Resubmissions

21-06-2024 19:37

240621-yca7cszgnd 10

09-06-2024 17:07

240609-vm7rjadd73 10

13-05-2024 17:36

240513-v6qblafe3y 10

12-05-2024 17:17

240512-vty3zafh5s 10

12-05-2024 16:15

240512-tqd3ysdh3t 10

10-05-2024 18:05

240510-wpghssdd27 10

10-05-2024 17:48

240510-wdyypscg56 10

Analysis

  • max time kernel
    150s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-05-2024 17:17

General

  • Target

    Ransomware/criticalupdate01.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>CoD31r6Q/KBsJ3NqcqcbOZhZCAzILwOgG69b98aWwDZeev5Jzb7fsaoSS0E7pAAxa0NNVybCVaxwjuYtp4OloISe7AwlMj7iwjEuO0OAO2WtQDUAHAQaMfNSKpW3NT8/MDLIX55EU9pxBWX28iInl1/fYb1nsv1A+D2wjgnY+FmZoX6kuZBcSXBTlSqDLs11WzBELpY1IoyblZ33Kb08HL1P6CsNZV5tCvfvAduuMIqP3g+NdE1w3TDGIlF1L7795aXKtBjJ8ejRolWXShQwHbxf4wQ436UbnEuhhmO9cb7Z/oeS9t9m5dy851/aio3qJPU9E0DFf4qpPOr/ixuqbw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1047) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3208

Network

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak
    Filesize

    16B

    MD5

    f211d7562024b582ba710c3d29e599f4

    SHA1

    313eed160249c7a3a4a46f13f0714a5f69c8ab88

    SHA256

    1d66176c589a8419667c9d3a99b2683229c9559cfb0c4ae70ea777a324b0fa2f

    SHA512

    814a033ae08650070fa26008fc99583f685f51802d104cd2d4bd73f3f50d9d3c743eeafa23dbb25bb6fb175ec2354fc1e1e77c64af24cebb64df89d45a61170d

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
    Filesize

    1KB

    MD5

    eab78ded251067c29be524d97908733a

    SHA1

    2b8b1c89f3986ee7ff54e1c2a616027d41d652fc

    SHA256

    20ec6e36774f5934555819172fd523975b909108d5ea363d4463931dfd91b531

    SHA512

    81f8ca8a85b445e543b8209f10c8bb8685c33ea96f65a5c69ab1f73857728a99fe0fe8227d1c2aba1db65002c87a025e73eafaa57eed9bbe0077fcf0f6d3db2b

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
    Filesize

    160B

    MD5

    d7ddd790d92bac5b61d03ecb38919759

    SHA1

    07414a6ffc6e896d5e1854d5e2b24e0c3e7a9feb

    SHA256

    6b34db505fdc7a03addbccfaeb14bcc89d3ce1f2cdb756808ecab97d444c43e9

    SHA512

    81619dbbba3ed919b300ffeb11b6c7b3718eecb72478a0849fe975c3c309135623a3e53f3c73ea1180136b2ab191fb2b5dab51b3c889f234b6a482f0ac3e8070

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    192B

    MD5

    a01f9bf3ad4bdbd476836d9826424004

    SHA1

    1c0585a5264812b3f231c6cf98654b2b9653d97c

    SHA256

    338cbe8b417746a544f310333b02355fa8990220ccb1f5b6353f082706482f6c

    SHA512

    6a801c01cec28eeca0eccfc2a05f9d36f13d7135cf8571eb781cc9f0bc3939137d52541f544fa8cff64664d0e6946038126d23cf1a77fe8a18fe47ca89af78b9

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
    Filesize

    192B

    MD5

    38c74f93127ee30eb50bda774b321d06

    SHA1

    dc03044bf78432dd74b74b921208e936223e55c6

    SHA256

    8fbb6a1c11d5343d743d6b66f18d4434c48d0e05bf15fc887b3fb60b38f76172

    SHA512

    627d00d479db7fb7f8efac031cf1229d612a1ee1520cb4d4766a6ba9379aeebe1e25c1f7f468390aef02f4ea879de81a14c0e6bc4104b75aee8a6dead31d2348

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
    Filesize

    1KB

    MD5

    7f3ec6f4b85fe21d3137a5d24187f082

    SHA1

    86bed8e7004df9a4071863565e3ab3f93574a914

    SHA256

    00559b54840df3cf0c8cfd59fd0cd8848c8467179f5ae15ec51ef1016933a391

    SHA512

    8b02bc5780ae484deb7ef2a6886d48d041d6adbe80e1bcd64b70718ec2714662f8da6581746ff38776ce8600903b5ef57095a858b710b830c441db2072c977e4

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
    Filesize

    31KB

    MD5

    2083b4ede8a40fb75f023b5670899e19

    SHA1

    6feb34b8b7c118415b48c7f87e1351e78e95f0b4

    SHA256

    11182dae725d06e27b34349e2ef1811a959d9bbe4abecdbe55fd2271d39efd8e

    SHA512

    fc2140dea496e074f63a9859ea14465638c812fb6ed55a672af1ca08f4e3657dfb87172ce5a8098ef6c064f77f294c3f015af969e942526a8e0e0d9bb5bf320d

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
    Filesize

    34KB

    MD5

    79514aef510e4fe9533a9726d8878d8b

    SHA1

    9d8ead2a2de9636c68ccf63c0e9a4193fa4295e3

    SHA256

    6e4b76c01cc20bcacf5a834662030afa443bedcaf056a6c4833de7340ef5fc74

    SHA512

    5994f1fc37cae791f7db0f2bcda50c82db7ce05dd81ec294cb95af2311b17e544a5557886cf09eb77a9cc72aa7470b61478eb833cb8dc71d1f4a6eed9aee2453

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
    Filesize

    2KB

    MD5

    cccd219b56d10831feae421cd940f5c2

    SHA1

    804bee9d05a175f0f9fc9e84e12df50cd835c97e

    SHA256

    4da91518d39c11b933b0feaaa92098d5e487ae71e4a17f892fe0f3ce60bdb183

    SHA512

    373eacae355a0e77fb96a04586a061469d90d7930312f9b3e80f1b10c4a6921fce58b38666a952ce2dcfb5451a1d886bc7055cb4f2311db67c16f42f48190262

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
    Filesize

    3KB

    MD5

    ba639f4675bf4c3c928c9dac5712823c

    SHA1

    a08a466931e60d4ddd4e72beb1d22542d15c99a6

    SHA256

    a37d5a759cb80cf56aee72f80b62c8cfc0a780c16a2d40f30fe9fe21cc812134

    SHA512

    d315dc5455d1a1dae5d0973be2e14abd529600ae73a61f50d7c6d16fa06499d7b9146f67aa1f160f5adfca817f57c3dfd7591ea4e5ffa5f7e507ce936120e172

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
    Filesize

    2KB

    MD5

    c08cd66386d312c1d5dce463c4408c0b

    SHA1

    ced310a9d83884ced55424f7d629315f80d28f4d

    SHA256

    daf754ef92de717c9ad20938d1b9da7383d14860e36807cb76957c0013c3f308

    SHA512

    6beb7cadc3f656d0f4a6280a54f529c1dbd051b38388884fa5e4a135195e6d6b52e85de84e1a3de3ab43e90c365f0c9fe4e580f308c5248a45037f6c9ec007ea

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
    Filesize

    5KB

    MD5

    75eb76617d42e47ababd180e612a5f58

    SHA1

    d9f556686a1a40affb72c5b802ad198cadd72d88

    SHA256

    601b64c6356aa6ad29386b43c814024f9823ff411538c068d86936966b8d6a9f

    SHA512

    048cf509c4c18a64063c42a4a4d5ed6c663211a0b6202cd0fde1b6877e840fd0314e300d722ad4049ffdf66fc28cfd99ce82e029f91b5fbf00d0f2012b2ae1cb

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
    Filesize

    1KB

    MD5

    422d7d5a7af3c732afce5c1a672a84ca

    SHA1

    baceb386cab461c811029bdd69a118b09fbef1ea

    SHA256

    4eca47be268d043e74f7ced5115b673a1d034a3ff326f1058fa38c439aca0fec

    SHA512

    e14ea728c6494377ebb36dbf10e3155123a6e70b5621f833855924e71783fe7c277a82b8ed0beba9afeff9bd94e58212fc7a8315fe314449bc27d17e7467a01d

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.fantom
    Filesize

    10KB

    MD5

    caf440e543dc23ec24b9173b664c63a9

    SHA1

    803c052da42fb0e78206be9d39fb7b69d7bd155d

    SHA256

    0bc2383fd6d3e209703573bb0a41168b7975782e924f2fdd4f0f274af7f8f964

    SHA512

    796e07ce4efca1526bba22168e32a1e4f6c3885b1beb1b8a2f583f0495b687da748e66c509f3daeb1d6163f444dba36181dcd3228df554603a328b4bedebdacc

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
    Filesize

    3KB

    MD5

    37a7cb02230cdcdb9622e07b104d5fc1

    SHA1

    b2a839f51fc2416f32ed6da48d6505f9afa2e6cd

    SHA256

    00d4716c80a50be453df023a0e2f3859519dab9d24369fb59d9b89f232f1ca0f

    SHA512

    09e301743fcd9d933ca030c69ed65f3f4c8fa8a62eb93682e7df87bae1a4127050252691dcb6979219c66cb66199dba5a509609c1c88267e45ddf21ce2f1481d

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
    Filesize

    176B

    MD5

    9a099a04dbb5093cf2e4c8195a31cbd0

    SHA1

    f5c04e8035bc8dad1e3ca583c0c05bebd908e5c8

    SHA256

    dcc8f8a94b7015dff61c906979967ff36cd8a238f16412d3a7131eae38552503

    SHA512

    19e4eb50bdecb3c68c2ec893a4622a28148edf9a56a00c9653151b29e3ac8d098c0b3df2a2239818f54f8d1f5646efed03a0a6eb3246bbffe82fb30a1c908893

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
    Filesize

    1KB

    MD5

    623c39e335148a8cdf95a56d44bc6fea

    SHA1

    7db56fbfcbad47de74c93aabe30b5555ea3aa7bd

    SHA256

    838b58e606eac5653586e4c2c5aec5cfa7dcfd182b165320a51fba6fa9f2ff09

    SHA512

    de183b8c53885f908b4a41bb052d3e20d176063432d43d8c51b695005e599a7782c0756082249bc0a995ab6f897721ec87098216d79362aaa0a2d1fb8686ed46

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
    Filesize

    3KB

    MD5

    d461c17d93951b35bf9cce0be4472cb8

    SHA1

    b4553757d1050ae4d97e10b19560a7d14fdc0b41

    SHA256

    cd42fd6252c4a96e02e0cab69b74285e8772b4c54b94665ab9318afe4955244e

    SHA512

    85a209ec1f481ece7195bb5aa1d872dba3ce74252bb1a3551b8840073a3dbe3e5a6edf07fa504c376e92a8b25c2f719585e3164c66c283036e34ff5e4b3e7276

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
    Filesize

    1KB

    MD5

    9311e412a97a3ff73ffb77f886003b40

    SHA1

    f4a856e2496ee6e9acdbeae182bfcb0eefafa78d

    SHA256

    edafb406e467e7086efc16ac73499fd7e2c824d803480a642542cb60ce51d8d0

    SHA512

    2dba720af70085ef0f4a6d08a660b4e90e7a84c3ed282f8d6541c1e248cb574d4e6de1f523ae4e1e8ae1d5a4948bf1e419da210db8f5f199b9d4a1a45936e096

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
    Filesize

    28KB

    MD5

    c97ff708395a851b5207c6cd2474b900

    SHA1

    cd15407aa8e03da3532ac68368eb1d054a3d7706

    SHA256

    09a7734ab6928fce974fc23b4e90f585967ca4d54e19fb04e9cdfa43e0e72a92

    SHA512

    9843c4d28ed4106f43d9117540c1d9ce58e38e02338f1bea430818af79c643709bbd004a55f3239b25fd8fa9618cbc9a3c880ddb0cb616d51570e89c9990c9a9

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
    Filesize

    2KB

    MD5

    0f6e2ba34550e408954170862de8513b

    SHA1

    999875a34163da8ad9930ee3444d2096f17a2529

    SHA256

    1b7d887005962ad3a3dc0a5e8cd077adc618de14f4bfce1209bddcba2f0bb0ce

    SHA512

    8ed7f750440a14563b813985024bad2cc6bc81a8f32b6928b701b228abaa5c7630fe24905f320f5eddc4023cca9bc24d8edb0d329e1596cb19bf4cc608d3882d

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
    Filesize

    1KB

    MD5

    25428bcda3ce75d543f9cd1cdec416d8

    SHA1

    212cbae73e99b18959d7bf12e38db4986b765ef7

    SHA256

    e84f185e744e0d0ee5ec6cd258001ce1bd08dcf3376096da195448b49c9c4046

    SHA512

    7288c6656bf801af2ecfdcadda5b271aacca2e9aa8401e8b8f5cbdf455dd08df521533bdb3648025ab5e3b5a0cbbf96062dc81679387db70ef24af4a0899f534

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
    Filesize

    2KB

    MD5

    66328b2fd8ac94935851d8375edddc96

    SHA1

    31fc90b049e0ec17806bc9ea811f3fa7e89fce9a

    SHA256

    97a507c9ad52ac59beea6a7cc6431d4c5617721210084118970de3b55520b46e

    SHA512

    bc690b154561568e9c70ce319b6d072858145e48042055d94416a143ae61e46cf216b21931ff4ca14055e9f34403c692d58704b06e49209b264418310b10f14f

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
    Filesize

    1KB

    MD5

    b610518bf8eae6d085ec14413a342eb9

    SHA1

    3a73dded0556ac05d5028456652d741d38eb4c09

    SHA256

    e9297d9340614c294289d6230905c234e70994f2fa32cac8f6974d394850c985

    SHA512

    d841a50b5911544712c74ffdcda8794155e4f1ec486240442f2670542ced70dc72d1e316a8e3bae2977b6fd0b783a11d927642cc8ee90df7489a7f1780d3bc36

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
    Filesize

    1KB

    MD5

    ec828038db689920a96bf729466e7d10

    SHA1

    95ce4b2639b661482f07a73b2abcfa52a1916b55

    SHA256

    aa8a425429006119755bae39427556f50afeabd26e0ae36906bc50efcb1b7a8a

    SHA512

    4088ef3f55e1aa18b9ca20c0e279100060281bfc19ce3045d05b8a7ddad9ab104be742f506a92391162f42f1ee1716d9d87cc3f75f96b51aa10a18473d486ffa

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
    Filesize

    1KB

    MD5

    c2d44e4310b9b8ab4c96c567cc31be8d

    SHA1

    bfcd952e371bfb8454474b0bb5edf4c1960c539e

    SHA256

    2cc79e874e6a821000c67bbc12cdf7057626d222fc8a0ae1a2cdf7c8a99709ac

    SHA512

    fa0517a5a3dce95196ec76c4bbfae10c17abd7dbe2bbf7e853576ad3ff4b685949fe0b9df7ed656acc1666dcac3d9f2e189e917097524dd647fad1d9d6f79b16

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
    Filesize

    3KB

    MD5

    cea43a561fdae58002fec51a8a28830c

    SHA1

    508b35efd8edac34558d52b5260ed7f6b61dcd28

    SHA256

    f29ff7e9f4c831d218ff1a5cc18eb1a89fb2c9aa13b3b255e34d0c774e4c2225

    SHA512

    1f3d74df91694165a7f387d28589cc92637fafeea8d8c7c02dc5b6ccba61c5aa097e414db14fdc9ea1550d8e6b746260eecfb98af3549640ab7644de6895850a

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
    Filesize

    2KB

    MD5

    af655a56a67dc0f59e203027ad4b706f

    SHA1

    9494868f531f7794cde87f1c33fc1fd07d44d2c8

    SHA256

    d7b511a150932a4d1a83a63705ec5bd2f674864972395319a96a3a06f34e94ab

    SHA512

    8603836f98c743857b175c36affee39f93fa6e3c7dc8d8074e70eb2625d6bfdcd3508e43ea678cc144e608a1776421d085e5e50f32531bfe3ccc7950a3c17170

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
    Filesize

    5KB

    MD5

    a8f465e5ba0056fd06e18a5384d1e158

    SHA1

    4cafa95b4ab0ec989f909321082beba6f2a0ddb9

    SHA256

    34632fbd93525d94b7e22a20b9088c02afe7b78e41fbde22eb31c48e93c14e55

    SHA512

    d92137c81bc7260acc934f52b3c2f3d341b8e1bb264293b69fa5bce0621fe1d3298f57d74de6edc89ecde256b1457b902204dfa54729d5505f2273de55cd72ec

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
    Filesize

    3KB

    MD5

    4817a64ccb9488c23108f2200bee6373

    SHA1

    a3ecdeda5f6302dd6e23caa9a72ffafcad47b597

    SHA256

    a52064abb4106d3ade5cdd1a7552cd8d54c4d78a88535ae1ba71fde00b856281

    SHA512

    af28cb10794f99c1f8a8e9b65aa420fc8ac77f9c3365fb9c2f0a94d4e18cdd57ebadbee31e39dda0f0ddf302424b52650a51ee883ccaef9ea0a4823abac74b46

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
    Filesize

    2KB

    MD5

    fa89abbc5418d3de30a6258d827b849e

    SHA1

    413c8ac0cb6f9d8bf06a6150b3d8d715e06df20d

    SHA256

    3764d56443f7d7bb186beca7f9fd7f16ad382256c5ecab5eb4c20ffdf395d01d

    SHA512

    866d5b52b2000008b3259fb7724b5be53da9d4a0443cf25ed3c5267dd4e4d1c11180f792918b8c8354b7054e414c6247e409955b8e849da2bb2c35866bddec4e

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
    Filesize

    2KB

    MD5

    29530b9b5b43a487bc0c87da44ec2e41

    SHA1

    696663e8188817cdf1eb4bee57e71d7c9b3eabf5

    SHA256

    ee4aee7e26938136e82b3c33a8d3eee118b7595f2e1bc0052ff3cb610341831b

    SHA512

    eb3ccec0190c06b0bae23619a1f1c9f429abfa842cc6c165517d12ed9f278244cf12ec24c57912d65ef3d9814cdb6f56c0249cd1e36e7e8853750abf8ee4e3e7

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
    Filesize

    1KB

    MD5

    ce2683a3c5b8d04fc0efd130848efb0d

    SHA1

    a638388b4f7dc25f522b81b9f244d4155ec89cfa

    SHA256

    41f0dab87609afb97f4c9918bd51a94509da889040e6a250b7ae5571688a5129

    SHA512

    86e9c4d600d1a8b589fb219195bebf61b54499fd90232ac7340d0db9b9e2538b6a3781b506a580b703bf1500404c17e629c9ff0b456c91cb658454c3ad4b54e8

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
    Filesize

    1KB

    MD5

    131e8969965eaa94717173c774cefacc

    SHA1

    c20c078ec5500afe7fe809e486ac862d16a7d2c0

    SHA256

    27e697dca6691c4268eb34dedc62d869c9b44af4e1fcf5fc520223efb56d7cc4

    SHA512

    e569fde659c5390c7dee5a40fb5f59833b0b9c3dad5cbc9f49f6870eee565050e627e9c594ec5b5c25918880cb8f8f0e0d6520c73b146293b87a18159634d024

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
    Filesize

    11KB

    MD5

    7f99c5034e4e1b7177440a07cde4c819

    SHA1

    fc96d50474e8156d3db1de703ff3eb6a960413f4

    SHA256

    4c8f4a12fd2d255a882a384f60ad4a748dd2534732ff9e399a42c82cfe617764

    SHA512

    85d952b36538426aad0ae1bc3936ff279c661bf3142b4b6e020993fcf622a6b8d9814acb6f025cc4f4babe55bb0738e0e7e274e48f41f0c24fa6c7e53368a17f

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
    Filesize

    1KB

    MD5

    0c574bc443c0555a416522a0203d8a32

    SHA1

    a1768f5231a767734904d013a8d2f037403355ff

    SHA256

    d0735f62d6ec4dac9ab2c381c4a840463dee0c6867e89b6e6a657c622824b1ca

    SHA512

    e95868575e857a2ad31d54bd13f7f3292a0fef1f521c6546c68df5303deb477c7a99e20d6fa2d6c800d770bd2e5a387e6b3e9ff33a2d5b2924ff37cebcf9716d

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
    Filesize

    2KB

    MD5

    d1e8fdec19513c940de23a099e26b7a0

    SHA1

    e48f07bd9f9c32746cea26f0c9754541519e1424

    SHA256

    c8460b381507bfaabf056dbf601db641c06d89c81c687c8f4247c0942c97d845

    SHA512

    5edfdf6c43510a1fad2d4f0a7e4e5fdf61ff2f1b562c6d4c8e80c526f7f04c761dce8de84486e0832b4ff45e006468473866bf571fad2d4a9a530deb9064a11d

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
    Filesize

    11KB

    MD5

    c01cdececf2df0924fcb60eb93b4c4c1

    SHA1

    8d5f95670dbe886ab391082240c98bf5a2150f17

    SHA256

    3466d941ab3e6644f0820ef8f32f57c4c758d26538f208e43a8af44c9a939e64

    SHA512

    67e53affeb749d1d0b5ff05d2b47eb069c50f9fe1aa3ff823f7fd79f5e9839d4bd3193d88b86854ef72226802e7760b8fa28375e28617b19b0a9df546e198b88

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
    Filesize

    11KB

    MD5

    388b87d832cfd82f2d7d131d12a2c682

    SHA1

    3128f5167a83e740ccb59c23847581f34c74d2ef

    SHA256

    51bb2b252ec62efb07b238c1af18d4975e2047e5f8d830e4a7b20e6bcd3d3699

    SHA512

    2861949da26a8b497f186b75b91b919b23947a2d3f7c89bc82481340d359057f8b0cafd7a1579873bdc706a148f0499ea2f1b671cfbd6546b6c1b137e468151b

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
    Filesize

    11KB

    MD5

    406f0680b6e44eeee9cc8884a1d28f24

    SHA1

    05a9b52c2bcd739101e540a4353c900f8a7987f6

    SHA256

    cb42eb5d21597a058b5608d9622ea635fcf6897412fa1baf59f6713483f5b90e

    SHA512

    cb9983bfdb96146f1c5e9f25695f0cc20c18c7cb8aa1ddef9b3207a3bf3675d04146ea879e0702f08510e6caa59f796c82eb666277d4c95fbf21f3591e28aee6

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
    Filesize

    1024B

    MD5

    fef7ea911c8d8332bdb23ce7a3a50c5d

    SHA1

    e7005af3b8be915fb6c1d0dc823f88faf16bf774

    SHA256

    b6458f22f4514aa800300a67486acc61eb3a5925225c8de66794a0e70d849a54

    SHA512

    40a52d9b5e50c9121d9d1a9c2801227f660fc2eaad1d93a145b2da502d3269cfa474c1e7527e506482777f4fad010501339d8c4aa1e246a2c24c23267de8b3d8

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
    Filesize

    48B

    MD5

    e5603cd9babdd159dd8ce49d06dd1b01

    SHA1

    d5da13424fe3d21d91c40d7e52bc4db1a5509b7a

    SHA256

    75042387b1d6a38f133524f52e1b3ffb7b24a89745117c0b3c6962fe9a3377e7

    SHA512

    04bee2804ba418479ef2884a355ff80898e4cb7418cc193b3a408e03f368905ccaed1f391269a12917a05662a1c120a843415bd3bbc786ff7689ef54566dbc6f

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/3208-150-0x00007FF96E2F3000-0x00007FF96E2F5000-memory.dmp
    Filesize

    8KB

  • memory/3208-1501-0x00007FF96E2F3000-0x00007FF96E2F5000-memory.dmp
    Filesize

    8KB

  • memory/3208-1941-0x00007FF96E2F0000-0x00007FF96EDB1000-memory.dmp
    Filesize

    10.8MB

  • memory/3208-155-0x00007FF96E2F0000-0x00007FF96EDB1000-memory.dmp
    Filesize

    10.8MB

  • memory/3208-149-0x0000000000590000-0x000000000059C000-memory.dmp
    Filesize

    48KB

  • memory/4160-133-0x0000000074A70000-0x0000000075220000-memory.dmp
    Filesize

    7.7MB

  • memory/4160-137-0x0000000006070000-0x000000000607E000-memory.dmp
    Filesize

    56KB

  • memory/4160-136-0x0000000074A70000-0x0000000075220000-memory.dmp
    Filesize

    7.7MB

  • memory/4160-135-0x0000000074A7E000-0x0000000074A7F000-memory.dmp
    Filesize

    4KB

  • memory/4160-134-0x0000000005330000-0x000000000533A000-memory.dmp
    Filesize

    40KB

  • memory/4160-11-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-13-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-15-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-17-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-19-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-6-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-7-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-9-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-49-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-69-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-23-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-25-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-29-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-31-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-33-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-35-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-37-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-39-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-130-0x0000000004BB0000-0x0000000005154000-memory.dmp
    Filesize

    5.6MB

  • memory/4160-0-0x0000000074A7E000-0x0000000074A7F000-memory.dmp
    Filesize

    4KB

  • memory/4160-131-0x0000000074A70000-0x0000000075220000-memory.dmp
    Filesize

    7.7MB

  • memory/4160-132-0x0000000005160000-0x00000000051F2000-memory.dmp
    Filesize

    584KB

  • memory/4160-41-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-43-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-45-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-47-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-51-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-53-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-56-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-58-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-59-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-61-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-64-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-66-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-67-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-27-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-21-0x0000000002500000-0x000000000252B000-memory.dmp
    Filesize

    172KB

  • memory/4160-5-0x0000000074A70000-0x0000000075220000-memory.dmp
    Filesize

    7.7MB

  • memory/4160-4-0x0000000074A70000-0x0000000075220000-memory.dmp
    Filesize

    7.7MB

  • memory/4160-3-0x0000000074A70000-0x0000000075220000-memory.dmp
    Filesize

    7.7MB

  • memory/4160-2-0x0000000002500000-0x0000000002532000-memory.dmp
    Filesize

    200KB

  • memory/4160-1-0x00000000024D0000-0x0000000002502000-memory.dmp
    Filesize

    200KB