae9e81ac296ae3a89f550515ae03882ab4a543a15cad6053c3aa4dfa77a6b

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
    Filesize

    11KB

    MD5

    1714b1005be0dc6d9b691f4b45f6d446

    SHA1

    62358e0298c17e1fa199f050e26d77a1242f4274

    SHA256

    9aa28a5cce21f199a154c1fc6595fc34251e512870e2fee2ed1136c66451ef9e

    SHA512

    0b3a4f511defe340ca8c7bcd3da705312253c58a3dfeacd33064bf9668370ab9983c6224fc91c83074915295fe6f56ab6741dafaa9ac1c21f0b5e05f1b179d5c

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
    Filesize

    1KB

    MD5

    e82d1cdddca92f23bb9036c9df1890d1

    SHA1

    5db283d37dd169f7bf0ebd32e8e4fc165ea213f2

    SHA256

    569c7d5e33dd1d27d98b505b42cf933931539337e51c7daba9ef16f275983cf2

    SHA512

    5a5c084a301576f7992b2c3cdc71277d62534f4ae2e27f0304f9f17cb13b5ad9c760a27d06e18bfba8e4077c8caacba3fc5d46a14747ebdd7a3172a258bb0bc7

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
    Filesize

    2KB

    MD5

    d3470bcc50067c081594f5e14fcb316f

    SHA1

    69212411f81d137ebda1f152d4c485f825923d2c

    SHA256

    d4c99c1277ac823f84809dc263b9e4258c2dcf065ebd1fb1b1d22477a780dbbf

    SHA512

    c008d4061d51cc43aba3a183d59cb3676f247ad9b4f6aeeff3f1378a195586f4c8532d45afe9e68f3df641a6ecfe6644d97897bedd6bdb1ba5ec236563cbaedc

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
    Filesize

    11KB

    MD5

    b82f2c784895cf6e8bb80113332eec35

    SHA1

    7228bd35b5c81cb2f6f4c7a3935317c200da8522

    SHA256

    f2e591f20d8aea23a5737770d1eccae916744e6338ccb97652109b4e42900980

    SHA512

    3188457914cf07e82ecffb234d55b730d80c061ce90108829109efaf1a4c172414bc7cb5923ff39eaa6117cb31ed6f8e32fd26bc8c0ce38ca5ca144f195dbcbb

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
    Filesize

    11KB

    MD5

    18aefba7e9f86498a9aeb4b5da464e65

    SHA1

    5987b28f4ad938c99c403711387aafe983da3be3

    SHA256

    59ae3cf5b58652173c9c8f213c473bbf69a7cda3eaf07b9f2ad4b9a7c5327ef8

    SHA512

    eed31dd4262428d3c79abc6ccfd6697117ee161927db83d20d7ef31be6b9f25098bffd71d2d72ed2ef42a5e2c37f04bf544bc92ec4743ca4d46bec67988a5c73

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
    Filesize

    11KB

    MD5

    8317c81dc8040ac096db449b0c767020

    SHA1

    eb525145f9be5af564d4e249a3f82c995e43355f

    SHA256

    e8b2cbe066f6c886c78ba164314465cdc1138b2493ebbcef96f5123ebca5d387

    SHA512

    0731c5b5719c955ea78be230e55f71b5e7d7dd29003529168b9f2ef0e4ab18b0aa56b9386c65dc782c341efe9f31b0973265f25e2f68add72f4543a6f924ff66

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
    Filesize

    1024B

    MD5

    2e428591ab00591563c3ffaece908dd1

    SHA1

    b43c82963b822d6302452722772f479a5faaea47

    SHA256

    418aff01bac5372aad1f492b4b880b60f691e500d3972c0d461efacdffc29786

    SHA512

    cc6c48eeaa200bc93a671524580b54d9806a516cf6c7feff6f0d84ecb737ffd2ec3c9c7a31bc832c34a5ceccec6de45187e9ed47e778f727b27cc92fafdb520c

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
    Filesize

    48B

    MD5

    e9857a842b004d4476f0e2e87cbb15ee

    SHA1

    21878ba132e48e7be14a2d11f7243aba4a7d0e88

    SHA256

    afd124d279a6233011ff1f9eafa79506e59f8dd6a151ccd5ebd2b064fdad1b78

    SHA512

    f732a9af1be40da32f3bc6bb1371196492b3240ec2d60af8b79d5d7b54a500e7ab9045e6730d0dc74ee9cb21d92984d654912f6e59ad0c2470b057c441fc8f06

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/2476-21-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-0-0x0000000074C4E000-0x0000000074C4F000-memory.dmp
    Filesize

    4KB

  • memory/2476-135-0x0000000006170000-0x000000000617E000-memory.dmp
    Filesize

    56KB

  • memory/2476-133-0x0000000074C40000-0x00000000753F0000-memory.dmp
    Filesize

    7.7MB

  • memory/2476-1-0x0000000002550000-0x0000000002582000-memory.dmp
    Filesize

    200KB

  • memory/2476-2-0x0000000002580000-0x00000000025B2000-memory.dmp
    Filesize

    200KB

  • memory/2476-3-0x0000000074C40000-0x00000000753F0000-memory.dmp
    Filesize

    7.7MB

  • memory/2476-132-0x0000000074C40000-0x00000000753F0000-memory.dmp
    Filesize

    7.7MB

  • memory/2476-4-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-11-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-13-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-19-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-27-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-30-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-33-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-35-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-48-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-51-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-53-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-55-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-5-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-7-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-9-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-15-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-17-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-134-0x0000000074C40000-0x00000000753F0000-memory.dmp
    Filesize

    7.7MB

  • memory/2476-23-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-25-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-31-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-37-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-39-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-41-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-43-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-45-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-49-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-57-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-59-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-61-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-131-0x0000000005340000-0x000000000534A000-memory.dmp
    Filesize

    40KB

  • memory/2476-129-0x0000000004C50000-0x00000000051F4000-memory.dmp
    Filesize

    5.6MB

  • memory/2476-130-0x0000000004B30000-0x0000000004BC2000-memory.dmp
    Filesize

    584KB

  • memory/2476-128-0x0000000074C40000-0x00000000753F0000-memory.dmp
    Filesize

    7.7MB

  • memory/2476-63-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-65-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/2476-67-0x0000000002580000-0x00000000025AB000-memory.dmp
    Filesize

    172KB

  • memory/3944-153-0x00007FFE57810000-0x00007FFE582D1000-memory.dmp
    Filesize

    10.8MB

  • memory/3944-148-0x0000000000F80000-0x0000000000F8C000-memory.dmp
    Filesize

    48KB

  • memory/3944-1492-0x00007FFE57813000-0x00007FFE57815000-memory.dmp
    Filesize

    8KB

  • memory/3944-147-0x00007FFE57813000-0x00007FFE57815000-memory.dmp
    Filesize

    8KB

  • memory/3944-1939-0x00007FFE57810000-0x00007FFE582D1000-memory.dmp
    Filesize

    10.8MB