Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2024, 14:16

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>UFGQr0f05fFJDMS6fUxQJ8Ghv30Sa0jlxJTSF7QmTMOw8Mklkge5g8Ip1yhNanrBhCUFwly+Vuy8na+/TWlINfXeg1oj4OFKAstODSVaH+C4x9KeUOhiefFzfIVGML1awszlYWhr0zFg+XeJRJc76wkyIqKcHAvPqMiN41fgiWHiMZhGXVdvDZ3Xq9TIDlKxLZhUS0EwKW3hjr6/UDzO63ONYmiZ9tTRQ7UfUDcoBDF1JNDPo0JjYU6uv1c2s7YPezPxWNxguqzJS3+GCJM/6pELzEF0YUcU58wG8NUqLa3WVJn9GAuHrP53Qtjwai+ZLYHpe05yMfezaI+8ux/Spw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1023) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4084
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    6d0a1af175f5251faaa976295f08390d

    SHA1

    c12ee6043ac6a7cad7c4d9bb396e21c4f8c3bb02

    SHA256

    71d095461c8dcd1d9160b6bd34021f788264fb4cee14d6a3445c8b073dbcedda

    SHA512

    6e3b6de1a2fe78b97cd1bd70f00eb05cd3c110bd27e15063d1692cabaab0653462d188afc9f87dde21d5f9b5f440a0da377b27fbfe656429ec28fc2c09135213

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    6fd9be1a59bb7b9eafbb35fbf6853867

    SHA1

    8f981b962c192824fa37cccafda53a293d517dc4

    SHA256

    e846d366c89e90d6318b20bfa7c82cf2dc51798e615fe89e278724ffbc3f9721

    SHA512

    f4611b336f2d1cc0310e3e16905fbc2fa4072dcdca838919e734f7ceaa7c38ca5169daf13eec153db625b19c23fd36aa72e70f0132846da3cd9205a4df7bd132

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    4bde2b13def1b1f9168eb3111036ca86

    SHA1

    9bc87bd514dc74fb034b31704eeabb67dc259484

    SHA256

    fce6e43bfad9f5974740901251fcd61cec21e997fc1cdeb48fca2e5049340840

    SHA512

    d81e0add175f67ac762f7ac21ea30615d416b58718d95b71366912c4fac87136e140680b414b0e67c1e14df90c3d459041399e955c803c5f026ce2dbd53e871c

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    71c5af83de4bc62be22ef6e2298adf7d

    SHA1

    eeaac49b730a3ff6e4df91cc6583cb5f76566867

    SHA256

    a6d6e4e24fd5f54a3722831a9459dc552ed52fe70b5442307ea53747859ba8bd

    SHA512

    d72cb99adff5c7b22193d503fa3383cc3c505e4b794c2a230cd0b6489e3884b6f35b8b5fad3cf3ef85d26696e672388b9e97fba055f23513353da1344fd7dcab

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    29de61b66031c71c47175193896a0c06

    SHA1

    72b3644ec3f414d641c7c56291d2540abb2ac4df

    SHA256

    307ed446e2ff563d603ac20e1c0f3193a81370b6709c03c9a3a637e50345e4ff

    SHA512

    99e2630a18be71caa83caa81f3536d8c08af2d6a44037a02b5826c78d2959ff6f246802fc84d9350c12fc09852d3cd11bb88aba57a0a4c425e80d73b7cbc3cf3

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    a75d11c1011b8e038ce65412e82ad65c

    SHA1

    fb0f0bc08b05cd70fa34df035b02688326e51ee8

    SHA256

    f117c69d5ab0691f2da2c5dd1c929b66834f2d978c505b2052770b7c0ce30711

    SHA512

    4d3b0b62ccedbcd28b3aa45d89c032a2ca2ee137999af8e572f806327127fe9a46501937fdfce9eda7e79f090f8bd4023a2c31cec10101736a07f3cc420355c0

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    8399299950fe55889576dfe17b837b42

    SHA1

    51163a46cb1491cead29ae4b1cce1462136c3f6b

    SHA256

    5953a21db3a25ddd77603c0cbf520909fb76cf06b9d1bce86b3b8308145f0f69

    SHA512

    9ce365782da90e8ac4b02c920644608ff95b20e117e5ce50b95a78a799495968801d450eee264cbcc487dc1c10bb0d90b04aa3cb41c96feea4e059d25ac28dec

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    4ee9767f7ac0da0b247dbd08139e1dbe

    SHA1

    191702a8d3291eed45f8ac6dea1d2937f5cb0628

    SHA256

    b6329dada1d9f06f4dcbd02389e0389cfae7e6304d5ce1b6ed8a31dd1e431dcc

    SHA512

    e8ffcecb0acaa6020f4714fa1975e862d2ec02c30599a7314a8f96af8c5cc35fa9dcd86ab693eda3af95e02371d8150313f8b596589af0507ad94aef279223d6

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    9ad4aa86c5be64f6dc9484a6ab5a6de6

    SHA1

    f9ba1f75d9b136cce9041a8026c66a16fd021ee8

    SHA256

    8a1959c2ba8749b3b877c83ea3cab013a95d101c917f6266238e90bce36b268f

    SHA512

    6d06beb6210e7f2f45008e0d4a0c3c7b7b44eb933c4cfe937385fe8d83da283d59edba0a2542aedaaf4856209f76184596a155df25cd00ed4383314aa461f2a6

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    6edac7b2d56e4f0790579a620702a78c

    SHA1

    8b4e6671dfcc98e875d105c31e3d41b92f6c53f9

    SHA256

    67f525d9738d0eacb78cf439528825100f9d03462e892489cc4ea885c064df69

    SHA512

    e7a3f9380e323447fd326714ce62e90d5ec941172326389423c9abffb21a3ddeae0584ed82bc335fccf31824f6dc650305167ddc9dc8b492fc3fc7616f777a1d

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    9d1e413d0c6931eb75d7a75f101f9db1

    SHA1

    f8f8d8d60b5d106e46275c5b11b046a2e3fd3676

    SHA256

    d714891a284f168c405f4e662ab8ff9defc86d2c7403e7a41507dbc351a0052a

    SHA512

    fe0ba1ea3dfbb097fc37047f10aa4d6534db4ffea572c0d4967505faabce11f7fdc389a8ffe8dc227f114e772d3d459924fcd90e862a0951d789b209e894598d

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    83f852f453f6e559ac48b08f139644af

    SHA1

    4ba65c439a4098214f6e065ba2f9e15465db552c

    SHA256

    222e0c9d74827f5c396e143a75b6a6c1282cae8d88d6b4b64b1a270e5c040459

    SHA512

    8ed83b3c8a71d7cbe093226eae45f6abf3f0029a30bf5d7693eb2b50460ba338728df58f615dfa3b5e5f92f4036e0fe36123fc8b6feff27cafdb36625ae90cae

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    69a65ee9a1eb6bf58c029b95789ef69d

    SHA1

    0d40951d6c05bfa08209ad678ddc52277800a772

    SHA256

    9a732f930de6bf1781fd1286c7a642b7d889560143e3677be59cd1b516d01e44

    SHA512

    54a99a75ef7997a469b8140fe25eb7a26896f5f4a51c5cf2d0a933d9487e6461995207d7563643bc9c955bc290fbfbe38f7bbd945db683f3c2736eb93b4b2eca

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    41394215c6633f59fb8d8f8dbb0cb5c5

    SHA1

    bfd645c6909eadd6743a1143577510874977ebeb

    SHA256

    f5429520b53ea1f5732fe810a0b06f72297e3a714c0fdfc9bb0f2c1878f64925

    SHA512

    9c526330f983fa87f1be236c73a5807c67b9f85f9b791d37de12afbff06f80907ae272b428e945d7efa31e6e5679281ac03f7914ecbd3c109fc1a0a0b730f8dd

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    22fa43c53da402488175438718ac1124

    SHA1

    ca5541bda46131da3ca3e9dc8d5f8a2a47a0cb0a

    SHA256

    5ad755a3a229152e63388c956d8b2d88d7d5dd5068e7f390b498ed720e0ff82b

    SHA512

    c566c51f48f3821f6f659dbecf9740f56a589eb891acb2d4a5c0353d596ded71c26a58fe638ed24759c33773e1c7f8474ecc049c315068d9c26aedf01e8736e3

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    327053929ca5ec0be5a921a25d066eda

    SHA1

    7cc5953d8c3d1e5f21947afbb74c453b6b678046

    SHA256

    60a9b192b2f9e6612a6b232d4de3e2cbb4aa1dd5bb661b9a245ebe4c5d7fcc37

    SHA512

    87da221f2da7abe5a2979190524580c211bd9942ccaca181eb7f97c58d705a2fff85c5105bb8a48621dbf9d955966ded32370d573e575c4ab54366ff6f6a294a

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    4ee9d897dc9515a783b794d418cc5f5f

    SHA1

    d5f691d2596c1ac6822d8670d6cfd09f780ae88a

    SHA256

    56d381bb466da112fd39ecfaa2395e73e16d106ade8820c4f54d9179974bd053

    SHA512

    730bde069ab3e7146ccc5e057c7cd14c0a0da060509ed9a159fc7f8c308f705c8ae94a33bed2202049fd01cae46bdc09efbc4f924a8403eb6b825096729f64df

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.fantom

    Filesize

    3KB

    MD5

    7172c44d024e49bd1fd41516f0f3383d

    SHA1

    cfeda26d49ba024c8731296b67606663dfa0c792

    SHA256

    92fdc8ed0db6ec7493fa73be46f1a2e9fc87376829be2ab0a720fa149c246b21

    SHA512

    a1d28fe477b0e1dcfbb1a013ac9fc9c12e291b14cdbef1ae81dfcdbd19cead3ce077c9e3451051bdbf94aacb4e21b40b8115d3e2c2d4bc59f74e7270b1b9ac6a

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    cdc9eaee4429e9478e636f376cf118fe

    SHA1

    8b301570201341c361813a8757a10a0d2a2db226

    SHA256

    8a829a35b5fe5bc3fc7003c913d7b2ecc21c2e6298f1635177f12185fc34306d

    SHA512

    d539f34b73b1ae22de4ceaf047123ea776e5c973eb6a63db9b658396abaca92b9b4fb7895628f55f8ac8e8c5b4304d2f4cb61c7ec842c1d899164a0d1ae98b27

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    0dfaf3b46cf01da8bd1e8bf0d19e0cc8

    SHA1

    3116bba085e63850680e9856852d40b6e8abefd7

    SHA256

    8539be8ce129d4ddb6087d29f23199a56aa9652a8fcc53bd3fa7bff5ff19c65d

    SHA512

    c20553d68360683f2425234528fae53f440b9553efab5054a43d6f211c2ec2ae22e78c87ae40b423429b50ba8ea84ec20e7304ab9f07e8d92d26647d9ec0a6e3

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    6ab131b534211442f32ef4dc32dff370

    SHA1

    8b9d85af084a833608b87b2f14b74d70e5ed2972

    SHA256

    0c60e6833e29319a0dbc8a11105ed6c31fd876c675d25d57c2d59f1c0e45d4d4

    SHA512

    bf1ffec62d17e3b6dfd1b9cc641a6f0adf1f45252cbcccb698e3f7aee3d1a0ad0f9a2797908a4a7f115734d990eafa3e1d765d40459b964fdebfb5ece58b7901

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    c5f0b8834553eebbc3326c254dabe2e6

    SHA1

    8d2fb52319d6b3254c7f4596cf60b6fee19dee49

    SHA256

    97070bfa8c5da6e628068cf65d2291abeb6461283228f7dde2e347dc6bd053c0

    SHA512

    25e519deb6c47461b1acefe4981948db57dbc4604a04c9e6e7fecc328489c11c276344514afc12fe07a24e156a029d04b996d2e464b0eb8e70660e98a63277f9

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    0a9fc2dbd1b148f7aaf2b651006fbdc9

    SHA1

    cecd48c649d67e955353ab8165f5967548f42228

    SHA256

    4b13507545ea38e1877a8d5538ca635e90d1c1af21bcd31c7c71a54dab2a7450

    SHA512

    da57e63b3cc68c3e3a0684742532074f4901c81910647bb6eca6ac88344197d9f15409e6bfa87e53ba4743453fbcfdaeb2d0c475303455107b795842781b57c0

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    23cded2648c56580aca95da60da38a98

    SHA1

    da65684065ef4e0c739ed892f11b7efb2924ca2f

    SHA256

    2b0167065d820258b2bf94ebbaaa169c3dc2c80791b22d976eea33caf63f2adc

    SHA512

    536439f4fe7d71bbccd7aaf331f9fe36b9d8ea854b2f8fc2c42322028d43dbe9ebdbf9163b8a16f2834315d7070016b068fb88b0a53bc0f10e35d1164a52d52b

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.fantom

    Filesize

    1KB

    MD5

    748101ca022a945a2807266ee343ba91

    SHA1

    bc66ab9cfb2eac1f49d557caf83cd93471dedc8f

    SHA256

    2619da6020595619aa847a532d07b1064e854f9d5f2c527d07cc0017cff2f97a

    SHA512

    ca114f16370a5a73c75cda968d78cb87e9eee1338614286a90c4390da63d7a36e45cc308770b8006e3d53a7b64ce23450db5b49c8381827149acb484da10c80a

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.fantom

    Filesize

    2KB

    MD5

    28575ac56d8a34738eed4b44ab4cac93

    SHA1

    6aa4e3bd18bf75ec6eea6901a62b83144e427f5d

    SHA256

    acfe55afcf5874d1f60a30f12b466a048a837c41d83681a27d3bb423192cffc2

    SHA512

    3461bba78a65a9486ae476232047b65fa7730cf030d5dc23e64f5da8523bd0e684157a6c0d10cbdb849a7512388016e610c8cfebe4c31f413f4541bc62db518f

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    ca2f49e63a7aea6c5ceeda4609ec5d45

    SHA1

    423a744a2b283de3a05ca71d93bba98aaf8c50bc

    SHA256

    10a806fdc98b48f14eb95a88017a99de9899b533ee1e3320d97e33ccaf153bdc

    SHA512

    d80df2bbb3a6fd592642e4225df1512970b8c421881d16d272c0e5adeb7c3f247657c1377bc48220e8ed2d4a4b04786ce802fdb22c8ce4ce5c8e2222a7fa8833

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    bb0f099806ccfaa2fcecf2f67d689fe8

    SHA1

    0b6270a566df7f880dba7902a29dc07d8c710e20

    SHA256

    e90292e2910816f7fc9f3eba8d91cdb1aae3cbbfdfb79b858ba9d658d81ef65d

    SHA512

    c65f6ffb74da2af6c3defc0ee8ac95cb90f29abde4a7f6ed5ee1cbf5bdec9672f5c71a884509eda0a3b982684899aa5c8fde0f10b20fc1f8282ca60f131a49a0

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    5e82a4d1cb7fdfc323795fbc35b0e6f2

    SHA1

    ae84d68a524b977f07bb3bfd91636cf74f66d718

    SHA256

    7df41f02870f359982a9848562718df30deb06f79d07c4951beba6ae8ca7a7f2

    SHA512

    0bd9580085b9dcc11e353dc45e2131fe538112e2cc4cefd960f4af6134456ba799bf43aaaeea7d7af08c60b016f4c872885902621f08f01cc4fff51b22bde956

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    f3ffd80afa63aa02d32ae4be80180457

    SHA1

    ba507574284bc9198f5bf65fdf3725853b60cdc2

    SHA256

    265fed9b7d13cacfd80ff719f373ee20bc13cd3587f981ba318d3c39a6f3a082

    SHA512

    fc15082895adb4d21f00cd8436d314a3ec4226d3d19f85c3f8490f2ae7cb503cccfa4733cd689d6efdf8762f0ce69edc7dcfd03ef1553bca0e76bdaec48c191a

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    9891199a007a6db650ee3c9282e0110d

    SHA1

    1e8fa8c672c96aa92864a6f9188c92100a23c286

    SHA256

    58ad409a6aa6905f35d65eb2c17855adfcf2562d5f6f21fc3820a9e9b49b38d0

    SHA512

    b53058f9539266e9e8713669ebf9d830e958a9241dddc8701dbc72d2873835a600581088987a3e4a0f88e95792cab8bfb74fb7285a651b7a77e6d4b310817bab

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    72e88b337d4f5655548a6ca1516e9f7c

    SHA1

    20b15d85297c9c12dcec9d853a5b215d4fe29446

    SHA256

    bdd5b63794fceef7bf7ffb18ebc3d4a28b4773568e2d8ee4b0fd0e7b56c87124

    SHA512

    6b72d6fa20c49e19a41ad17a961c2d490b3d019996479ac108522f18db281e960cce032bc640c693746fc99b465fe9fc8d4217d5dc03f5c10bdb2e66e754be4a

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    7977a51262b71eda26035ed0042fe109

    SHA1

    31e1bdf3f9ef8c4b00ff277f8437a388e56048d7

    SHA256

    1fd574783601a67ec4a15f5f5942bce60202299441d99f9c610ddbf9aa87583d

    SHA512

    8c8fae002b8cc0692407eec8a808c8a15ca13925b2982563ceaf993052604b7245ed70e610a6e2d16060215c06139788484e30e11ec064f2b1a9c04966afb71f

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    7725a741d6a152802da392d7baf6e567

    SHA1

    1ba49a2b7811f99d6bc1d8d1dc34b1c7628953e0

    SHA256

    e6b4e251856ccc377769a57eaf0afd3152e5554ecedb3bbca5ccd7c4b8fb772b

    SHA512

    ed2d1487fd267de491dba5b97351ea178918a1c3f514e4bc8bb308d245a4f8251816634d324920b040e8f529a6e8349e5a68db7dcfc802b4e21ebc6faadf2172

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    88c12dbf84ba3c0f334d308b99e9a896

    SHA1

    7cff0d841ee18ba78ad760b4893bfdb6fb999af6

    SHA256

    ed86352547f552e2f5eee100af5f59bb40ae8993e5817f6383393ef0758dfae5

    SHA512

    ce155d4768441cc31a3672bfeca1a4dad87d14edfa4f47b511a9aaaedaf75887488da2cc292102495d1b797e6a409006cd2db666a57bec9c1f52a336fac84e80

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    3d3245cee7265e3eb82fca50149a2b08

    SHA1

    09cf5e5d7e79ab2d99c72a73508a2f10744e5280

    SHA256

    cc4e9d54df97031e94baec2502ffe1e774cd32f8402e3ed59629fee33dc2a4fa

    SHA512

    f3bd29d8ca3ea50009902590b11412edafee853dbb29cae799b1444efe2f733b09807f8b76e7ff1690c5a2b15a7e1c1d83247e5cdca6748300bdfff955256890

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    9182caef74dab8bbdacfdc853c35d43e

    SHA1

    bb8fb5126e612fc1c23e56c8943e113377cc38e0

    SHA256

    21fc88fb0661686ec49d68d6523c63c534ca847b51ae0e843b1d7e5ab0c2c3cb

    SHA512

    4ba9ea603201ba30a426574ebe62a5f11067f06e2ed1c72e59c3b9a628901c83c618e25f871a250ca9bd889064c98a5bbf56fd9b1ab231d7bc8efed017515465

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    f4e120d5ceaf7176cd069c4da4e7a332

    SHA1

    fcb53ea0934bbc031f9b35e469ab8e822ffd79f5

    SHA256

    d93598c6c25e9a3a586614b2b232bb5a1c0d84e8d9c004248f55bfe0eab7dca0

    SHA512

    1a04c8bf5fcad99bd01f7b93ede5c945a255c9090ffb94d4bfdf0c3f48588abbc81babd751b79032e69a95f1ffe7aaf21a738f579e92295520b82957017e9f72

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    07c11f49d4d3dabb3c68f2b72b6cc6d0

    SHA1

    201016cb36815d26243dc5707be7b66c9109b061

    SHA256

    d3c0718e0de010bce133e0dfa02b49a6834e327d5836f01ff60b352e9c24e03d

    SHA512

    f9b8f163380108c49e5deb0863cfd05ef51b99007ee44fecbfb771fe1b98c9492e8b9faade35428b0cfd89978103cfa5d6e701f5f0e81bee69675a87c31ef08d

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    a1d19e249a1331552a72dccd250d921d

    SHA1

    3f41c8831c29cec588973005ef8dab31ea74d9b6

    SHA256

    893dd94d4ce982e9deb17627459fa8885f1639da5da66a2772e3fadbc12c64e7

    SHA512

    ba3f38c044cf79eaf251981a8a14c41035cdc4a2244262f130f046c91ac98b9b39ae7c376a3f0cbf08ed158447c4913ff481adda942590f5155eeffadb7591f7

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    d183023005952a905fb652cf457d057a

    SHA1

    afbc4b245e240a03c82ba99b82c0356b4b69256e

    SHA256

    e22e1b242db6f2bc0801f39f9aa6f0de666c6026b7cb14801017230f8a86b708

    SHA512

    95459def22ac218bf41ab355f5d8aada7aa0ccae28576cb2a3bea42e884e7969c335b1aada65cc8b6d59586fa5aeabb9ec3ba976b9879c4ee011a37f6a8c9144

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    53ead68a78286ed83a887d1936b8f348

    SHA1

    5ee4560f6d02d352fdb78e7dcf5d8e645d8f7e24

    SHA256

    0b95b316fd35033e1ee58245f5eb5d9b7e3d9e2658f6b8ba88a43d091298e287

    SHA512

    b141c9494abde8c34e1db91ac8cf53bf7e2be31c330ebe40986eaec3405754dc19c1407f7d7350a2ad9910f41b48b7d6993cfab6db15f624c3781e29968b47ed

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    1499dd8aa8e6825b5a255c40ad0cbaa5

    SHA1

    cdc79278218adfe25976e41a16b7e5a6ce2a5459

    SHA256

    96306819ebc367cbddaa79eb3216bd74d6d0e98684ce0b1ab8f537117f74867f

    SHA512

    385ff40e48ecfde1943560c55340fda331d2ca8102aceb9c1aedb4aa36c0fafd44fca8de6baf9f3e4678ce15c9ffa1366ad3cd649fc1eb505a6363be34a1ddbb

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    110f870da3a7fa5f02de90edc8268d12

    SHA1

    1c85da19e3e8ec5ef47aedaa501bacbeb6f92d7c

    SHA256

    037c0a447e2d1c281ade0043d8e52ab60c8bf67567f78e1e544881b50f4ce17c

    SHA512

    56afc983a8e4c7e4e08f8c58f023f95ece1504af6cccae624442b13f485aca10b74930f40024a8910c6f68ced458ba822ab87edf92f65e7fc815ef348bca6074

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    edd0026e241f0e15e0aae4b5ade9aa5d

    SHA1

    a9d8588906e5242ab26db04faa40739b23944339

    SHA256

    f2e3a4c9563573d80af96a489b71c84da98aedfbe9b1b02867dfc7d56da370eb

    SHA512

    40d33b6c5a340d50224cd0b9c835e2d255f4f0a2a27046d471eb3404c0b009a7e599a57472e5439841979d1243aee587c6523ff2c9658972eca0ce45b6b615a8

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    191e10c9b406b12282ea8b1aa4e3c703

    SHA1

    5d930788b8d44d77f49244e84ed2de263cd4cd04

    SHA256

    ab636fa955456121a10480538a3be80efe2e1f5c704009be2e218ac221f4d092

    SHA512

    e152f1a5981a969b00d205df0e8c6c7b6505b2d62c913054a366d6ea3e2d1deb216ae202b80f233dabc4e476eab3cf32b2d55ae4447f4d79232c06150d9b5bbb

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/440-151-0x0000000000D30000-0x0000000000D3C000-memory.dmp

    Filesize

    48KB

  • memory/440-153-0x0000000003040000-0x0000000003050000-memory.dmp

    Filesize

    64KB

  • memory/440-711-0x0000000003040000-0x0000000003050000-memory.dmp

    Filesize

    64KB

  • memory/440-613-0x00007FFCC6C80000-0x00007FFCC7741000-memory.dmp

    Filesize

    10.8MB

  • memory/440-152-0x00007FFCC6C80000-0x00007FFCC7741000-memory.dmp

    Filesize

    10.8MB

  • memory/4084-48-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-10-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-0-0x00000000025E0000-0x0000000002612000-memory.dmp

    Filesize

    200KB

  • memory/4084-138-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

    Filesize

    64KB

  • memory/4084-136-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

    Filesize

    64KB

  • memory/4084-135-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

    Filesize

    64KB

  • memory/4084-134-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4084-133-0x0000000005370000-0x000000000537A000-memory.dmp

    Filesize

    40KB

  • memory/4084-132-0x00000000051A0000-0x0000000005232000-memory.dmp

    Filesize

    584KB

  • memory/4084-131-0x0000000004BF0000-0x0000000005194000-memory.dmp

    Filesize

    5.6MB

  • memory/4084-130-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

    Filesize

    4KB

  • memory/4084-129-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

    Filesize

    64KB

  • memory/4084-68-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-66-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-64-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-62-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-60-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-56-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-58-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-54-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-52-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-50-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-139-0x00000000061E0000-0x00000000061EE000-memory.dmp

    Filesize

    56KB

  • memory/4084-46-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-137-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

    Filesize

    64KB

  • memory/4084-40-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-44-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-38-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-36-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-34-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-32-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-30-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-28-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-26-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-24-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-22-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-20-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-18-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-16-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-14-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-12-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-42-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-8-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-6-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-5-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

    Filesize

    172KB

  • memory/4084-2-0x0000000004AB0000-0x0000000004AE2000-memory.dmp

    Filesize

    200KB

  • memory/4084-4-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

    Filesize

    64KB

  • memory/4084-3-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

    Filesize

    64KB

  • memory/4084-1-0x0000000074D20000-0x00000000754D0000-memory.dmp

    Filesize

    7.7MB