Analysis

  • max time kernel
    151s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-uk
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-uklocale:uk-uaos:windows10-2004-x64systemwindows
  • submitted
    03-03-2024 13:53

General

  • Target

    Ransomware/Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox fantomd12@yandex.ru or fantom12@techemail.com </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>ZfFx5Vk/M7QnDhi2PjsQLe042voGnBOJb6MGrt6UcNm1vYhCrwid+YyuQCuPN0YqJyLKF2lIqbbtClXOX53Q/+GxmL4F9xAPnKe5t4Vze0L6kh88umswq41otLvqYCWNms+XqruoNfORCL0fuhWNevB2UrPRlxHGM5qiUpDJBfTzdIbG8Kn82yKQUilQ5NJDHBGCvqTPgPKn200gVtf1UiZdwwNa5rV1Hl2YUgZO4WGfa1PqVFGWHVpIBOGsoc4GGgAQU6CKFIhrOroQyeet49xypjOREzfeP1kiews8gYtchhulBHzPHD7qnCwfFRVLALruL8QeufZ0+kVU8Q5l3A==dWstVUE=</p></td> </tr> </tbody> </table> </center></html></body>
Emails

fantomd12@yandex.ru

fantom12@techemail.com

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1019) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3432

Network

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML
    Filesize

    1KB

    MD5

    178536a85187024d31c5498373cdcecd

    SHA1

    41b6480dff4f016407d89413a5e2ebdbbf607347

    SHA256

    428c220581a3ccea8af5a73ec1b8e94e8ee5295e408513ac6059fc2b6f80f3b3

    SHA512

    b55b6904534f612aa2db21eb4b676e3b13af6aa1e435a9d0cb016c7828664c3b79f57cc5df1c45e0cd7d512a3db69638b01483302dd858cbea25903562cbbce7

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
    Filesize

    160B

    MD5

    c785d21857fc2a64c15e89d4c6706b5a

    SHA1

    71dd2d9f8c710caadd415c171988fd94999542cd

    SHA256

    4f45fbe1e00b887f0c8103b95279f93e207354690b9f2e6f5614e17df74eb0e3

    SHA512

    832f7803c6aaa17c330abec303d0304a912c1fbe10e1f682dee44442562f6694f692af4e4f235a3c63be3d9a316b8afc46e88a4fd48f2a562823144b2c76b3c9

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    192B

    MD5

    57c30483f3f797985aa38c27401f840e

    SHA1

    0366ed25c59b3e1107a2203f41e7a2fcabde8201

    SHA256

    321162e1a4db63283ebd2a5f5caa5dfa620d06b60868f6c3e8e1fad87fd5c646

    SHA512

    cde6671344abb040fb49ff42b8e2fe5a7bcef2eacf0b5907c0467094912c2e33e3144f60a9b6de864077c5f8105c6d19e40f69846ea3250f8b6b5dae4e55cc37

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
    Filesize

    192B

    MD5

    11b8d1ec826fdce1310d4544f705c366

    SHA1

    ebb4e1c7cb5b79e7293cda88be6c4062f92afb8f

    SHA256

    3d6b4ad0f8befe0b3aea5de75c1f586a9f1b39d3fa84dfaa8bdbbc366b0b85c4

    SHA512

    45a4f6f6f8114b1bd50bd3feea9287c7fe6a995caa56ad19712b8ec4befb05be82a25cd941b8215410ab762ccfcda6d5274871b336d7ffb138d63cd97284d360

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
    Filesize

    1KB

    MD5

    8b5e5a9ac679bce97c4932de2cea2b33

    SHA1

    6638a3805fb0db5fbd4d513dc75fe108f88070aa

    SHA256

    fbb1dcb18674d7a255a2ff6b75a58bfe21a9ef6834ab96da1599933e5f9921f0

    SHA512

    c5a005d24724d977c03f0707650851487f9314cbd6e744ab5c724e8439845f3b25a0291add7564c109c4f1d82d5c392faea3f7603df1e5ca98cc8fb3e54ad93c

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
    Filesize

    31KB

    MD5

    6e358db38fa42e26ed5204c77fd1518a

    SHA1

    3e2d24dd2ef555dd474aafb32bac65c688952945

    SHA256

    40a6a1efaf3c36d8881288e9ea969861c040349860f4b179e8e4945b2b61e24d

    SHA512

    3c7432c30e0e3c13146b08200aa66dcadcbea216256fbf242e1684520760f3e824f51cb8b6d72cadb7c71033815e28281a15ccf45596c5ccef726d3cd6464d29

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
    Filesize

    34KB

    MD5

    4153d331d29ee857b9f37a187a6314fc

    SHA1

    87af87d9b0de07d806f0e6f65d460c14f3c54b20

    SHA256

    5df11546bffbc898d50094414af2caa0c1a124b8202e5937d86b919fb7f298b2

    SHA512

    90a8dc015f5073c2b726b178c9871c656727f23a67b72f13dd371eb54f5e8ad3ee5139ba7cd3dfd575065a847932c08b1c82e8dd8c052930ce00543cecafe778

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
    Filesize

    23KB

    MD5

    51b6af446956b662765e20d62e2faa49

    SHA1

    cc8095582d6f18d23c2d42995bd9c360866b2161

    SHA256

    f1fb02ceadc478098b61cfac5087454da83e78c87c8fcab39c08759782290346

    SHA512

    c480f6d434cb897ae7c555a46746c885175b164f4f004d38b802c9dc0810cd1f2a3decaa3a9f910430105d47c3043be32276eef6622a1a07a690f48b28edc08f

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
    Filesize

    2KB

    MD5

    6cf70d33b8042ab1e6de5d899f7153a7

    SHA1

    3a0f946a504005d0c540a6fb16329961eb2f4c8e

    SHA256

    53269d3696a6528de8a0f1597a3e11a48d724a65cf507bcb642ed66a33ad95ca

    SHA512

    e34355aa21d055c8df113607ae199dbacbd1dec2770939ed7eee2b0126c70e31e667ca6011adb03d5cce1a1ba780f30b4089acf70a64134a0537559e698b472c

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
    Filesize

    1KB

    MD5

    c7b7e012ccae6bd2cea4d1163bc82637

    SHA1

    bebfbee2df45050749971966f0579e343f7ed8c1

    SHA256

    d2a6e4906e65db41c7668363f24f9e4b01625afaf323508c25d645718a0fb509

    SHA512

    e5c7491bd20e306876e3639a164aee8d864791ab67ded27758fa7e0d2976326c2d607d07f838d0b67597976bcd68c6bf5e2d5da775f613ff4d3e1a743faa349c

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
    Filesize

    3KB

    MD5

    fa79f284d0d2d6bee7b58b199b01fbb2

    SHA1

    63d0dbd16c1750595bbe51cfebbbec8bf7817c18

    SHA256

    900452dbb4d8866aff8b4329c6213ea821d918abf0f55267ca2c2b3c6f7733d1

    SHA512

    6aea703a9b9e86df0019db5ae1851c5f506361ad81c68c766e0b0ad164b780ad33f02440212d4d99e9961fe96d0fa2ec90bb4cebfb185439b12a5713f9572650

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
    Filesize

    2KB

    MD5

    88318e411c9107f4007f014a60f244ce

    SHA1

    4e99100f597311d5a90b3c8eb5334a685fe5f3d3

    SHA256

    d38f86fda70052d1bd7e72eeecba9e835d36daf94ed5f15013747c3fb0db64a8

    SHA512

    4398bfe31ac84f24a6e2e7775a0f4ce73f8fad1d575a32e95cd187e5590dc5d30e0baf66ac1d7dde3c389615b87f8c80a55f4eccaee0a9f0cced5842fd473542

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
    Filesize

    5KB

    MD5

    99e7de1d3979b4ed5f4cc1b5da2ff73c

    SHA1

    871dc33174c0b6acf7eafc2d39ce8c80eca9f916

    SHA256

    fca7d6f0e503a33b5edd01b4c1ffef7b1fa74e3c86486a310391759cc325dd5d

    SHA512

    c35829f77ce0e92265fd0c9558ae01937329165f432e1529f92875e7e4663ae4a0a32901af13dcf4af2bbbd4e2057152d6e77bce0e585a8d6e8e9700a8f98d73

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
    Filesize

    17KB

    MD5

    3da6744025fcd20f9f7356bc569574ef

    SHA1

    6e669ca88419008f97935420a7c49d3d9c425550

    SHA256

    dbb6673795749cd334af6bb08b443d318d597c65176ab389e42f1e841ee82943

    SHA512

    6c0022ea15a2c174966ab4e83e45cdaca7a792bdb4530da21158462e21bd63a2ed2dcc6697d2e69e986eda981092ba43da55118ee8629dfebd952d0318b5eb26

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
    Filesize

    320KB

    MD5

    77d90bc1cc009472deb42584684b3f3f

    SHA1

    38314cfa318ca48eb58c72d4f947fdfdaa75d2c7

    SHA256

    a37b51267bca3543ff03bc39bceb99277433a531d82287ca5b1ab2ba6add7581

    SHA512

    cacfc28265e1ef1932b31ce8c8f8b510bcc4496d3b4fcf48afbd7f0299e6df7ff6796f7851009d3fe46681690176d571a57d568dcee7985192468fdbe515db4c

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
    Filesize

    1KB

    MD5

    c62fbe2284ca75ceea2a374c76425f91

    SHA1

    4faeb2fbd60cdb54fa511139d9dbadb883a78b73

    SHA256

    198cf59ce6236ba222d9241c8d779d35ae8213a61b032dcc6684cf9c41fc3130

    SHA512

    bd8c294561bf11f6413b13c78f9e5f7ed08f267e7155822d64a63082ee292836b608b4819e53171021b08ea9e2abb397783633eb2a78ad5385cc0504ce656cff

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
    Filesize

    10KB

    MD5

    0ff6891b1a85b4a555853bbced985405

    SHA1

    d62cc3aeee642a150f666f2d9ab1e79c21ae1d3d

    SHA256

    7ea86b23ad49fb2a0ff58f0d4e6aaf583f85564eac865fb9392bcebb929c6fd1

    SHA512

    9d33768648a81bde145cb335ec5cbbc8f59fdeb5263d70d3992c4a2b75c755baa22e1b986cceb8a3f2e3f1c5bb25ccd76048aa738002edb7388aaa0f2ef81086

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
    Filesize

    3KB

    MD5

    0003df831ebc7d89ccb561e91214e85d

    SHA1

    6f7931858d6b6033b6929b1a28780ac4ac2f5f9c

    SHA256

    945e474c650a22479e3d5b89e864590db5b4ae4d351bc8bcd5748ab3c4df6b2e

    SHA512

    78036c8b555a74f3846e74cf6067e97bf166bb9dfe452bfec3f5fcad622b72c118cf25e2028e0ea316ef5a89b46605f63a9a05619f23ccc0fd834f524aef2914

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
    Filesize

    176B

    MD5

    72fbf416bf4a20639957dde60fbbc6e4

    SHA1

    9c0177100470d55f522f579240e41b37dab3305a

    SHA256

    8f0543de59fe6c9795ad006d29f977f01c886974a7e818fb0a1b44aa3cffd24f

    SHA512

    e3d302b4125006985323efa38ff7a73ba14b74e31daf97fc44382d492fa3cfac1d60b5df7cea7bd542f9153d738bb35ab08bfdf8fd45128d0fadc5121ceaab2f

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
    Filesize

    1KB

    MD5

    c97aaa6cf45ab8f7d71ce44d57b3c1f3

    SHA1

    ded3889024987978aaadd64484c0f8e3f33d6b60

    SHA256

    f7946d1f03a9144eea6554766932d4a52cd86051425e72e221e0c117f17e674c

    SHA512

    8aea40ff1efe64d1cf3c71b62697d1ad985be3204bdd00508ae2fc3fbe0586c2b5903274c44119115115c827bef07c9e6b67d9fcd04742a7912b82b1f9d58862

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
    Filesize

    3KB

    MD5

    5b0e22210f2630011794ea1e800fbbdf

    SHA1

    2ee85ba7c6474c6174028f89281763b0993f686e

    SHA256

    5f4d55e126965d7a0a209182330ba4fc4f3d42f3844cd07b80e7fd29cd9107aa

    SHA512

    7a869a0c424b1cef778f790ca4ede18565e163c95ce31e0ba5dd745608ff0312af39a05bbfe8932e4cb5d8870e274dd6d408f80854a3b067fa9a13b335517316

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
    Filesize

    1KB

    MD5

    e21905ded44b3f3d7d4b924ade1f8b45

    SHA1

    81586f83aeaa80e91e49dfe302298b7a8ee7d723

    SHA256

    c8f4473672144fe8ad1763c81838f6ad707be19477531d3a0568e4a6e45ebcd4

    SHA512

    055307c121f6fe2ef9889ed12dbe8e45b085bbdde2773a5a5a730e9c35d23d62f0525f092bc45e3cd7f06e0b2319c2cc7726c45500fd6549905ab399f551a1e2

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.fantom
    Filesize

    28KB

    MD5

    5045c050b9932c63b105e61c256912a7

    SHA1

    ca72f35ea49bf40a27f65845911869c547a119c7

    SHA256

    29a9268c7576da760092b13ce9ce424cd42c411ec429343edbe07f4cd19f8be8

    SHA512

    755af54c9d29a3587990a2f0cb1ddf004c933400d5fa2ad4c14ea8189b521e1313510ae85a49f2755c02e93fc8e1634ca0d3682004acc6e2b5d799bbbb8f3218

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
    Filesize

    2KB

    MD5

    14fd801a823b4e040a3a2c2ab599c8c3

    SHA1

    bceace341f3956f875ac0131f2bf72b0ad022cb9

    SHA256

    0f48564bff8570a615a7d00ba37a3a891823962c1695824d43ba8b2786be939d

    SHA512

    51a0633bc5dffac41615d3a5425bff3c1623c147156ebcee7f03393d31a1a25d61e0afcc9042814db6654e555961db0567643c8099e20f510bbb3258ade92a45

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
    Filesize

    1KB

    MD5

    fb247ee82f171546447a73bf35c0c97d

    SHA1

    8b04a1ac4f876844b39840a900129e54a164c5fc

    SHA256

    46c2a80cc981db55b03a7b678c7ec30b3c72d356259b80cdeac512fd73b51c1c

    SHA512

    c9cbe07085145c559d0618ab5115d086055f46b2504531ed307e05b0bd8626acb610e01a860b7eab325d5373b874be07afa979c84c816052dfdb9f712e406ea6

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
    Filesize

    2KB

    MD5

    804286af463853293feeaffa781713b5

    SHA1

    39d658561510d1e995c97dcf3b1d256dd2422bd0

    SHA256

    b5c280c1d9df0d0b44f91da6a6814f5a66faad3e41495c6875a60eb939f97062

    SHA512

    26098e44e9f6fea73577a99df88efb5c3bd0e656ef71c5ac4eab3078f43b5c2ff3518afd10a028f01078a39260573e589286a9a613b899d632f6d496445f6ff1

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
    Filesize

    1KB

    MD5

    91e23519b7ae22b9c9fe981e5addeb7a

    SHA1

    73531c5a03e326277931b28134e7056173d0276e

    SHA256

    62e62b43106afca193e805167f6f9aceb0d617dcec15d53e65a1fab425e3e9d1

    SHA512

    b7eb93b6b08229691d6162f19611fb40aae6988b38b9bfca3691cf3e8bd127f441a97111ab3db2b61e9a29770c8066b300a74a0c81aee547f5a7beeb3a26943e

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
    Filesize

    1KB

    MD5

    c77d08f5989bd68c30a81ef89bed3fe9

    SHA1

    8287a94cbf5efc954ff3bed206d94c4aa135649e

    SHA256

    371f7339de7847c0d420f635b3e9f46c75a7c3c274430ed7131b38b79e3df116

    SHA512

    b73150a6cb6731640bc2a850ca7bf57fbfab788d842da6073920ad56d7b6f7090a35086319ea0581225bcb5a2eaadbec5909efa1737481f4802ea02427de7dbe

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
    Filesize

    1KB

    MD5

    2ef96de3e606a5b23478564ce647568e

    SHA1

    bbbeb2993180563c74fc15e2d65ce4910ea9b10e

    SHA256

    3196ac2a9e841f8d6f1d660b5c3741d2895e0daf00e436c1c9a3d4de7fbba911

    SHA512

    383ed901fba154af746965dc1b863d3573df01a2f264be35966d67bb903fbd4020dcb1d14612339bd40411e489ebb0cf765046b55878d966a86cda57eb7c6502

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
    Filesize

    3KB

    MD5

    f0dcc3b67b94c3cb273e131922741642

    SHA1

    9b686d74d7fab1f90e67f52e1b0ae340cba47b90

    SHA256

    b703e5fa502eab7cd735817753ba1ec29cf984b999a8d6ad5b6072f4e251f05f

    SHA512

    bac5d0071236b268efec82bfac387209e231f42a3a8c0cc418979484ca18cb57b94f29bdba73d792a2c6fb8512177951e0885d9742a8122222511d4a6af9d5fd

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
    Filesize

    2KB

    MD5

    e00dcd7510e671d3aa3cd80e135edcca

    SHA1

    52de285752c3715f07aad5531c26fd16bd0b89cb

    SHA256

    12f97a80c0af904f4c0e4f9d44510cbc90acaeefcf813eed969be8a83de1e557

    SHA512

    0de6a2c340fcd44ab781ce046bb76552dea42dd889f6c0ca437b59d24079d7cb4baac02d364912df1b7143c3d0767e5decd896dd048db718dbfe580f9141ad0b

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
    Filesize

    6KB

    MD5

    a517e9fcc861ea5b16c75547954348bd

    SHA1

    08c94fb71f95d0eb86dcf74ca3d95165dd100f0c

    SHA256

    96dfdfeb492d3167188772d12410e0a7dd622fb97592119011fba8665206ffe8

    SHA512

    238479b8a0a6bd0af42f852377fcc5ac91fa13449967223e4fde26028137da77db8adb481dabae3766308a81dade5b56b21ccb4573fd4ec8a6728a028ffccb4c

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
    Filesize

    5KB

    MD5

    4ebc77aeebad413291c366bda2afad71

    SHA1

    c2f001e20903c3defff44e8f0374b5e319015c97

    SHA256

    bb05b577610c72a3b3b2371f904a51ce9b0a607c3668255edbfc43b02cbd4ed6

    SHA512

    8c73a041b99345c645886121c64734efa7d42c7dfe52008c58aacf4db3ccad65931c200f9430c4c213cd477b099e9654f0e054e7758f7f1d481b7d76da7873e8

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
    Filesize

    3KB

    MD5

    0c1c67d7717de71983d409cbf5bba1fc

    SHA1

    eb131425f96124dba5e63c399ef1f75abbc4dc44

    SHA256

    17c7e13fac8d75cde46bcb6e592cfa7a62a42f5568cf2863b04ab79516c63c77

    SHA512

    70386f452f0b863e7b979e20172873b46fbd0caaf159a8643a237b5a96934cb76383b5649ef438f0e5b5718defee1b40e7baabbea6e8be035d44ebf87c682f69

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
    Filesize

    2KB

    MD5

    e2f87a3d72863cb558d0aa41be12627f

    SHA1

    dc025fc88e6d9d35f39fbd80652852391a78423b

    SHA256

    35c92a040e192fe68b56d72de025a39f5144a2e5be66c587c0d46ef204da4a92

    SHA512

    9146123df8915f666e915c86b24a5728335278c88d18d7bfdc8a6298d15d30b23a83f6244429cc7954e72742c995e6b1beb2b3d8798e0259691f3203cef14b50

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.fantom
    Filesize

    2KB

    MD5

    7bc51d1dc0e0e223f5f481f4268daf3f

    SHA1

    585b7ed9a0c74d469fd4d569269f964f82ea96bd

    SHA256

    34da81284067d6eb2a2afedca454bf864c9072e51eecf96644325038728f1ec0

    SHA512

    721e56f33944934d2f590012b672a8c88b014a4223f3eefad7422598d564ba5f59dd45a7a9d42b4c40e4e54184a4bedf89be3542f7b088ce8f155ed61ae07074

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
    Filesize

    1KB

    MD5

    5d94830b5fd305c02a0be6dcfc686f02

    SHA1

    2e0f2d4677cf04ea6158aabd1f28e3b694345b48

    SHA256

    212127d836c8da46cc75c5f5c7107a6be672bf83a808773168883a12e4f138fe

    SHA512

    c60f45f85eddce8a6079b5020efe558842acab1657dbb3f5ac6b06e56141a14fd1a154b6177b5a726756ba6e73f4811c1bdbfcac6c89e053dd774915ac18f99a

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
    Filesize

    1KB

    MD5

    d295b0cf62fe5fcd935b5b4534e98bea

    SHA1

    4de622eadc2ea24be411259e21f3f6f302bd7314

    SHA256

    3977aa4b7719a54ffdd581309938a57e1ddfe9746a997107b3cf638c95e22b55

    SHA512

    b07b036714bad6bbef5e71163b5c235e96025b7fa8954976a104879685638611a7ad6cbae9bf7a760ee307ed53b7a877449a8b6efdee6a134bad6622ea8d59df

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
    Filesize

    11KB

    MD5

    7c7a9bf18e7822d7e20532aff7db8961

    SHA1

    5bb3f24b3dfd9f85d72ab36d69c6d48398b07972

    SHA256

    48cb75f1b8db533746ca778fbffbc31b57a8e74502dfc2c63caa77c3cd810e93

    SHA512

    7705543f08a5cac8933fa255fb97405bda448b57e73fdb5fca103c8a6614c18efd12fec827a8c0708ebe473b7dad00a6b94b4bf62d8c43b830f16112f04f51c8

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
    Filesize

    1KB

    MD5

    679fb537caec67b48792e38d1a671cc5

    SHA1

    4ed88bd0009dfb1ffded8bc490fd71e9daca7af9

    SHA256

    9838074c29c55c2e8c59da3221dea9d46224b4ac8484c51f8a9936461f847fe6

    SHA512

    1f4ad0ddd7e3c891114b6b938621f12eaba5215d4467b92ef8335d9649fab6690759aaa3f76032736b4d2001e893e6b59c80ac26661e5317177f0b99e7a80eb9

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
    Filesize

    2KB

    MD5

    c92d105eb03ca039375f1feab199103a

    SHA1

    9114c67757160758382a04a9d3b5b36e919eb9f2

    SHA256

    d56c80261e11194b3461c52e9edf4dfb347478d3bad781bf7ed48cdb8337e2b3

    SHA512

    b46ceb89ea0826bf2e1ff34a2e83ec8b66ba1548dc551ed6f9df906f76d1521649321e82473eadd1879c6c3314dc48d6b5ac04521946c92cfd6f4e4c3e54e578

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
    Filesize

    11KB

    MD5

    39c066ae0095bfaaa5e6b31ca1d011fd

    SHA1

    038141b0784e9f96704b14e704810400cbe9d37e

    SHA256

    79a67203ec7d1100749ba3823e0fcd3be5bcd4cf4d95d6d83321df46918f57ec

    SHA512

    c9e70d88cd56c8d3ce2f19cab29b73d5e49f4b2d19ae1b01bc969cdda3f655aef1f3ecb40fbfb2ea4001abae993e193a4804f9f066f52005cd27b46531a05ed8

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
    Filesize

    11KB

    MD5

    2d75b627b113f07c5594ad5481c01639

    SHA1

    ec44a142320649ca55a3f20bf8aa6da6e7da03fc

    SHA256

    6e5910226dd7cc899e969968415f7e11cd088b35b3ec19adacf0a5645b81e94f

    SHA512

    e35c73a2bbc12d1192574267917cd2f61d3e19dea2427325bf36cf5444b606b7d71d144f47ed82923b75997d312bc33eb9d37c4bf2a12ac3f2e8ad5e710875cc

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
    Filesize

    11KB

    MD5

    2b373229e6c7d42446c4c8ed0d8e0591

    SHA1

    6e8f62355de277f781322156f33326e1914f946d

    SHA256

    9c47aa51498a4552599e48726628ffa7386b4684044399cde218540277188767

    SHA512

    b7ae88aecdf28852ab4af55d96bfd6da8bc8747cd92d4f5a2bd2b43d39eb0b8d2187a10b5d6a4b42931391875c9dd9092f3c1e98bf578b362244e5519f67cc82

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
    Filesize

    1024B

    MD5

    41ec906b3f89542d952e6251130ab0da

    SHA1

    5ddf4afb7f255acd23102340f3c2630de9e027a1

    SHA256

    6e9598537c8da0b2d1731cc88c33bd2a11538f00706724b55b1445942cc32b6e

    SHA512

    2bd61b4bb367952501a84dcd4b6931120dd2f64ff9e632f155118d88e132f663887bd336763753ae09bcd83f224f48d7eabceef25bb8415230c541b5b8a89cec

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
    Filesize

    48B

    MD5

    7a41a266b657155633d3780f4544767a

    SHA1

    d66bd725002449c033e8d407011a2947d3eea249

    SHA256

    4e53a48e9bc87d15f1c4ee7cc54d5413968167806eb4ea7ab6ea9249362d4704

    SHA512

    5941a3e6d9d40ad6da98a63979f604aab912b36a483ddd4988bd192ee5a201887b1ea907750b0f08b22ffe30c7f982ea7d176c2382daadfcbaefaa4fa95ef9bb

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/2260-55-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-51-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-1-0x0000000004CD0000-0x0000000004CE0000-memory.dmp
    Filesize

    64KB

  • memory/2260-2-0x00000000025A0000-0x00000000025D2000-memory.dmp
    Filesize

    200KB

  • memory/2260-3-0x0000000002770000-0x00000000027A2000-memory.dmp
    Filesize

    200KB

  • memory/2260-7-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-136-0x0000000006130000-0x000000000613E000-memory.dmp
    Filesize

    56KB

  • memory/2260-135-0x0000000004CD0000-0x0000000004CE0000-memory.dmp
    Filesize

    64KB

  • memory/2260-134-0x0000000004CD0000-0x0000000004CE0000-memory.dmp
    Filesize

    64KB

  • memory/2260-133-0x0000000075220000-0x00000000759D0000-memory.dmp
    Filesize

    7.7MB

  • memory/2260-4-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-9-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-11-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-13-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-15-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-17-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-19-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-21-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-132-0x00000000053A0000-0x00000000053AA000-memory.dmp
    Filesize

    40KB

  • memory/2260-23-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-25-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-29-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-45-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-47-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-49-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-5-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-53-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-0-0x0000000075220000-0x00000000759D0000-memory.dmp
    Filesize

    7.7MB

  • memory/2260-59-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-131-0x0000000004BA0000-0x0000000004C32000-memory.dmp
    Filesize

    584KB

  • memory/2260-130-0x0000000004CE0000-0x0000000005284000-memory.dmp
    Filesize

    5.6MB

  • memory/2260-128-0x0000000004CD0000-0x0000000004CE0000-memory.dmp
    Filesize

    64KB

  • memory/2260-129-0x00000000027D0000-0x00000000027D1000-memory.dmp
    Filesize

    4KB

  • memory/2260-61-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-63-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-65-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-67-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-57-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-31-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-43-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-33-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-41-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-35-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-37-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-39-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/2260-27-0x0000000002770000-0x000000000279B000-memory.dmp
    Filesize

    172KB

  • memory/3432-149-0x00007FFA953D0000-0x00007FFA95E91000-memory.dmp
    Filesize

    10.8MB

  • memory/3432-894-0x0000000000D00000-0x0000000000D10000-memory.dmp
    Filesize

    64KB

  • memory/3432-756-0x00007FFA953D0000-0x00007FFA95E91000-memory.dmp
    Filesize

    10.8MB

  • memory/3432-148-0x0000000000170000-0x000000000017C000-memory.dmp
    Filesize

    48KB

  • memory/3432-150-0x0000000000D00000-0x0000000000D10000-memory.dmp
    Filesize

    64KB