Resubmissions

21-06-2024 19:37

240621-yca7cszgnd 10

09-06-2024 17:07

240609-vm7rjadd73 10

13-05-2024 17:36

240513-v6qblafe3y 10

12-05-2024 17:17

240512-vty3zafh5s 10

12-05-2024 16:15

240512-tqd3ysdh3t 10

10-05-2024 18:05

240510-wpghssdd27 10

10-05-2024 17:48

240510-wdyypscg56 10

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09-06-2024 17:07

General

  • Target

    Ransomware/criticalupdate01.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>ndnBqI2zMaMH++Dp/rQmk67qxZ7gItiZViR8j875+1IJAdYxVT9Ugm4p4kMxwL3/2U4NzL5NQmpo4fuNeg5GSbCrm4Tyr+wIFU2FBLD79pA40mUB1RSz7S1nyW2/pX2HnQy23hvUgWu8jw7g3XC/Z4jLs8P7P8636IRSXB6Dp/qzgWAL0h6kfrZ4OTwRw6u+Ey+hSbljwrs8FsNRL/pP5U0n/4RYvy4jB+mpUGOC+6MUpfFk0xhOQnImTFCsUGFRroYrn+0/oI5B5tCxMRN+MdgcUSIiz+UgyWPRbb8VrTvAFdrUXbWMC7+X4zpb+1+jol6HGoEaH5sXuGzo3YwUJQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1438) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\criticalupdate01.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:168
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:1720

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak
    Filesize

    16B

    MD5

    53cb9499dbf0fa211925dfff5c5a287d

    SHA1

    c5e02466d77611499d41de6337e5a4f3d377379b

    SHA256

    3a54d0190c06d70dd74f09db17a09d6d838a1d39c997ad4efab0e740a284e26d

    SHA512

    8fcde3c05ca4aa87a7352a88bb93167b2ca11b87183dcf0021ec80efd522acf6fbbfa7c39fb023cadad9d6a3c43a331561a5d3780275efe90c8d8838235f51b6

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
    Filesize

    50KB

    MD5

    f54f809321f16cf571362966f6290cd7

    SHA1

    097e6eff5c0637d6d40dd35bbd00175ff264b4d3

    SHA256

    2ce24c3c6c5bb6db8b0ca1647d703d5d651bdf7a7d88601619e2a9bb9e93437a

    SHA512

    63261fb1b857e06b9f9cac90f7b348e172f78ce58e3de6f13313e7b1c9327a2c30cdd0f941b884ff5bbc4659af9e0ad24dedb6b9b67067ee5cf8df50cae32a63

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png
    Filesize

    1KB

    MD5

    8ff0b52b3cdcf878629678888d5e270a

    SHA1

    45023c524fafc7d53fe4d8d93992873475d21854

    SHA256

    2461ad165329fb9b6d7e5c949b07fc94c858574837b3092a79916da99ccb1339

    SHA512

    6a92dda197534d6c74e3be80203c031ebbb7f364f3b6667697026368e085704c4a5b86fd334bd3b23c830cf42f3c2c87fae11fb85689feb82bceebe782cc9812

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png
    Filesize

    3KB

    MD5

    eba31732263bd9c0bd20b8257a166a1f

    SHA1

    bd753abe69a1d687f49241aad52d00cfc0357755

    SHA256

    57079530693c4c23d3eb520650ef7a055f0a13a046cfe3859b5c9dfa61f2b518

    SHA512

    a75f4c85c9250f892a12cfe6267b319a6cf5760e86a1f59b723a360c1e0621e9ac2b7cd55312154e09c481633acc951fc943be6ba1946cf412dce8ff9bc84049

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg
    Filesize

    720B

    MD5

    2e7fd0117bb1468fbe14a0778135e9e9

    SHA1

    2bd39977963769236fe0dede549f7c5581be9b9a

    SHA256

    704170d4f31cdd988083e13a3580e26ebd963de6099667dc5d4235481a547d2b

    SHA512

    d4e802aefbf143cf5458d71362ede0026ba590d28758e6b36b5df96edbc65c29bfc300976168d5617a5d23e12420404031023a739334a6fdd26893f0fa2bab2e

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg
    Filesize

    1KB

    MD5

    262f37c333d173ab162f50b914411c5e

    SHA1

    6180b4340580862b74869e8563952058ab8dc0b6

    SHA256

    a6dc5bd479436ee51722bc1d1187597332326ed16d3595285f56c1ece41e5f28

    SHA512

    018e35c2f37e33778567561493673a6cacba5175bf61a20f6a7abb37429512ef37dcd9d11a0f40ff1a9caefd345cff66eb4cc697dea21f930fd956c9dc9b7852

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg
    Filesize

    1KB

    MD5

    35cf630000f2077ff8d723307d9c77b1

    SHA1

    89ad740f5ad6539184d09600ae358fb85ffed23f

    SHA256

    c00a0f0d53a26d83196ee55edd2d1fd13f69e70cb80b5f2a257f6f211b0271f3

    SHA512

    c307ff0020d5417ef5ce50330e84cbc94b33b4bcc198143193eac6e8a59477e805884fd2d698cd7ddb0fce65f66c6b3c9b969d9d5136a4739d8ebc93a0d8ec3b

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg
    Filesize

    896B

    MD5

    b742c832f6e3fa67652caf38019a669b

    SHA1

    af9a12557315396b2548f5f056a5aa2b74186612

    SHA256

    c4a12c845b23fb293d3ea7c438feb128c58cbb8d68f718555472c3a8c6e9bdd6

    SHA512

    406822033fc7b3e6d6461bd1cab93a85823083216418ed69df764d326e9a22e57b4011fe31a7f64a6f77d419f25f9cdac91719e2c2bbc75e3bfd9d91756179dc

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_comment_18.svg
    Filesize

    1KB

    MD5

    51d80ab25107ec0b4316d30020096024

    SHA1

    8838cc44c92326e725ecec1349b476c1b4635c4f

    SHA256

    25a72505d4a6946d8e8a3c4d794df8f7e18a23c09d66c5bd054b4cd6dac80dc1

    SHA512

    f85e5ca92661c807d9ffd37c5702c88048a71aefb36ab7bad613d72ba99e3937452cf33966ec6e9bfff1a3e348e100fe6c85e5963e90e113068d8d97fb508b7c

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg
    Filesize

    1KB

    MD5

    e438c44e849a7cc476f2b697936d7ac6

    SHA1

    00ce07f28c454a2bc05b12791c7f36bdb8ea6379

    SHA256

    bfad994f5cbeaf73d5712ba5130ae73acab16fe84a58ee1bc8e90d47c2e2457b

    SHA512

    0389e2e541db949cb5ce298ea0adfc8dba1d59f2a969776a82a7f4b5fd0c59529982c5de977bd866115302c1faaf2bc1cd908a018a49319aa100566772491311

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg
    Filesize

    7KB

    MD5

    92d257ffb9f85edcc96177ff6a5fd9bb

    SHA1

    8b6f51a3a77b3da254ad864a5ada56e3e7ecd7a7

    SHA256

    5ff91d29f101986ed5e7d9497539c39a5089face6ed1d1085c34522f6a30a7e1

    SHA512

    d604787fa8e9d6c2cd304dbb671093daf48e2413ab6d19fd3548c3a42191771ec20198db64917cea7c9499acbd14bb9082ff5c444608edb2da7d6c9636b0b50a

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg
    Filesize

    2KB

    MD5

    02d26a435c3ba29f5ffe31cedb067af7

    SHA1

    1ccd4d38a729d4b48f55fbb62c45b4ea59e0f35f

    SHA256

    34c278364d7ae03cd1c120967ae0806ded59d720d3c25759d2862d0a056d2c06

    SHA512

    fac5da33e6a16c4f49c5d911d70cf44605098f8b1543de109d79357aeda2a03bd337c1bb4ec7cc63bd7ee5d5e3a3e11a4a6ba21cf8b6c05c98b7f7dadc492ff9

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg
    Filesize

    560B

    MD5

    26aeec34ae2a93d73e205ae468f02844

    SHA1

    85f5975c4f2596fc6d7d4690b1b27be5add3ea88

    SHA256

    deb51b9bef0281a93e9d4710502061347f874748a9881b9bd9d0e2114c6faa59

    SHA512

    4f771fc4e941b6ffb3b9c537c775d7fb56ca87ac29fb0c3d28e01c9debfea5b9716649be589f87325bd19cb8f36ee144239807e795690800f669c5d7b1bd5d79

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
    Filesize

    1KB

    MD5

    a5f10eb6806742895a43d0501194ba12

    SHA1

    e83ad8bee0da58f5f5a0e978752fbe12033ff991

    SHA256

    ff6be14128a6ab0a3c4f9bdcb4be3f133598ad92125b6104e0ec1a3856c54dc6

    SHA512

    6fd8aef10969c7b2198f1dae35c6457be2be249bfb4c687b1e17ece28cc0de160e48667c3f480bf61581275499de61212746b87d2434e9295e54b23086dcc7f4

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
    Filesize

    160B

    MD5

    7cacc37cbae2efc89de17a2084bf2118

    SHA1

    88f0ec901d66c0c72df75934c64fdce1e59815f3

    SHA256

    01290ded6d58ff1d1cde70a7f329a0fbdce197ffd340fa29e23b7d5a2379ccd1

    SHA512

    e8aa8b73e98e0e00d704f4f448887d049fc9988f3b2a89e0d06e092f364bf1e7b2a112a1e2c6455137d56d812020c3750554a021470232f40257d32f9de82c0f

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    192B

    MD5

    55402ac9ecc3dd7da5cca183443d1e0f

    SHA1

    b8a96d3f11fda7016b463f2846082ee42cbf5fbe

    SHA256

    cdbfc7473974ba1f2e50e4d8165820fefe9d1fc2dfda529af0b4391284a7e446

    SHA512

    24988c6295ffc16fa095c6d1182779f197fc6555b0db1300150f77755d22878dc9a9e7aa33cc5e80284d666a6f62ab89f321e6b686581201797f879648122d08

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
    Filesize

    192B

    MD5

    b98140220c83be220a9c9b41bd3b02f5

    SHA1

    54a54dde7d34a967d8339df8c78bda867ef3b11c

    SHA256

    318aa3a1058f22e54c5bb021a1530e76c0d790ab6ce0e24d7437f06f523d335d

    SHA512

    5a8f157ea5222d158986ac401f8d6b5041265b2c8ef5124e0894775788265690b0f9e017ff09ec58d11d3e4a2bf8b8742300f90ebe39cde660c01429d625e6f1

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
    Filesize

    1KB

    MD5

    5fb0ef6177ff1a8b1ead84527d4eedfe

    SHA1

    0958504e8e01be8ed6107b5f3802073ca1f08b32

    SHA256

    cb3df76f6c9c0c3b66f6fc512a82a2d1184b425f63201c60ce8b1062de308180

    SHA512

    c0e8b64be5c21b977307b0a0146614db03845e3c77c5e5b3f163c8bc58c88767363b3251b3102f578d3678d7440a939a38e5b0b94bdcfbcd11fcc007787abb50

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
    Filesize

    31KB

    MD5

    bb172cfdccec30c6a3677c80ed1af26e

    SHA1

    be665fcde5a5b750bf6c0f7519051aa07551d596

    SHA256

    2b9e0ada91d1ed9338344d88118f053001a57c243af9695694586738e7fcd399

    SHA512

    fa2b99832285332211be03013c198be8025ef673b68138e8d3b454dbe2aff583c905980a5f0d11cc2371b57c6b013b718b214c7ac55feed5088f39273fdb266a

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
    Filesize

    34KB

    MD5

    63b0964f8478b77d78b97796621b2e87

    SHA1

    3828b20501cf94df0508d510a5921dc5677af2d2

    SHA256

    a3d6aa0524b5fb93d8cb99f70b985f1b357f34756ae4f435b040bfb2f76ab07b

    SHA512

    771264bcfcd493a50a3edc7da82b5b7c73eddc3971521d2d72fecfe22ebd0f0f6640221b86daf48f4de78c0c87b29904c3f8508ddaf1107accc4e84f041265b1

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
    Filesize

    23KB

    MD5

    e0fe898e1e3f90594d17a8ffaa5ab94f

    SHA1

    a7f2fc87e7aeacaa5f7ca5ab9c1aa4698944e287

    SHA256

    f3278179ff3a1a4e6f5c3b4b9211e629ddd9661d77dd14e15da08d5f99b83ae8

    SHA512

    0ba8b1e2e65e243357472954195351ae08e6655f08aa2fc5e012b0219cf9ae17066a0f51b2d8437b231beecc67d1a43de10a9f1c3febab6006cb2737e35328ba

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
    Filesize

    2KB

    MD5

    ff4045b8474e2e43b77c06f8840dd72a

    SHA1

    42e9366f94a009ae411c8220951e91d646435746

    SHA256

    1c1bb319c088d2481e8e901e71f06cf8761251d271edc9a190945735b12b681d

    SHA512

    f6dd0bba16dcebe6edc9a021e562b72826063390f249863f04ebbcde12e12209dd874401829bc316935a7a2c13121de74d2d20fb45865bd5804fe1539d78432b

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
    Filesize

    1KB

    MD5

    a76961c7785fd68a7e4d39d4b9d722ee

    SHA1

    8b6f184f7542e28f6094544e1a0dcffdd5aa4354

    SHA256

    6e6979ae46950ab07e6aed1c2dd48e08e33d552f64edc0eaa8103b78f445583e

    SHA512

    ac33155220283ff4cfa0fc7b4f3934cbc8f8a26fe79169ddcc5acbddda9859b7635e733dae953bf69dbfd335b5a5cf0626713161b67f6f364a770c77f77a0ddf

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
    Filesize

    3KB

    MD5

    c886bc4dd85ae1557de6896e80424a17

    SHA1

    00731959fb11058ac33b044784e809005acf2186

    SHA256

    60ffe9782a5254a93d40289ae60adbbb0bc0bc3844b19fa5af04421330a54392

    SHA512

    86e69c2b424e9d7f6254615ea7c0e6357fdf50eaed1ad9a2babf78c6027bc5ba5c15a5256ce19121ddeea0cabdd0cc6afc3ce9634194b8a0289a2a7928422763

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
    Filesize

    2KB

    MD5

    7694435667ccfe0ace9c873c397a990e

    SHA1

    f9aa7d0f4a2d1d499b25cb505cea2c677499d653

    SHA256

    102bdaffebd13d7f0247457761317dd7bc98a1857de25e2d92b14e11c4bfe211

    SHA512

    4ea44f06276f9a9f8e0864509c6d50c0035cb745210a63072b9c394223397bdf89c49e00596a0f875a72f03853c06ff188df68d70bb6b86f9476d9e40ea0a3ce

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
    Filesize

    5KB

    MD5

    d5a32860bdeea9206722045d00554daf

    SHA1

    c24d5da6b601e0549ef35294280a1d3dae802598

    SHA256

    0615ff47574c780ea8731e0a665f6cdf8a4987f515c33ab743d1bad1cd8de658

    SHA512

    cb7accd6827565da063d9e4c3b2de9f0c3f22059f9ce05e544c2679a9debcb064fd8e19a992ac3ea8eeec90c356d33808266e4ea200f0233799a4045d65fdd46

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
    Filesize

    17KB

    MD5

    c1383a71db2745fa200a3d77a2f1b1cb

    SHA1

    858fdb4c2105d23f16fb30e81768eaa9ddf748ef

    SHA256

    14ef99fa406ac7496e6af83303310caa4577d663adaa6dbe221d43f7937752fa

    SHA512

    1799e2f8c0fe824c961be8dce0c09982aea06db238cc55179e96eca84f8f2203bdc592f0a63d6ac8ad0519eb0fd34e460f76aa533480d815039fa823edad1b8c

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
    Filesize

    320KB

    MD5

    f1334feedafd0caabb187a4bcf90742f

    SHA1

    a52633b38c378318f3eeda42a039fa0575e593f0

    SHA256

    623563c8f28ce7ff11bec3e78e7ff14c8944e3a80fda27281c762ed0c8b26e81

    SHA512

    acab228d0a7069d94982e5820e482b4dbc98a60ad5596ca54c521ad083186619e4419cb94032c682234f2c6b3a05984b43a4d0d55b84bd12fcc6dbcd3f36e86d

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
    Filesize

    1KB

    MD5

    fa051ce5c84ad0570ba252ae6decec4c

    SHA1

    f3426e79a2cd553f2d718548652369d32cf759f1

    SHA256

    2d46783182b18c14402f9e943b356cdb38c051834e21fa3b0a3858ee2d2d0ad1

    SHA512

    0ba8018aa96361379e83ae6cca85144303a3fb84ba4bb0a28c74b52272c76ce88f5d9050e1e191e55e4f706a405960c84240bd587fbf08cbddacaebe68deae55

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
    Filesize

    10KB

    MD5

    7b014d84f24cda7329584b3fc5592be0

    SHA1

    f8b04023b781e9b90691f4a3adda7ae72edcc42b

    SHA256

    520efef74c645f219f0ffeff8dc95835a593632fdc3153ee9a24cb3a8c8e347c

    SHA512

    97d0d845103acd25bb7a6fd085e5a5f2588d2537d2d4efe975efde48bf53711a37b1cd4ae40dee2d231e609a4457642ac0b6c419dd1e328cdfe51c8be44e8c54

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
    Filesize

    3KB

    MD5

    13078b3216c05b4ca2e62d2a281c484d

    SHA1

    93e79492987465342612db59a456571927496e3a

    SHA256

    8defa3f8149beb4961ccc7e2adb26630175cf3e7faa22a33413311030f1b6b27

    SHA512

    ac3802a19052b5c1fe1b68fca7ef12b3ca061007b2ab714b54c470ffa2d871c3b7444195e75967f404e87fc616e00b91cb7684495ab483457d06a14bdcafbf07

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
    Filesize

    176B

    MD5

    abc0264144f013a9dcb8f62fbdeeac42

    SHA1

    acde91fe22829cc5c3bf62e34d722ad6b1db9253

    SHA256

    6e8fed12ffd87df373a36c5b7eba986c78ede2a131e16854450b6d4e3634b889

    SHA512

    5318bc5047e249669a1b89287bfeab3edcfb3426a0b6201265fffbc34fd5ee9a2ce840143f6ba012ccd6a346cf5eca1d59dd1df40fadca79c378db3d0d367de4

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
    Filesize

    1KB

    MD5

    cd0b757f98130819d7dbb947033e812c

    SHA1

    608c85c8a58008d20294dae516ec0539955fb5b7

    SHA256

    0aa9930c11b69a834bdee25f6e18da558041f0605677b5ce2defce96a13ecef5

    SHA512

    228d01286cf6eea5f021211f815508b5f3375369734c5b617bfa786461b99d88d0a8373b727afd25d6b92697fe652e72b90cb89522d10bad4c7aa451f7ed3d29

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
    Filesize

    3KB

    MD5

    992f6b415c3524e76a5ffcd957b90bae

    SHA1

    f13bb3a20036083b92646c75fee3bb2563fac843

    SHA256

    5e3788ef399422f9886e830eb2316bcbc8a1402582f75b84581654864961615f

    SHA512

    44596d4d574540fffcc42012ff4bff3f258160aed1b8258b22c85bd5b604196b9094e8b357016cf1b2b47a741ad0ca485efbf4ff54ef21db7d33fa78d793dcc8

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
    Filesize

    1KB

    MD5

    a572e27b0761b916ac011f990a8483b9

    SHA1

    a085b08b636d744ddbd771deaea2c667880e9970

    SHA256

    4f5291067b0d339db536fecb74a9aa4acc8e5ece3377d5254c0ee3d9178023ee

    SHA512

    4d2a00220520cadf6df22f9cb72b9825513b58b80bc3bec450ae3366288b71a210d509e51ca206595622b491175a3ceecaa2120c6a39a4f6b7eba8d78a32a729

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
    Filesize

    28KB

    MD5

    aa0a3c098e632195ba1536c0906f9510

    SHA1

    b8149f9e6d2de0654bceb3a6b7069b3550454518

    SHA256

    7afcdf64c57337774ef313f692aaf36a207f44bebcb0f66072743f46851fef8f

    SHA512

    1d2e4617011418845fad4a65dcf0cebbf6692be77bc036c5a2761a0fc95d5feda99ad4ea1f4b27bd9186c3ac09043c92404c8ca277a415740be23945b84a2c74

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
    Filesize

    2KB

    MD5

    c59ac6bcdb8781ea2c4f3f8b45ac4679

    SHA1

    f936bf7c3a7e6112f34e98e7fbe3ad80062d2876

    SHA256

    351f369c20d3ed8bc22805344e6e6e556fefcdf4be5da7db01a6d26f236eecbe

    SHA512

    6adb3387a5769bb3317e3ec5677acec7c69a2b110979c6db57e742cdde90341fd76318f7c94aa6a79d57d16b7d980b89f8d9900c62d851219ff8d334d624074b

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
    Filesize

    1KB

    MD5

    f89f058707b1ea90faeadd033585a519

    SHA1

    7752330abb57e5b12047bd7fa3c985b15a169a3b

    SHA256

    ff0b058f1e2dd3247d0e1c2b17f0841389cdbe6d37d9d7eb1e6a08bc2143d683

    SHA512

    8f6c07d3eda1038cae4cbea54375e4930a0c24e77a2b9776cd7dcd3820429597cad3c54e538fa7c312d811beac61c225d9f266902af9cf10d167fd31afc6c9e8

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
    Filesize

    2KB

    MD5

    c69f9cf61ed18c594cc6406d2f7b013c

    SHA1

    95032d41a435d22d35ec8c08b94084eb8c2196d6

    SHA256

    51d5b3b51e0ce1356814ac83d7f89be49897f67da93a2a538e7d94636742a057

    SHA512

    5d87e1f9fdd7947156272d22f56d018244f88e8573f85150a05db2cb5c1d8b4448fe51963b2388c915c7c9a46d8cd56b31cbb1a1e477274baa5485c7bf1c24aa

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
    Filesize

    1KB

    MD5

    19b7dd227fdda55cc0ce16a780f944ca

    SHA1

    b11c1e3925ceb1f73a6e4abc31a34ad57e8917ad

    SHA256

    62523e40fd39f0cb5096241cc527f8ae7004fefa4f790c2497505a0d93813e9a

    SHA512

    d17f3397db5f633cf01e4ee66cbb12f299cfb1b0c626fc1af920cf5a370bb854a69460d61c1174f5d4b8071ba8a02e48c01e10ba64e2e54b6836f97f39465e95

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
    Filesize

    1KB

    MD5

    b029804b3027fe6827747f8e82a311c5

    SHA1

    930cdc6feccdc54ef5f9903b631145d1abca9f6a

    SHA256

    1fcabe79914bcc9de4fc5d87962723637df83dffbaf0f9df4d8538050f6a3732

    SHA512

    a625eb1b8fd2b4ece4274363a8d464621804a5c30fd666ea18e7196a0f7b05dc2a7541b3f071895008e7713a1dce591567cbac5664a1cc572759b4a42b473ecb

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
    Filesize

    1KB

    MD5

    9c259d06f3431e779a7a464152e5207b

    SHA1

    9d0666b275a91dbab60f01942523da2051d92318

    SHA256

    e09a83280060b0b1eaca8ebae36d17e37b514866cecd7bece615893e06178be2

    SHA512

    3da677ec9cf8147653f81c65315f5585feef0f980e6f9f271c4bc52fde85816af7bb412fe6f570dbe065bf5247159ee2b538440ca4ae45686e3997ed9915555b

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
    Filesize

    3KB

    MD5

    14ef6e58fc0ee74b9224b545d65d8a4a

    SHA1

    6dd159ffa94a02e07767f31ab058cb06942c2eba

    SHA256

    353749a79a926c39a1a44dcc6cb08fd78c741f2e476053c819c588bed871d1b2

    SHA512

    a8a04d11d5e253706c3fdaae5d5c81f8753fb17ff9eeeb77e4a7355eed3c8d1af7d2ce2990ce8f59028d63d6e13705791ddb9ba0e5cba81d579fd4fe27c78f48

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
    Filesize

    2KB

    MD5

    0a764e6c68cc2db1bca97c7b0a7a91f5

    SHA1

    32acac5647548a48b2622f43448ed45a74b79ecb

    SHA256

    2782f621c8c83ccdb0d4ee3372eccb3790b88798d7c1116686d3aa8fe0025ac0

    SHA512

    20814b8ddc5599d68935d6efaa4b4911c57baa568085d56cc4ede5639ebfeb2085076dbf0c3bf0b8e0627a27a6f5e7b59752457497e443c91d19111cc0c85545

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
    Filesize

    6KB

    MD5

    487a57110676cdcc6e3db8aedbaaa479

    SHA1

    af913fd4e329bf4750689f4c20d24afb3984e188

    SHA256

    94763b7d60965f9cf8e9afad8da343d673afe77c6116eb487b8d0c8bfa9aa4c1

    SHA512

    b19efe8af67d19fa9f1709a18ee69dee4f00b559a8a78237f7a4509b0b93e1e486b85553e9b1c0bc77b7f9352614dfd2330f7312fea038d5d5053170b0e5c646

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
    Filesize

    5KB

    MD5

    6672f6efccdf5baf998a5af500829c2b

    SHA1

    fc839e1cf6eda311aa187d6439d6d1739fc0fd08

    SHA256

    f9fe67467a1bb373b2c697c3b0347a48cce3a37982c3796fa9e2b495326eab8c

    SHA512

    28e04f7cb82f6e774239da3c3b7f47c5e7a5ea30dbd2fd2a8eb794cb234717e071691adfcb72df1d4e2e1e5b01e22c5278fd93d04cda8ab65cef571f12428147

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
    Filesize

    3KB

    MD5

    0f0ba87933eaa05aa3562acaf4022807

    SHA1

    a85a1146b145f533331eec67cdacc8cbb05be1f0

    SHA256

    4a71b5e99f72651bfa5e16ab50a7300ce03f3a5bd24a95dc0c9c0dd34fe8460a

    SHA512

    ecfb8f8009f78a4e0485a47bfa9fb2286cff430e6b947abf8eacb3817f91d4e1a7b98083291c64362afdae2a92fd837b58f38bb6f1404c05d8d80e9c2b502a72

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
    Filesize

    2KB

    MD5

    16dc551d341630d454989ede2dbce3e3

    SHA1

    8be8d8a44ed7ef9841e10ab9110183c3e8eac721

    SHA256

    842d48c95dde578191d0eff76b625fa2f6d16edfcfb2407418134869de75e4d2

    SHA512

    bbd0efae99aba546cff04d80b8ce23c906907e8091c391ddb96a67cf473bb0df9487e0536991c3f28d7d303399c3bf4c7d870ddbc2853b7bba0d37005d1639c0

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
    Filesize

    2KB

    MD5

    49ac488cad52633c5f9f34290000f286

    SHA1

    c794c432e6bcd3ac18f96f9ee613c65b392ac383

    SHA256

    74c78bd7574f2f3ca846eeac3a240b1a70e0307732ebb8396c9af378471046cd

    SHA512

    46a197ee93cd97da5405063cf7e637e56f3d260a5197bdd4a51c740adfb4addd6d932a5bf5bc278012fa2d7d1dffc5c94103ff03626e8c0138b79b24e5af395b

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
    Filesize

    1KB

    MD5

    0d4f7f3d81188727376e3fe1145d2fda

    SHA1

    dc8e5edd59715cd779ca5643ab249b98962b3e9d

    SHA256

    f72a7a1369a7b7d63edd4a0d76f12d56e3a404d4803e81c01d9b1dc26a185f0b

    SHA512

    5cf4c10052c3b5bc98caee465d73a2ad77269f8644ca0d4014acc5b7ef85c1495351264137882caa59f3141eb9666c0d233bfea07ba63fb87a6474afde207e5b

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
    Filesize

    1KB

    MD5

    0c2353fd658bfc0fb7a85dcf2593204a

    SHA1

    7ac4819a95aec08d82a335f7b51ea5660ce5cb89

    SHA256

    f175e68bb50a42bf8a78f69bddb35456312450d865d0e8038ac90b9a5b49cbd0

    SHA512

    bccacac3c810b6d79168f4617243f8c4343e2976ce1ff8a5ed3af92296d22e07e3801b8ebc4e45a9b1ab365a6f762449a6cef8662178c9eeb9332d45d0d6e2fb

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
    Filesize

    11KB

    MD5

    746140c1fa19646061e27fc2528e021b

    SHA1

    ef787483e249c56a141b04448fddd2f4e4bb619b

    SHA256

    b2db7b786c00a198cfcf64fda0db8f783396ca3bca25d685c44e7258b4b59193

    SHA512

    cf48143b5d0da1dea490c423ed588b071384f64c6d2e2783446aae023c7a776115b84f86e1e10435f40687704d5ed5c9323e45381413bf2ebb98f9b013216315

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
    Filesize

    1KB

    MD5

    9562ef4948147fa78898a069e21ced39

    SHA1

    1399322416f7a363880339e6a09e6019a2979b0e

    SHA256

    700415ec1b25dbc4d0dde0032e236f6bbee2903f45639176601db0454f258902

    SHA512

    88eff69d01ad6f79d922bdc1539722cc1067b7d05d80b876f413ca3a476777ba954d7b619719bad27c53bbf1c38789dc9107bf8517cbb8d2eba80ff74d483a72

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
    Filesize

    2KB

    MD5

    2af827d7648c5e429d4a7c4fb900739b

    SHA1

    facfe267e36eb91d71f2feb3cffafb43e969d5b9

    SHA256

    de37e3afbc743dfd02d40464e4d5031e51e863481284988a3008176183a48603

    SHA512

    0d2fad736d472662f1727a9d01950e06a22b431f31a65365c78028b9e9c6db203eb8611afc8a58f2647b924eaa0f6fa27c20140bc2d35b7f9160b9af62420a55

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
    Filesize

    11KB

    MD5

    1e88292d3d9601a90a9d33335e360919

    SHA1

    757450514dea6784962d3c1773ea2a136972d65a

    SHA256

    2936e76ee2ea2d01e1f05c61ed07f56ba53521eb71c29f6424d0c86b856907c7

    SHA512

    42ba12e280cd99c0490876bdf64bb1654f984e5dacd8fae9b9ee6fe3a2163784d93c145eb4c30b13e4fa7c4ff762553588458a764cd9096cc47308282aa8fc6c

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
    Filesize

    11KB

    MD5

    33f97b6acb6c1752e53cb72b7e3bda4f

    SHA1

    679e06a0fd63a97e1cced0842126515ff15ad5ea

    SHA256

    4f0db33c95457940fc8814ac40135dd622842f0833c70681877f1ff1728b5069

    SHA512

    7e4658b81d9ee632c378ef5c06f3f6002137cd237436c806cd81df50c870c5f6f2f6a04f15c0278f58ada23ba4863e2d510933d46d86861bc04818d1b5f4c866

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
    Filesize

    11KB

    MD5

    7b5d84d04b318480326270e8e9904315

    SHA1

    5937db3d56a8a6dabaf37fb8ee24148c44f21a53

    SHA256

    93c2cb35accdc514843b762199e2116ef54c6f84b715017992a9c22db66dca2f

    SHA512

    055b906094c58fad13a2b57abba9693abad751604b3004d35c75a503e2d1f8b25d89ec7b09f90f0c63f285e6d34dd8a654b16c6711af5db01321b50910ca45ba

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
    Filesize

    1024B

    MD5

    d374a0c65af98e1461a7099efec29ead

    SHA1

    734df0c06da744ebd8b80fa2f1a157e2cc57035c

    SHA256

    468fb85412476cad05ce40af9d070d3cd1087a51419d2d3244f794d7a65b8883

    SHA512

    0c849e5d84b3cab44510a0e2105530092da766fdc4509e6c2c0e09ced7c064d9526284287aca1935ecd639c3c31e6993d0c5b2549216808453bdcb7405805c4c

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
    Filesize

    48B

    MD5

    8c1615e239582ea398f5c8c92b47dd89

    SHA1

    212e4ecc6a8e95d865f9709898f9d058e9f24efa

    SHA256

    f32cda7b57a875e991c3e1f683c24d4a6936d269e18e2c9c5c445038d1448662

    SHA512

    4058331de4d865046f910917e0468d747f1497d558f291830c0c69f501856ccb444771981459962e2fcab8b1d596ad02aaab7a126fcdb310fa7194fbefcdfce2

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/168-64-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-14-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-62-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-18-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-66-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-68-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-10-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-16-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-20-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-26-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-28-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-30-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-33-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-34-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-36-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-38-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-40-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-42-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-44-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-46-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-134-0x0000000073E20000-0x000000007450E000-memory.dmp
    Filesize

    6.9MB

  • memory/168-132-0x0000000005220000-0x000000000522A000-memory.dmp
    Filesize

    40KB

  • memory/168-133-0x0000000073E20000-0x000000007450E000-memory.dmp
    Filesize

    6.9MB

  • memory/168-50-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-0-0x0000000073E2E000-0x0000000073E2F000-memory.dmp
    Filesize

    4KB

  • memory/168-48-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-12-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-8-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-6-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-5-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-4-0x0000000073E20000-0x000000007450E000-memory.dmp
    Filesize

    6.9MB

  • memory/168-135-0x0000000073E2E000-0x0000000073E2F000-memory.dmp
    Filesize

    4KB

  • memory/168-136-0x0000000073E20000-0x000000007450E000-memory.dmp
    Filesize

    6.9MB

  • memory/168-137-0x0000000005410000-0x000000000541E000-memory.dmp
    Filesize

    56KB

  • memory/168-2-0x0000000002420000-0x0000000002452000-memory.dmp
    Filesize

    200KB

  • memory/168-1-0x00000000021C0000-0x00000000021F2000-memory.dmp
    Filesize

    200KB

  • memory/168-3-0x0000000073E20000-0x000000007450E000-memory.dmp
    Filesize

    6.9MB

  • memory/168-22-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-25-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-52-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-54-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-56-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-58-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/168-130-0x0000000004B20000-0x000000000501E000-memory.dmp
    Filesize

    5.0MB

  • memory/168-131-0x0000000005020000-0x00000000050B2000-memory.dmp
    Filesize

    584KB

  • memory/168-129-0x0000000073E20000-0x000000007450E000-memory.dmp
    Filesize

    6.9MB

  • memory/168-60-0x0000000002420000-0x000000000244B000-memory.dmp
    Filesize

    172KB

  • memory/1720-3059-0x00007FFAEFCA0000-0x00007FFAF068C000-memory.dmp
    Filesize

    9.9MB

  • memory/1720-2266-0x00007FFAEFCA3000-0x00007FFAEFCA4000-memory.dmp
    Filesize

    4KB

  • memory/1720-143-0x00007FFAEFCA3000-0x00007FFAEFCA4000-memory.dmp
    Filesize

    4KB

  • memory/1720-144-0x0000000000E20000-0x0000000000E2C000-memory.dmp
    Filesize

    48KB

  • memory/1720-145-0x00007FFAEFCA0000-0x00007FFAF068C000-memory.dmp
    Filesize

    9.9MB