Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-03-2024 21:38

General

  • Target

    ransomwares/Fantom/Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox fantomd12@yandex.ru or fantom12@techemail.com </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>B5ytiqAPYXsKisTdrC5AfxcNvO9EvCaFT1fwEm25wszCVhmm7uMU4WhUMUxvIzAKK8M/MOEh5xFr1kpOUTztcwy2Jpp46U4ibZ+gig96zH5acapNnGUxOsxZEYzkDmxgx2yQz23euTgj1pZMvv+B0krLS+gsfJs3GFLpymSSL1JQtn09vPww72In+JEFklUrEGinFpC4UfLEHgl/1jvsVXS2INUHBeUwV8kULD8caLGJy/M0kf1UhnfxurgLs0JP1qCThQxSJ4qkOK4muTTVlbRhbqiLBl80QBnFjyRX/16xZVa51I8UvvNN4WWgmtxdAQHANXz77C0CrKSUZS8Mlg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>
Emails

fantomd12@yandex.ru

fantom12@techemail.com

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1019) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ransomwares\Fantom\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\ransomwares\Fantom\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:2052

Network

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML
    Filesize

    1KB

    MD5

    4ae8c726c633a179cbe486e022dd2a41

    SHA1

    dd3b95de43cc20c3a2d25e9125fb75d02d6abb60

    SHA256

    8cc28513856c4d2066de3e55ed66275a5cb810bbf0c4cfa02c6264ab17973fad

    SHA512

    443a8412dfe803d94f448cc9a6b8b8bbe812b7d4f4e172318ae9bf4bafe2cb4339d7bc1bc9ee4d5abee0d09c076bbbc87221251605763ffdfa9124dcedb02b27

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
    Filesize

    160B

    MD5

    46081429c20a81edff71b0795c06c85e

    SHA1

    a3075a1bf99f854ec7fdafca8c4dd7b81b17d4f2

    SHA256

    4880791ede2660df4dcfcf3c299daeea5a714a95e4f9e393576dc7c10e68c483

    SHA512

    f2beb2f34b76f34e67f5c09e671614ad75450428949969ae126b98e24bd3572e4f2ebc812a7492039195c29a3e229bc75126dc230ec164c938699ef2c05c5d00

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    192B

    MD5

    6c8adae12651c72d40bb96c399315521

    SHA1

    5d1aa51f682724575712e2462f516012e4820f58

    SHA256

    86a39bd2be4916e44b84dc8398f0a422eb932a2717fb1c7fd0aa8b6b8d6952a4

    SHA512

    b39f401a2e5d46742924c581569cb12601de48609bffd4d9360ec6b4c61b086c2151175a62aa7485041ea49f6521b1283899028e386205d37a1f70162f0f049f

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
    Filesize

    192B

    MD5

    461a4a7ea678971f1406424f82b52890

    SHA1

    40ee0d2a93807eb468a2a1edb37cafedc6c33dfe

    SHA256

    0e1b187cc981d4854b892f110338e28c159db32614ff05300559556f53ce0761

    SHA512

    71319e3720ce2a5ba838f46ee991f50c4b250d1b4f03035d894c30c42d65def03f48e403a3805cfdde09dbf1616633f3e9cf23b3171c17197a44941070f04b96

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
    Filesize

    1KB

    MD5

    f65878557f7b67b5b2ecd02c9f803a4b

    SHA1

    4609dc668a0d25efb0f07fb2192c587e9bd6b08e

    SHA256

    3f7492c7d115ce27fac7d0c405327782ff12402149b9de13f2cb2adb939fa35e

    SHA512

    eebd0578b25199fdbcb0f358498feadbf7f457ca302ea59247f4daf4efe8517ff63b313b60942c54f7665eb8a2e7116fc37c7b283cdb5ba404fbce1c4d9706fb

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
    Filesize

    31KB

    MD5

    3fb8ee3b2407ce43a41097c5d9edc75d

    SHA1

    6488056142d8be35e2602ce85dc7faa6930175c0

    SHA256

    df04ec74c1e162671afaf6505063499caee5b26c92d2e0b1f1957101e0a7e88d

    SHA512

    2af77c38e9d404f35b1269b576a5e0acd75ebe6eb5a58acb4d53631eb99978949ea10fd842f1a1c755e0a57a079acb00c28b6c3c00f84dbb201d838ca08c8f8c

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
    Filesize

    34KB

    MD5

    0a64918ae8cb3bdb8a66e62ccc1ac198

    SHA1

    c9dcf9f1101efcfd1824424a2acba2a96e476d4b

    SHA256

    5b020aa8bba8b57c9269313f6b94d4b7bdc31d482ecf5671af5a762970d718d6

    SHA512

    4164f23db1ed3da43ec34d52f4bc740f56a74a81bebd1b29688fd35da5c7d5a9b9eccdd4153c6dc521b11e383e58c0317bffb075b9ab87ee882b3c4dd2cd4197

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
    Filesize

    23KB

    MD5

    04f6d16a6c50391069b0730bcfe314b4

    SHA1

    081754a5a34dfa86751941e40c3ccc234072d374

    SHA256

    2f732403b04a47d72ae64f3a7fdc00eb32358b895fe7168099248729bd3cdc07

    SHA512

    b1bf03b7f8cf7564bf0c7ba01558a392963609ac2e5f677273f3a738a7c3515dbd37b9615277062d93b30cdc9d0121b54d04d74f5d8bed563bd3a60d4ec7d648

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
    Filesize

    2KB

    MD5

    92e3a6fc939eb419a7d1b23ff6f45e1c

    SHA1

    5c0466425fdd19482e48ef1a286ee182cca5c9ec

    SHA256

    50f4078d5cbabc1f9f3525f59dd9b86f4e0b67a93554843a39ed6af5fc67646f

    SHA512

    0b6255b7507f35c2dc00c27e382dcf831c7a49b4298048021b7a9651ef7814a884e41f881b378958ea33b6ef1518edb331b3873a6248103ed3ae93088badd0ec

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
    Filesize

    1KB

    MD5

    bb76559b235f8daee06a570d5cb226de

    SHA1

    3d5e407a6390092dab2884346f641189ffdb9f43

    SHA256

    40573a726b6980512147b123916d438b6f333f94f3a7f322d8f25520feb6eea6

    SHA512

    79aa653b40c97694275c0cc1f1b155a39edc26048a1f8acc8b485ac0079ac854a8ac7058d807615c2fec24ad48e9f5680e6b3e828b70a48879dd139ef6cd0e6f

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
    Filesize

    3KB

    MD5

    07b3f76858ed1905ba86f23d30456112

    SHA1

    f069ea08b8742bd5fe0e7fa26a308c27ded44ac0

    SHA256

    831e10ddaeb5f2111f62f6d349537c8425cd19298fd265291667f710f0c0ad57

    SHA512

    32a777b73759f3aeacdac373d6cdedd6075a6cdc8ebaf50e632902a3254b26eb57c0de06b916e2ed56842d3b5938a2714606ea4fb27cef47bb5d8b27962f4447

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
    Filesize

    2KB

    MD5

    407a64cdb67a048e7ac10a3fb8de2fdf

    SHA1

    d9439685637a12e707af1af5f46507fcb4353a51

    SHA256

    aaa7574b4eac2aab846e57c26ffb37cb3ce2b9d7adfc3aba763d14be2192f364

    SHA512

    05d783d360ec2fdc0a68d8b7a74a75d2a54895012eef4f620b667c526514788ea49de182f5ecf99ff5dfccb4368ce68c784cc2268fab1763fb50c2e0c92fe3ad

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
    Filesize

    5KB

    MD5

    81de6f69554e534e6eed2c087fe92fc1

    SHA1

    4be5407b1e34af49e1a02b4a11049b61d528e10c

    SHA256

    889b90db22d662c0e4428deb2aecedba503d147cd25bf90e88c5502698a85d19

    SHA512

    dcaef98c33e55845d40c26039642b2907d4d470a89d47d4a61d75cbaad11ebb61e0e6e7a5d154884408ebd8f74b69d99141d908346a2f9370f29e26bdacee856

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
    Filesize

    17KB

    MD5

    f5ee1a40c8322d7cd4829c79d367731a

    SHA1

    90af4e40bc7838a033f008a22ed9ffbd5f5becc4

    SHA256

    6d2d972d87964cac8c37673617352132daa328c5144a1e56e9b37f655644452d

    SHA512

    d7e9a4eb6e4080adfa17613e07d1ca9c3f165658c502c071d0c61d099d28059557ecbea718cce448e0161e0c437cc1cfc62f8c8eaedfbf929ba6ac0cb45a4995

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
    Filesize

    158KB

    MD5

    11b9c14c6fd01afd2828101ae0d31539

    SHA1

    f05039579329f9f5bc0dac45d4e4dedc40a9ea2c

    SHA256

    c155a12da1855e9c2b77e80730382d72b1bd98e6b4e32aaa0573e28db02ee454

    SHA512

    e56b088b184259802fa97275204c96f5cdff7ea40abf30d09ec7de11b4434a79bf30bb960241344523dafb696105ee4fd196131a58a11aaf8d73c0c3599363be

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
    Filesize

    1KB

    MD5

    18708187b1954772e6a1f01ec67aaf75

    SHA1

    6568434fe03fd1e47252186de5978e2d2e0b9d9f

    SHA256

    3844a6a5abde96d558abcdf7b229f45d806474206c7bf557634fcfc8b4580f05

    SHA512

    7cbe2a145f299dfccaf6d532b09ff1c1bcb7b557f0cc78a6b08fab3c9126b920137c143c0fba1b30c8f0ced1c3fbcc4ba022f41c0a2c5ed7b3c81d203a80d7d2

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
    Filesize

    10KB

    MD5

    5b96a45040bd28bbc18d3db9972be1f7

    SHA1

    8b6997cd1c93ce7b410149909f7bfa7a141d2a32

    SHA256

    8753e03211ddc9620238ff2f2b836786b0a513efa157de252c7f30b7738a1ac9

    SHA512

    b98a692c6c0dc9a79caf32fd02f5c7c75bce6761292829d9b66c82c22816ee8056827fc778c2294e049a30e8939d28ca6d3b83b3104baf875b19468131fb9ee4

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
    Filesize

    3KB

    MD5

    3f3573b276defcf78b4448943b5c24ff

    SHA1

    63ba6bba5dfeb4e3daf3744dcb4beed03dca82fb

    SHA256

    45243ebae52826bdb18b46428285c3a64a95038a3bd54f22c9d6170402dc2aa3

    SHA512

    bf47de9b87a9e02a5954f8d8bc01702527114fe080bb4a2a9ef787abe7278d0db649411f81caa16ac7b11f41d6ba45067d751a9ef1f37fe8c7f598d92afc51ca

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
    Filesize

    176B

    MD5

    c820da5aad3b0b3fe0d2d77a052d11ba

    SHA1

    1b252178488dca723d3143d04eee3c282558fd83

    SHA256

    576e0b62b431d2412b6a851b1cd253d031f7705708eb459b890b639f2f9db1f0

    SHA512

    d25ca027eca6240a205f5456ad3eaac471d9efc5f1f1d1e2cd5800f90831f48ce605c29b61712a3f42dce4ee7d426ed77991f65ad3daef8f1b6db08f8fa1c8bf

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
    Filesize

    1KB

    MD5

    54715d7fc4d502b58161319eb5a928bd

    SHA1

    4e4a190d398617e88516d1ecfda542a8e68b1bb9

    SHA256

    fe54c7a47c350f6abeb9def9e647abd839394da664f3acfd413ed6f1d178f27c

    SHA512

    ec2807a1fadb930dc40ead2ad93cf6dbbe2218f4280eae04a7f8f53c71a4b075df2013870044be9bfce8c1c92cb342272054331f91926f623a0febee6e7f5e40

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
    Filesize

    3KB

    MD5

    b604fb7ce9ac7f4e16f8c9bc36a2d8cf

    SHA1

    3b8730bb0d33018a6e5427a2708562f4b9bd4135

    SHA256

    f602d6d9e6d80bdda64e0fc45c8a623e2870a946aae324e61ae49f3934a4134d

    SHA512

    d030f6a6d035515a140d13b4cee2a60c6476454b3968027069896ee79e49a17cbd2dd2042fe23e9308073328d38986103e07b9d9efa964eb18b2b16565a4fcb6

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
    Filesize

    1KB

    MD5

    535827ebd4b25213053af278768d1865

    SHA1

    849dfdebc70bcd3d112cb7cb1f0505c126e69b15

    SHA256

    83b5d4978b39c1ebd7b6c147d153bc81d94d90614d17df3d82199c98beb04de0

    SHA512

    ffd7f39bc2ee717b891eb6ec98761eb779c937cb6bb004094ee8481367db31cd8051e07f03eb87b0a083e852f50a6a1cf80685403b08b648cd1c5ac5b79c8d2c

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
    Filesize

    28KB

    MD5

    5df5d7fbde562562ac806a566a4a9297

    SHA1

    b575c2aabe98e3dd9b617c8a808426add41c0660

    SHA256

    8c4501a4514f3fe9718445bf182c04b105201af503548cd92871cbe46641c2b1

    SHA512

    15e190dd38ad7670768bd89d53c47dc6b9c3a484e18dfbe3dd69a2b13c2f14f9d7438281309db50da6a90d088818d87194a3bdebcc15c42a3cc6cbfc06fd0925

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
    Filesize

    2KB

    MD5

    cd88de7aaf7f9f0fb9d1191fa206753f

    SHA1

    b44bd688f7e9721358150df2e0f76e40ff916c68

    SHA256

    34604ba9f904774340bdeb9ea196f23358f280a8a16428ae5ed84aeae9ad5c9f

    SHA512

    ec6ef6c977b9afc82769e8621853c9bd752dab35f9e073488f4a57a86f6da3bdc4307d97aeaf86c1f2ff6ed3fcc2978d9c93e1257920135e25b37c33497b20ca

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
    Filesize

    1KB

    MD5

    912e94fc3d7193bdd318be28e7bb4cc5

    SHA1

    8d0efc82c77d4f26b78e2fea5d50901ed1de42a9

    SHA256

    004ae9fe62c603cb9d98747047bd669f9c5c24e13c54f992cad3cad812f7acd1

    SHA512

    bb8e2b2580721a90be9a2c7d798a517a2375969deaf88a9cf9d71f2cfcfcebda91ba99a95bdcf4dd932c74702bd68403476d9bb0c5500f2f9d2f0b54955bca8e

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
    Filesize

    2KB

    MD5

    dc3a7f39d9e3ec1cb10f80031131d5ce

    SHA1

    fa46b2781e8d6d20ca31c1dc32255d5a71075ddd

    SHA256

    53e4842c8d50203906a376ae8e5cd64faa60742e0ab0e0ebaca61f1cae4b3238

    SHA512

    97dc923d883cf12ea064ba4814422e7a842df7e12c2e30297c146c3c0b040edf52245ce3c4f8db49f1291f20819575bf235a8fcba5c5a465c1edbd86b11c7226

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
    Filesize

    1KB

    MD5

    86bde7b215ad98d8e16fcc8a37bb35ad

    SHA1

    67f09cd3ffc86fe8584fafeaf7d9d278dfe4c866

    SHA256

    efb5297b573ae9b6c6d36239c94314a1dfa50a381692253599e7b7d73e2acd77

    SHA512

    53291e421319663060f638f342146edd0d8440bc24f61435c03bbb85356e511e3eb9e943c2ab5f7c29399f76ce4b954f46fbda782b76580ecf1df6ebbbfcdb3b

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
    Filesize

    1KB

    MD5

    6b27efe3910e7d63bf34441fa873cc82

    SHA1

    1ef4bd43d110ec03f0af1baef62b26c1aee134c6

    SHA256

    4b58a6d4e06825159c1e70a1e5056859c1ee67b86fd56cbcbb25358441e7d069

    SHA512

    506541aea50440592462bfdb7cfc26253179129435dbcf4a5e41fb1cd1c7089be9bc731b9183f36ff028be4e9429b2c192de44cdf83a20d3fee3ea42e346c05f

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
    Filesize

    1KB

    MD5

    02120aa4f42b57c28a36e6e22c438dbd

    SHA1

    501b6f78375ce99ba764612a8b3159303917c85f

    SHA256

    d806fddaa571d859517b2b18af18b7c4165f8aa2cc15ea49999e599f60cc4873

    SHA512

    b29f045b87a9ebbeb4ccf7829f49c28de064efa54122f6507ef7be2b6f3097b5ea15dd4ae427a0b6fece21df4f87c5a64985ba07741be5f1012ec97cb976e27e

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
    Filesize

    3KB

    MD5

    aa7c2871d5d1cb11801cfc233e4f53af

    SHA1

    4cb9ccfaa025ded8aed143cb48cf660494e28553

    SHA256

    8c6561e70a2aaa2292365ca612fa7b85b222acba8b4eab25f9df94b031b3a57f

    SHA512

    e350d0748b3416fc10d354b29e69b66c76c0e19d56c91f5f7d82de1e7c233d29b231647b95645dc83be6d97e3fda80a47c68d1563b374f42e3dc15f2e7388e99

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
    Filesize

    2KB

    MD5

    d738d4874d9495d191e226320b508e40

    SHA1

    7b8cf97128cbe2c0dc12520efe0e509583739ab2

    SHA256

    1d5c1d43fcb39351a7ebee016bbbc8e759a1070020a1bfbd74c1b26cfce02b30

    SHA512

    d20c7bc11f86b25d590f9cc34808b4db53ff6e57f6cebd34b9fd8c208ee0e747b2d9067671c64d0c383ff64ad0b0f8cce6956e7fb0ec8768f3055532965ad976

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
    Filesize

    6KB

    MD5

    eeb66402c74245fb2d69a0a3872ce243

    SHA1

    e540f9459bf2cec94814a86791efe641e1d1ab10

    SHA256

    76bd6782ba44d1beb94e2adf562b503a4fe9e097adca767f26e2f01c97ab9154

    SHA512

    36ee700f4cdc0be6807e5cce2bdf793487b78c5316acb0b1fb9a134afbff5bafe6ca740311567a5cd0075733e918ce5772f67ea9904d6e99a43901de16a289a9

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
    Filesize

    5KB

    MD5

    df3d0e3316a814ff6aeff15ddda3cd4d

    SHA1

    5f55ebb250b83c410ed2c38b63c44de233010bdf

    SHA256

    ba81e652ed0e4f48bdd018b57e07d31895a3a2f4bcc73e72b83f6c1a30a62613

    SHA512

    0154af0587f77a13ace893e53abbe569abfc0ee5d7ed4c2d43a3ce655b66e6960beb9399898481ccbbe21b9f0672108c413e6adc8bbdcbc71c645fbe9fb4f094

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
    Filesize

    3KB

    MD5

    060c69305dff583604f9fa1de0d54044

    SHA1

    f8b8613820d22de7d7b1d2b7ca2e2e05b24de168

    SHA256

    1432952bda25d0d0520353f9fa21888f14a0850f0fae9f70c83c7c40a993cdfe

    SHA512

    4a22a64f7d88286333c0b6e9e79476b4e66f6579daed6c1e931c95d8afc7d49cf915844e271882b6cda679eb04147dee5508435e9e45862effe777b54c97725a

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
    Filesize

    2KB

    MD5

    ec6b1d1aee9dec99b12c155d4f18050e

    SHA1

    bba7d02c7d386b7e6d2a72e9039f00f8eb4c22b5

    SHA256

    cb83b9fc86bad693ae0a951fe5b8d359e0e1d07e3ac963dfea7e59a5d1bb15b7

    SHA512

    82e4cc366503afe63db0c296948fe5ce8522e43fe17cbceea22b764bd4a2385ae77ec085053de3840124a6a9fb994fe4b5f4bedade9122b81a0cb9735e0bb9b3

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
    Filesize

    2KB

    MD5

    06517bcdd107957d6f4731da6fb38b66

    SHA1

    2c35e3debf13a4e33dbf4d656091fca9976efb83

    SHA256

    f52ae25dc6779e3812e361f1784e17c27f8646e300b4928aedceb394991af8b4

    SHA512

    a9ea55b4f3373be68627c916780cd7caae7818f2c799b4ccafdfed4c6a67b6b72fa4199eee6ef33fd1651181f9ed311b9ca1ba43f0e7dba2e505d727947c264c

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
    Filesize

    1KB

    MD5

    941b402d4e77f1dc71909124c8094381

    SHA1

    dd9e15fad133a009447db8c84163b5b858eb8bd3

    SHA256

    a20ecddf82e7cdbdacacce63dc7d44829f4c54b01d3dfce4c600910a44717469

    SHA512

    3101d42d17534d75d7a0870badaeb79c2bf011adbc9b8121f7b77c3abfb949b39ee72c70026595be09d212c52489ce8653b4d19290d0b36dfb904b690de82767

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
    Filesize

    1KB

    MD5

    9c47d976f2b3225a48ef3124fc04a0e0

    SHA1

    0c3e9454b8a0cc5865d8144136f1dd034ddd298a

    SHA256

    ba9035196d7671f5756f97ede0b1e45332f994ea39f5b2cffdeb35847bd3a1cc

    SHA512

    d9eec5f619f6398e592773339313751ea777d90ac7cadfe54976b75dda302b7a355023845cd73eb07d03a20ac1b8f7be9bd23a463c4e55e5d8b45d725187c85a

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
    Filesize

    11KB

    MD5

    1e0cc342b24c854c1ec81333f8e42d3d

    SHA1

    cd2855ab4b9dddf7556bfdb9c10dbf911b1976c2

    SHA256

    c72157ff573a983c104143b3cfddc5a6662e2aaebaf8558399d2c7760372e68c

    SHA512

    3322eb0b55cb33a07dfd160435353766a6b81ca98a860f22a1d9cc094ced7437bec2de2bde7d382bb658fc4f0d064ee55c7845e7ce5de1c1d77014d15b86cc8e

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
    Filesize

    1KB

    MD5

    2031575a597ae6aabcb3fb32bd000ae8

    SHA1

    2e6608a4121dd8e21e317cdc822a4c96b5303530

    SHA256

    c11a8f84efaeb9febd7912c5019c118c05f35f064b7953a119c2f2809ca748ca

    SHA512

    76d97f886b356df8e2d57ffea19e85a38924179b028d1c8c2d16eaa938eb6501adfd1dd5ae41b153f4c434043d33746325dbb765a02ee5fe0ca108ce7dd6a196

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
    Filesize

    2KB

    MD5

    3d3d0b8847268888af55077831b55b67

    SHA1

    ab1e77a0b767040bf34414b7a417d25a3b518663

    SHA256

    83b8f6e7ec66e4774cf83fccce5cb8fdc464ecb1c2568666d8d88acdfc65081f

    SHA512

    15c73f3ac3ff290707bf4f2f93fd58011b3e91b758dc7d810b8830e092f6d2df0cfe6890b46defd4b5ce922a4319cad95284c3d5762c3c1cc59f20a32fe35b87

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.fantom
    Filesize

    11KB

    MD5

    909480ee825f6e75c52ea4b780c3dfc0

    SHA1

    cd6ad594f63ee2b785dc38e58ac01d119797e7a9

    SHA256

    1d3cc59f06fd8f6f85afaad28e95edcfd106ba3f585be3ead412b28011376e15

    SHA512

    dbcbd90f4f1b6684fcc3210dbb1927845d59650278952ee8bb0b7aae63c4bc3809365e68c8015a7e73d126e997968d8de15d91cb715c6b44c793be9b1880edd2

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
    Filesize

    11KB

    MD5

    13243eaab85fb670e765c59e757c17ec

    SHA1

    c06d8ef662b7be0717ee5d416001a9ce2c1c94f1

    SHA256

    1ee20e4bf6f9f9b3cc23664263e55e7babb75e80728fc99e6506feb86f649eac

    SHA512

    4b484beec8ef0f58c282ac7967fcb0449aafebfe6727091d8ed4e4c5856a6728bbd07ac05b18563e619ef0dde2a4099aa8c4241fe786cdc0fd8b78256342dd1d

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
    Filesize

    11KB

    MD5

    6bd72a5c896a084091646931b025f9e2

    SHA1

    a317a0acd370a5181959ac51984de66674a4e9bb

    SHA256

    7acbd56c0d0cabb3de13ba710b8cc56112847cb47f8aa63da1f15f6ff8a32531

    SHA512

    c182a03899520703d9ad5657b95032ce5f6407fd7d4e8aa1c7964ae20f196f9731ddbdd008658075c2a508b4ed9575217b647d03fecec733e0b72c3853d2cd1d

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
    Filesize

    1024B

    MD5

    a53fe6f12e908a783e42c91dc7fa281e

    SHA1

    8fe9116de29bcc2192e5d493594fd38cca278543

    SHA256

    8220e78611d32a9a7c5217376121b955631bc52ef4b9735cd6a9ca085de6fb2f

    SHA512

    5c77e5f3677d04383f41ef24513a5cf061f743c8b334721f0101e713fbb9c2ab2f5a4b9cb8fe23dd107c4b94e8bbd2ec81fab00de31d52a04684eba434993904

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
    Filesize

    48B

    MD5

    49509ac0e8d17a4e9b59258be4f8905c

    SHA1

    48bd345553698bfdabfa63808344dab2c3a98e62

    SHA256

    107c3736df497f04a735977ab2cdc3edaf29e42da5a79aa4b2d502f601774f2f

    SHA512

    3ec225e4431d60cf774721b27327e8ab2e2feb382b1b4f55754a9fbb38946bfa23875c53d4c9276a305eb00f1c5c37e7a20a43d2e069a6d6bc469d148a242658

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/2052-151-0x0000000000FC0000-0x0000000000FCC000-memory.dmp
    Filesize

    48KB

  • memory/2052-153-0x000000001BD60000-0x000000001BD70000-memory.dmp
    Filesize

    64KB

  • memory/2052-2326-0x000000001BD60000-0x000000001BD70000-memory.dmp
    Filesize

    64KB

  • memory/2052-1479-0x00007FFB08C60000-0x00007FFB09721000-memory.dmp
    Filesize

    10.8MB

  • memory/2052-152-0x00007FFB08C60000-0x00007FFB09721000-memory.dmp
    Filesize

    10.8MB

  • memory/2080-44-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-132-0x0000000004B70000-0x0000000004C02000-memory.dmp
    Filesize

    584KB

  • memory/2080-136-0x0000000004D10000-0x0000000004D20000-memory.dmp
    Filesize

    64KB

  • memory/2080-135-0x0000000004D10000-0x0000000004D20000-memory.dmp
    Filesize

    64KB

  • memory/2080-134-0x00000000748C0000-0x0000000075070000-memory.dmp
    Filesize

    7.7MB

  • memory/2080-133-0x0000000004CC0000-0x0000000004CCA000-memory.dmp
    Filesize

    40KB

  • memory/2080-38-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-131-0x0000000004D20000-0x00000000052C4000-memory.dmp
    Filesize

    5.6MB

  • memory/2080-130-0x0000000002510000-0x0000000002511000-memory.dmp
    Filesize

    4KB

  • memory/2080-129-0x0000000004D10000-0x0000000004D20000-memory.dmp
    Filesize

    64KB

  • memory/2080-68-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-36-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-66-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-62-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-60-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-56-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-58-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-54-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-52-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-50-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-40-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-46-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-139-0x0000000005460000-0x000000000546E000-memory.dmp
    Filesize

    56KB

  • memory/2080-42-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-48-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-137-0x0000000004D10000-0x0000000004D20000-memory.dmp
    Filesize

    64KB

  • memory/2080-64-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-34-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-32-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-30-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-28-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-18-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-20-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-22-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-24-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-26-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-16-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-14-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-12-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-10-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-8-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-6-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-5-0x0000000002690000-0x00000000026BB000-memory.dmp
    Filesize

    172KB

  • memory/2080-4-0x0000000002690000-0x00000000026C2000-memory.dmp
    Filesize

    200KB

  • memory/2080-3-0x0000000004D10000-0x0000000004D20000-memory.dmp
    Filesize

    64KB

  • memory/2080-2-0x0000000004D10000-0x0000000004D20000-memory.dmp
    Filesize

    64KB

  • memory/2080-0-0x0000000002310000-0x0000000002342000-memory.dmp
    Filesize

    200KB

  • memory/2080-1-0x00000000748C0000-0x0000000075070000-memory.dmp
    Filesize

    7.7MB

  • memory/2080-138-0x0000000004D10000-0x0000000004D20000-memory.dmp
    Filesize

    64KB