Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    123s
  • max time network
    91s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240214-en
  • resource tags

    arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    23/03/2024, 21:22

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>FmqHaCD82f7MvwGwsOh7saEBJ1sJGWgwVneHwOw6DI/Rd3RM/0qulRVvO7kudyVSxlaiIDhMRYlNcWGa1lRvPudIq2AsLM5V4AJcaji7d9JIwHBlprTw2wWvycjdNzmrlF4vGisxwgzcXv2Ms9BnUv2MBpmuLKs1TdTQI29CDsMnG9IirEqiGQyNEXA8/cdIwjncIpdFKfuZXeNMQ8i0CujQacQzxbiCVekECcz4YpxEK+Yy3AscZquhddctSxDr/+UQMwZimi9ItfgAudQvCFsckmQX6vvYMOSJ6ocnJ4QybiU3OMOOvr5og3H1zH38Lg6vluGu4KxHcJU4V9JXSQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1033) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:2760
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    40806eb06dcbd476034f1f551eb29fee

    SHA1

    a29b7aefdf2e56385841bc67e188bd1d481d0f1a

    SHA256

    993eedb45406e0cc3fd851729375a469ac645dcffec8ea2e909ae480cb7d707b

    SHA512

    e346cbef9edd2280aa3a2431f972f91f6c46a852207ec0e0b0961a034b8eb1326eec44fd82584ec3041c74c87b208a6bdbfffc00724b05bf0d4c14fea450e951

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    a029bb5bae1302d95c037f3f84fbf9dd

    SHA1

    1d57dbdd631c0ea82d5a5195e2ed7b6ba3bfede6

    SHA256

    3cbc7d1f6de10b10eebff46c38579e3892ba24a46b5abc3a8f62eb54619c1043

    SHA512

    d40f55e8c361eb120245ba96d64023b797fcb0198a6f88ec17ef6e72d3be2fc317ca08ada500467320372b9f33b091e7bbaff827c28a4f9f7bed44385e7fb2ab

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    c0c38292a051c177dabab9e2e383f434

    SHA1

    32cac255f4a6e0ae2ca4d00dfa044d72006b2f26

    SHA256

    7c2a25f16775fccae3a55fbabf90f09d66fdf2dd4064ce77da499dc7eaca98b9

    SHA512

    a424ca88b6a366b9d91d7903a4538edc74f9160c21e4a15da21b40ebc1dc99b48d9359c982af5fe9c5698096863567b9d163c9c3f42c8d2b2654cddfab250a17

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    9f6589d99731632475a768ee6f010958

    SHA1

    0a7753e2cbe86fd53f7490b86b96b0dfcefb46bb

    SHA256

    0737c1720e36b057c04a3f8b504c151c4a30ab21715208fd8aa0c0a2916f9a5f

    SHA512

    a3852b40620839ed9520de152ed3c217261d006845468c62817ad0a31fb3ee49ada94b27ec2d6e6f4de8118630d65bd0bed770ca5238a95b9f806543fdf48ff1

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    7a6ef9ec11bf3af8c9b141fa6ddc36db

    SHA1

    a46495f6f1234c09dec834895e85c540a36953e9

    SHA256

    5fc63b4f5db629ee7f04b0231ce915bf32b18c5bf0c0a9a2526f680a3bf7e956

    SHA512

    20a439950e3dccc9fda1632b0b500c42cd941bcb733210150eed079ecfbb42729fcf04f49da221177f168b4b6d473ccd4b33ca9c537ee7e7f923f9555f65ba68

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    c052c5d6ac43d0055cc81e768392c469

    SHA1

    71d616abb803d014f28c4bbaf3e7420493417c3d

    SHA256

    4624eb9ef82f62ab33cbccb1b1646ab847dea2df3a2eff1fd071eaaac73c5475

    SHA512

    7bba204696c4ad50f8eee4d6cc594d96b098b9d37d68090a2c56898aa37088fe155e0ea2e4b8da9dd56ee6be2853a130b2ec97942f24be2a9ed89da8debd94ba

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    9640bff2f04700dde3ee064d14bf55ae

    SHA1

    fc8f23ed8d0e038f8ba4119b597735a8fb75e0ac

    SHA256

    9be71d7e98685657f08950e027b169e45281b1fb80b078619cdd8659e810321f

    SHA512

    332d3711f6c19fdd27a4f8f1f7cf8ee98d05a7800a0021fc56be8638f9c6ef1ed9ffbb43d2782ba0cfab55c16afb13f414224efa96fe6ca0f88edbdfad86798d

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    e57b80dccd6137c1a60b0ac18fb2bfbc

    SHA1

    9ae4c210723ea4b9465e3f8855f007e237fefe87

    SHA256

    882bbd8def01ebafb03d69df0f00eb64f1300be59d4453ffbdc665b3a6f697d5

    SHA512

    26dd2d4da9b7441a6a49bfc1e0f9db6cb067ef95568118e094ace9d99870994a30a2f415ab1d790ff1f82e3ef202a76c1a07b3e6c508aeee0815a003fd4962c1

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    51d3679ae24d53f243d559c8cd4906d6

    SHA1

    4b939e6134cfbfd7d0da4bd369cfef51b91a55e5

    SHA256

    ba6f32dd6d53f7c63ec06ebcb1580bf61ea512df3f5f5e0a42a068d9a7ce9483

    SHA512

    201e0fb3fc4df1aacf55210bdd0717b1b71ef16ac9cf828e8704e92392f23ab4e261ad80a1ef1500ae1afdde4339151bc4f06d48795d196fdfec6cb0352ec7b2

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    559c55fb7e2827d3456f05777b3c3f1d

    SHA1

    fe03232ad3d54ad1eb727b24c2e64206f1a4e648

    SHA256

    8578eea6de348ecafc3a730618c34bb5265a23e75ad9aaadaed17aa49ef21d0c

    SHA512

    200c759ea51ebf6f39ba3892362404f0f5851007130f85f52c2e51fa3c8659044056bab40111221679c7d11fc434faa8e7d82117f653e2fb5e9814a05fefe3b7

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    83370ceaa9fdd3fef464b9e8c85ab6b8

    SHA1

    279f5287419b9a8032768356330a90e802869575

    SHA256

    83330bdbca2a90640123086b9b90846df0190354126f5692815b290cedefe972

    SHA512

    40770557bb1bb69f93b20f31afc11ead47e5a2d4e29b4373ae208f63217da4ac89236d3249715ebe07412fe44367e0b3977e8615eb718d4e8e8d98019b2f5b9a

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    bc22320eb5f3b130c8d5af6fa2f8360e

    SHA1

    4cfb98e11af81a9cc649a6258685397a807a5b6f

    SHA256

    d24ead4bae8c71796f31c2ba0e294f4722400af05ff55667051fb3000916b5aa

    SHA512

    df64023aee4a295e83676985eebe22066bdb8356f70fc9ece9133b54b9671e25e8274184413246438c96cb5328527e825b730eb9a1f5065f6862c09fe21bbf9e

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    1b35f2bcb6f036a28486aa6b98f57d12

    SHA1

    21f3daf021b1f6430117eba10e41ee17e9541b2c

    SHA256

    bcf17b95ce276d09e405ee20c6b4c9fb9f0403726e17e5d194d889a1efa611da

    SHA512

    8963a1b0b5effbc416704a7f790aa0691fa8c2e857d2aaffd117dafc14c17ef00d9e4ccf47452145f8371961897660e1e9048b61f2ddcc2a1933f7d7ffb427b6

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    9af8ac5d980d531940ddb71e61667b0e

    SHA1

    33dfdf11f8d2ddd49704fa640eaf384515788a73

    SHA256

    66ec46c72c84753ef3e9125a033951b5ee8764bb1ef993b5ba018be2e02efd4f

    SHA512

    003f204c0445776d323af048a2ae8d24fae1b1c9db1db623641cb2576cecd1a1f55cb812c0f28e1430ca8c3a3d957349486a5be474a9cca8d164d3d0652d5eb9

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    fc77c056c84c85fb0cb57cd0b2813bcc

    SHA1

    b752387c0e0b4b20c236e762979729f05f6346d7

    SHA256

    b8a54d4db0f463c9bc59a1bbc78e2c24327cf1ab36837ff2081c3d3ae225fbb6

    SHA512

    7fe490cc12e7c43f18ba6f2d3cf2c56923277ddfc1421f39c373bf8953fa72b178a7327efc6a65aae688a7428708bcc1aa0ff7a07fec5cd406401741d59ddfa3

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    f9c5af145ca1810c0701836403ed9597

    SHA1

    7f57581cc21e53946cae52f6799d36c3c467c254

    SHA256

    4990c6aea13f6c2c4dec51058f34ce170670862692d46e9c018a5d941cc77ae4

    SHA512

    acb0b8cb1757acedd2ce8d84052e7f7748fabad608376ed7be442ae845a48ec8885dc340d8a0011e7e2bfc87697f30b7c996163c2cfb8f2da72bd76eca6448b4

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    e94a87e8d7bbf40538c50b117d26d801

    SHA1

    9bb89020af1828a53feaf2fb384fa7e4477bfc47

    SHA256

    a93f169715b80335483d941160ecc5a7aa397638d9578514e621641987eb8cdb

    SHA512

    d66d98db25f041282ede2b587c118d3f1fab99feeeab26288281af43fbae8d4e32638e76f27cc000abdb4beaee27c0b81ec4cc14fba99daf86c182ea1bd49641

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    3884ff572bbdef5bb9301784a4d9b4c9

    SHA1

    248aab7ef2a7bee80909a02e0145746cafd9e48b

    SHA256

    85cff71a4967e437b54dda08f43d5b91a9baa3b535976e00752fd92767b27ac6

    SHA512

    8d75a6d961b507c113bb32fd63a04b8ee7109328438fb952fc8f1004cab2bc704a8256adad004e049f93afbf743ee85be54aff3dcdb89b78035d9ef9a8f4864f

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    4b6beddd1d7a497279132a219894e5ac

    SHA1

    7e30c95e4eb6d32891d1a786a2f5ff06fa689440

    SHA256

    8edb30083ec526a66c6f6c3096bd21f49bcbe73a7a128375a8de450ee2512f45

    SHA512

    244309d56bc31e8d39ed2ca7e78df82389be66831b58fbe2c000ec7cde4dae3cfd9d7db1486354f61290b5f365ae0f490a020f5f89bca54ca803d3ab909afb3f

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    965d21bb4a5033657d6bd597b009d3ad

    SHA1

    598b8406ee4d8d323d781ba33e97abd86cc0b74b

    SHA256

    01a3a34e6e408074ba9f0d448a06e680263b16baf0326fa35a3c8ac52f2497e6

    SHA512

    a46ddca7a61f95c3a3ea84dc64f4dd5073637460c0b2707ed64493549c21d724654ec56439619f113b0a63ad01394bd168d8c711b4754fb87ca35ad4558e7a11

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    4d3a98f400a66e0112cb1cabca0acff8

    SHA1

    6ccc50b547eaef637b5aac8fb2edaa85cd33ac54

    SHA256

    fcb086d2b023c4d07330250f4fa4af3bbc5858b57930c7ce8980864e3a923405

    SHA512

    310c87577d205c80a5555bd5fe828eba3420458f8306030275e1c37810d58678b54e330fdcb13573c95299fba71018e87272d9b8e1936368119290d6e100b076

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    292d952f46f0e0738e71a883ef44fff0

    SHA1

    0420c936f23e225b3dab153d0b880bf113914c59

    SHA256

    e78cfef58f238255ff7b38c82606d50e5b672e7d9e8514f9b1dff84964834878

    SHA512

    bc48ca89f6f37d61643b1e6a81838f4415f19aba9ccfbb16c22df5e0f76c173627b96eb5f018e84b8c387c1e7cb9ea1bfdffb4b9802ac0f6cda1f30297ea9b2b

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    dad8895fe8adca27e7f6ca647fa32216

    SHA1

    53e7dbbc40e812314e91b4c09e990f9b3597453a

    SHA256

    35778e12cf5af85fc780a4ce680d81ab3d37401a9cbb8f4485375f869e29d253

    SHA512

    dc14a6b5ba76bda4daca584e1385b7716f1564c2c19cc2805ad02f5b834ee0e9f3feeebca4f258452a272dc661bb5cef7b14a9ae023d090b23766a3ccb673e78

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    c570da4e51adf43ccfc15b3eaa70c59b

    SHA1

    6f37ea1cf52265e2589f7500aa0a3bd0566d94d2

    SHA256

    ee673db653e135fa574cd8e11609986faca91f6f42d1f93e2c11b69027d4abbc

    SHA512

    09ae1e9e2ff14bc0c569c75adcd351e97b8f2999ba7ae8099aa9a4c453033be3dfa75526f63e1e44545a589b7f24cd37187f5a37f00769d3f0818762f3c16779

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    1ad7b37aa2a166576ec46fa25f8bc78a

    SHA1

    e0b1bd5bcbc7d6d498d23ee7306af04f8d9578b0

    SHA256

    4d19ad9ae8629ef124950cf37959dffed70e1c28e48d979236264e71941f9ff0

    SHA512

    c5561c693b14765124e1171c0da47717280abe4a6ab49be412d508e91b082c3ea220ed1ed1e3fa96a57c95970df2fcc130d5499b34c1a9fac471edd60a4433e4

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    7a014bb4a4eb00f4fe1b4f28a5dea84f

    SHA1

    58fb34d421ecab2f3da2fa741100dab955ef7256

    SHA256

    5e119ea6ad80648d818c1bc4004c95ad5cfb1656fc00751a256699e507c95539

    SHA512

    0358ce59f15ca5c8a243b8d64fdbdddf29d369844f68aebae2ec998f5dcf5572b2cecff48b76a1688bc583d18d56fbaf31698edbed9c00290d1035ff2c4669ad

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    1ac275e1a6c859a3d5ef07cedd680fc2

    SHA1

    296816b800dd57cdb01595b22685ec3906a5ac86

    SHA256

    34112d3e0a17dd62204dfc6d46ff1dfd2011df1bca4a8b5272a966540008a0ed

    SHA512

    a0e6fb16d34e2c39be6658c94070a56782f9d2b8c7764900ae386f9958b91d54437d3f921bf8763a769e7e498ea7c82dc7e15826c5995ab5fed7953b5f387e23

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    a28db1da5f202e849e89fe10aad8aa2e

    SHA1

    24b44d277cac149b65f7ea3debb7cad4e7cb4396

    SHA256

    2a0a1c8d5522329700c80d2abc62f5aa279339ba9fd9bde7ed9d4c9df7957463

    SHA512

    7b8a14b3a311c329b6d665f7fae5e525832878316b32c202d8a5cb4265370a84222526b073e9e5f98b03a764d30704e15e5e3f17a97574f1bb7da632783aa921

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    c6ea2880b36d6e7b715db9826a516e48

    SHA1

    6584b27c6e45f7a3426ef0ca289b8eae2f67508c

    SHA256

    32df28b2791e2c87ad50da5e0dcbac95a3c1a4af260ffe873df97fcefac7ae41

    SHA512

    0f4d42308eb8483b9c6eebc954c88269a49c3a7f4d96ccbb6293cab0d91e937a467e2dd4a0c09172b9610edae9b964c6876f5c0fa782ba9a0bfba0c0480149b2

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    804ffa6c99a43f77d235a40e02279a2f

    SHA1

    3d82f3d74d238c85a5314a2b88eb93296c6de3b6

    SHA256

    db8dd8d214f5d25c76b03c40188ed8e89aaaeef4b90ba017c6808b0796462302

    SHA512

    9686262666229503c9a25dda089eff364fe7629d229f72a80805eb01986b5f1d44cd0bc3bc9e73c33afcb2c308a022fd3da2d5f9a86be2440b1744a7531a7797

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    2b85e2134da031b0157469cae2097f85

    SHA1

    120b74ad092836c66bb25ee27dd300bbb5320861

    SHA256

    26c9a5f790cc7cff68e092a423ecb3b24e0768856b7f6fdb1adb853f8b4e1f32

    SHA512

    73f19d23a68d9c5e94eca412318e1da8f53babe2201d7d57d4b0828a4ed020ffba743b55c1b3c247bdcca2c18eb3d348c1ba15da6856d339494bbb30f7f5d030

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    6a08fffa8e3c89034ca54c206285fc19

    SHA1

    873dbb9f9c2c85a32112086a69ef0644c9b82ae3

    SHA256

    fdaf7394217c8cca1648cf80f92be18031567e933f6b91d855f2353cc92910da

    SHA512

    0a448e7a47856f362d3efeb4e56099d095e0982ed41b9f8220c94d7ed4d7176810f831ee3983643dcccfab6df59ec91a76881bd442d9acb52aa8cbffd1475add

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    7169a410179af7542103b56b05c4b3f2

    SHA1

    2f2a756978772b4df82437df2bd8d69acb159196

    SHA256

    cd9b3a228055b559e4e3fc58208ea47f2e06598419bf7ac6b798889a5665ca72

    SHA512

    b01a8f35d3c416c6fea67acdcb209bc65c8b24317af3f031d308c0b78faeacc1a7b74a41854921d24fe5bd38ea78ca94384734b0562413d211fc1835fe11140a

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    d4603745ef6591e7886ac1d74e9063c4

    SHA1

    e7805d13fc16d541fa10b767ffef1566d7196752

    SHA256

    0ffca3a925b00edfb59fc84b698395c1ae7f3821fb945b3d4b75026842913422

    SHA512

    b8f6cf7cdb4e7b2421d27c413805ef8a51a5faefc9691cfb7f46e35ef2d55adffc38e1f30d999e6412770b7db7ba42363c54e9a8948bd81db5d0918e3f6acfd2

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    0cac11189583f24e22c4f94b8972ec1f

    SHA1

    3f73b94f3e8754f2dd74344fc84d8f6a8f0d11cd

    SHA256

    51da88844628e117a24dc0a8809d4c4f1e4362751c676f5bcb19e518d6019ace

    SHA512

    b449aaaf74f1dc7598bce07169df9d441e183c1daa43510a3ade0ee3300eef61ddf132e6ff1cdbdd648163fee3322c6aba167ca5f2568923fca2a0e9f5d67698

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    65bbf5dadaaf5eff4582ef507d363d06

    SHA1

    031ebc70c39c6c80f1c62936b7d607f761993782

    SHA256

    4c51ac227a791ea6b8f91f18644973281c2ba874040341f103ab722b7634352a

    SHA512

    bcb68cb73fd78e14742ad740bf4fe1a9e32654428b5877623acfd65fdb97e02974ba37b177863221b30a57437adfd733240667ad51b29ec67538c028193c3b55

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    be44d38809f5728efa7878485f682615

    SHA1

    2d1271fedd2fe0141dc905cf4fb1f00ce55b050d

    SHA256

    e3e5c382f68facf4fdf5cd14ce5c45f9b35b88ffb093d55bd4cf8c46f7366135

    SHA512

    6ba044bfb7939621d5033aa8676839c4a4a8b5c5162ab596bc32906e5a8b012d89c0802d1d20376fbb72d2efd65e8950e92b623a73b3d6ff3d775d9174bbf557

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    81388ae55c694040747725b25a8f88c1

    SHA1

    331bb806caabd85d8ab8e45b939f4862add45487

    SHA256

    61595082cf3cd17788d969952e71658a12f2f264cf18e5360619553154d8de58

    SHA512

    9d6c7193e40f9303c0e0cdb03877262c06043c5cf657b0c526aa228fce926ff203d7b2d00d33927c1044cd02e40665e4b258f4a056caf58198be7b636ab4be20

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    1bb8b3f7aa16e76a6dcffb8da35486f7

    SHA1

    282fe275f5e866dfdf16f27c6943d8da15482c75

    SHA256

    49de818c0dd69e3b8d490b38c87e9ee531aa1d0eea110eef6cc4a3213256a045

    SHA512

    27c10594d993bb58d6cfbeb163904a07a8e41005a786fbf5b97f2156d8fb5f9e7e5f6403f906df2e43758bb016ca93f5459bbde9ea0d89fc55f38e8e06999789

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    be11905a85a05d8977b6e11499c0cbc9

    SHA1

    ef4debe39b5a4f3c28a8461d4900fee76815c2db

    SHA256

    c96d1e527e7019975581a8b468912db00f85a305fd0a8a9d535e8b6d6c9e60a5

    SHA512

    be1609772e2e3495205cda57358e45b9bfe73a04ac63b3d85fb7096598434f31d84e6a62bad8f21f6f7102238552da3411e589362e6b58e6fbd1c51cc53a3160

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.fantom

    Filesize

    2KB

    MD5

    827b20bba83a151f9bf086d18cff6fe9

    SHA1

    a043c2e31fc0126a06017074a1179cb380935f9f

    SHA256

    f0636d0f2a9a0ca2636c697384cd80a4407c8505fed356e9f5ad1b98f87760ce

    SHA512

    9b056f6ed5eaf729935b46d62d46e0afa1f005e0c6c615ef97064947d5e8990842804e44cb95d5e353f13b11409516ac87cb2b8230bbdf7bfbce7fdfd52e5097

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    1bf87ad523960f492b0fe664e94c6b2d

    SHA1

    a7ba9dfd80886af85af7be8416101126627344e0

    SHA256

    1f5fda8c7708879db00415e91727842f7123e38a6b5cb701e449058820b17248

    SHA512

    b44f1a4dab09e115ff0358b00f1f9df847ace40fe8b4911b30aec8f7435c79fb96376f2fb62cb9529de931b967adb84b7bfe4e389657bb9dbbb306c674e460fa

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    e31eefdb0eac98c3c0353e885b7881af

    SHA1

    b686fe8b6cd095e7fc97efbc12eca2d2307c6954

    SHA256

    cbd049f6ef360da00d88619fe2ad35fab2cdd978a3a18f14d98ebb37e6f51aca

    SHA512

    b4875dee8ecfa72c7911befe42b0e7f91b6c1003d37de9023dcf1d0b990c670a267cd553e9bc60ef1d355f7fc1b48f607e76736fad48a3eea9855366358735a5

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    a590bdf6592903a1de0388d2839d475a

    SHA1

    700453024173ba6e1bb2dbe78d561fa33ed60932

    SHA256

    c4eb7c836835aa29797a245f40176cad9310011518bfc32a49761c17c8e575b2

    SHA512

    73f90f48496f015ac93a6eaff62e533c87b94b8a2d1a04ca7462556b2145bc185e610ba8b1880304261ca6ad7b4fb075335ce7a9590a3d23073652734eeda7f4

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    82cf5c24f6c92b350d9fcbcad802dfc4

    SHA1

    752fd25271516fc12088eee45d328270bc794e43

    SHA256

    0aae4bcdd826c5825bfbc306786e49bc61b28da9587d0cf3f21e6a18ab924d66

    SHA512

    3dc8f9641ffb01c23c5ceddeecbe2d092cac111648ea670a3df465b78089e2da714b722d5ee28ef49172bf2af9640342e3cfd9f2ea086d823a406375836a90ea

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    fd8466a168fe9200cb0fbe91dbac98f0

    SHA1

    67692ae2923978b6d76f7494ef6bfcac11ca1f8d

    SHA256

    1f1875b220ea59eda88c92ed3947c6f881f2b9cacf1592ba27fa448e09ce8ac1

    SHA512

    d722820346a6af82561d20a456c4c210a6b6fd99c853fa14737840c3f3213c02bb955288389ee2cf08772b0f16e96a93416d750b646d9546fa1cc6f7b0e71282

  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

    Filesize

    11KB

    MD5

    e3b6a0110df2c31bfea0b9c962b5931d

    SHA1

    dd63409db214a27374a41e3e5966e3768e991488

    SHA256

    a32cf451972383871afd3a27103036c96f29848612e39436441e023fdd22c28d

    SHA512

    9e55495ac0c179cf30cc0b563958bda98e15dde4eeeb61f600a59a09ef3fbc8eec959bc7792f876bce43ac0e252f9b3a83360e503c1cf012d795243a21134161

  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

    Filesize

    11KB

    MD5

    3c0b1b1f6326a3e62d45ca5721f8ff7d

    SHA1

    7eb8620130617d3efaab96ee505d1cfa3252e4b6

    SHA256

    f5dad65983772d2e7732adf38262d3ebd1ec0bc0fa8b284fc37c0be671496d69

    SHA512

    802b390c1888f9192a6256c399aef5602c0b7eed264355ee302206ec51c64d5d1bd60743f213572c2f946cc03ed873fe614988f4e583c0ba563ca705f75399dd

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/1172-44-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-42-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-1-0x0000000074550000-0x0000000074D01000-memory.dmp

    Filesize

    7.7MB

  • memory/1172-2-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

    Filesize

    64KB

  • memory/1172-154-0x0000000006520000-0x000000000652E000-memory.dmp

    Filesize

    56KB

  • memory/1172-153-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

    Filesize

    64KB

  • memory/1172-152-0x0000000074550000-0x0000000074D01000-memory.dmp

    Filesize

    7.7MB

  • memory/1172-133-0x0000000004D70000-0x0000000004D7A000-memory.dmp

    Filesize

    40KB

  • memory/1172-132-0x0000000004C80000-0x0000000004D12000-memory.dmp

    Filesize

    584KB

  • memory/1172-131-0x0000000004DE0000-0x0000000005386000-memory.dmp

    Filesize

    5.6MB

  • memory/1172-130-0x0000000002860000-0x0000000002861000-memory.dmp

    Filesize

    4KB

  • memory/1172-129-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

    Filesize

    64KB

  • memory/1172-68-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-66-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-62-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-64-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-60-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-58-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-52-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-54-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-56-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-50-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-48-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-46-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-0-0x00000000026B0000-0x00000000026E2000-memory.dmp

    Filesize

    200KB

  • memory/1172-3-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

    Filesize

    64KB

  • memory/1172-40-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-38-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-36-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-34-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-32-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-30-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-28-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-26-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-24-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-22-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-20-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-18-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-16-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-14-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-12-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-10-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-8-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-6-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-5-0x00000000026F0000-0x000000000271B000-memory.dmp

    Filesize

    172KB

  • memory/1172-4-0x00000000026F0000-0x0000000002722000-memory.dmp

    Filesize

    200KB

  • memory/2760-167-0x00007FF87DC90000-0x00007FF87E752000-memory.dmp

    Filesize

    10.8MB

  • memory/2760-166-0x0000000000A70000-0x0000000000A7C000-memory.dmp

    Filesize

    48KB

  • memory/2760-168-0x0000000002C60000-0x0000000002C70000-memory.dmp

    Filesize

    64KB

  • memory/2760-1717-0x00007FF87DC90000-0x00007FF87E752000-memory.dmp

    Filesize

    10.8MB

  • memory/2760-2984-0x0000000002C60000-0x0000000002C70000-memory.dmp

    Filesize

    64KB