Analysis

  • max time kernel
    150s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-04-2024 21:30

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>YuA1WlMk9FGrPjpIIZuFCS/ODNtgP7KqSS/zb/LdiFwaWAKJH0BQ96lVnUnLq060pOKJw7GRVxOflWx1YhhH2+8Xibo2d9l57lTWa8Z8J9+pWLsxRJzAiP2GOMsA8/0miObr0sWHwVNynFgLPmdJnnBad1Z4WhuN2bjwKvz+HqJb8taPa0ciUlaQ7UIDDrtQ6KUpKXSc4AcO8DRRjI6dwlAUg8kvYqT6bhJy2EKPLkEHTGTTy69o5bXDBSKLj6vc79IqhFMq3NqHbvG1hMMYv12xj7eb44MR9gZD93EQIEN5nA4wWVWBnE3AyVgZRDCO/+OQtx4SyaTDv9WZEt39TA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1017) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:4212
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4052 --field-trial-handle=2228,i,17475224967547320003,13667387715861799238,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2240

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

      Filesize

      1KB

      MD5

      c515d6d5b5ae4b58ee29226759f92437

      SHA1

      ff964643155ab5d6bd11a25f9812caaeaeefbd9d

      SHA256

      4f3fd7095438bfe4ec75cb1613866ef9c3c50e9a9a80d3a683fe34e03c500dcc

      SHA512

      0f7bca6b88f9031da47ad8100198d04b30c799e9e03d735ffe4137b3846f355baf694ab421664e7ffba228652c4ab4cf455d82e29773427d57d7fe729fc4a0a4

    • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

      Filesize

      160B

      MD5

      68a5f31834a61d6ef5bc95c220490966

      SHA1

      d0b921ba4c59f2f12451b9fccdcedce2188ef180

      SHA256

      d7f89dc8dbbafa2d0af6c087281a0d649677215e80692a4aa4c3f0c1f05c8c1c

      SHA512

      cf57f47ed7dcd7e040a6aaee9605621fa9c8f4bbd05b0fbb034922783a42188f1518599ca90e4e776d2bcf46882f90732337cd1a5c373adc44a57dc56390c7db

    • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

      Filesize

      192B

      MD5

      f2546bea0b65daf8460db6662566389f

      SHA1

      dc517a93610f48811a8e45aaa0d7314bf89e477f

      SHA256

      e9ec586abcd5652b5beb6b24eb31c02bc39af32423ef8bdab659582b5ca166b2

      SHA512

      98b6ba0c07ecc26a3daa74cfa905d0c403eba9f0a8982da113a717f8e426495efec77ca0f6bcaba586a8914a9da0ac99abeef558813107ff33444747094cca45

    • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

      Filesize

      192B

      MD5

      f96e806593ed9d4ff8b9a333da01d51f

      SHA1

      f280dd384549b77977b0d11a420ace87fb37b822

      SHA256

      b8bfef39696c60373d67d5aca64ca0cb5478e433b3a2859882ee938638f17ba9

      SHA512

      60844488860d5f76a5d7b8c6dafd6da0ce526c07b799aea0f18175c146110ca9d27d2ef4abe10dbf5549406b9fc15d3d6a2cdbcbae1fa4deacf6ef2ec689bf35

    • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

      Filesize

      1KB

      MD5

      0cbca26fd35889fc1909b13d23ea03b7

      SHA1

      e83256e32ff223af54767752860b0f516c5cb46a

      SHA256

      4c0573b502358812448a69e3f9e3132426510f7a2175288ef55720935cbf2df9

      SHA512

      553f0e2749d52129fca16f273a782922a5c86d006729613dad574ef2cb5c98511341947e6b243229b40b87480fdd561494fccc77972db8d7f3914883d551ea22

    • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

      Filesize

      31KB

      MD5

      7f51cf26be5f64365d83dedca082797d

      SHA1

      482c366eb7aa5f75f70bca0121ee2a4197935b66

      SHA256

      f65cc29806a2ea0d4c18a63a3d3395b11adec06c3960d8d369e66f96ea523736

      SHA512

      83704e2cddcd53e509e4beb1380c1b4b374a39821b26672d040cfb266208749494801cd7aec26388b1f50f5d7f08cf45810106cb202acd3ffd7064346f3385e6

    • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

      Filesize

      34KB

      MD5

      c27ebb44f1d4faf26cb0b367bee5e47f

      SHA1

      abac9b6ca8f5206bcfe49eb663ed8cebfcf6f056

      SHA256

      175d4dc844bf009059e62a43e1014c9430715ffb93a572a8aa419ab06d57557f

      SHA512

      bc833e9381f8e43c70a8c1ce27ebc645cdf615fed6d9fb46613f4baaac7701397ec645af93d15046fd6c85ff0d2eb695542ba0deb9148e7ddb39bf993082f5c5

    • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

      Filesize

      23KB

      MD5

      24e1041816e044046e80fc0be80564aa

      SHA1

      7660bfede1040759016b83bd6dc118c692cc57ca

      SHA256

      c5abbf0a294c1e7b2e321815bc1c44da57be51810bbcd2254628c15f70b5c8ff

      SHA512

      05e91f35e4ae9e60856195386ca630b043efcb8c3791a1adb166c68a1a5be1362f511e937e5b3254b18b57d6c3edf639e252cbf1ee4f8ec459ff3ebecfb710f8

    • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

      Filesize

      2KB

      MD5

      ef61daa23b5be53318df26cc3638e0e3

      SHA1

      f65f6f7431156738e97453bf0ce31fe663bbb538

      SHA256

      d8011911f90584850d3ff0ca441c052ff342af9e86a84caec0c120a2822f4b46

      SHA512

      34cc768c8c1e9d79c721121ec0123556cdcd85e6db133804593a4091c825833b767561f751ac9a1efbe7fca39ac9561ef988ec9169d028a1768b1274ec1ae4b1

    • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

      Filesize

      1KB

      MD5

      bd14007b1284c435f58769898e1fdea3

      SHA1

      e0ced387f2ead6cee418eca20d7967323fe54fdf

      SHA256

      54fc3015000d31185367e0915f6c27fa4aa5d6ccc760f53b676c9a65517f033b

      SHA512

      4bef247fbc36afb4588d500106d5e9e3fcfb2bce2118d8121fa88a1049fcd3dd3cb8f4d653ce58cbfc36ef084b3802bf525a10d56363e9ccf14a6f0a601ff057

    • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

      Filesize

      3KB

      MD5

      572160d08348aaf49bd1b1953c6c64b6

      SHA1

      3c5892deec7c7ee82a1f27e6e2402f22bb97536d

      SHA256

      2b9dac5686276666f36f244d8989e206823771cc4477a55af459571cb02725c9

      SHA512

      6b11278031c2e0c64e9ab46ca2e0fa72925aca23373c40227502b6b9e910b563b44f4a36dc4af59c4c1f56754ba5775e587c1431d28a5b423a8cf00c3d3a48d3

    • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

      Filesize

      2KB

      MD5

      f8052167d7463e2fbd02c358f4a07aff

      SHA1

      0a22638f95d4ec65cde5061748b7240151e1f9b3

      SHA256

      40069067b14d2a2b9bc0a862bb982f92525132757a7885e04ad8275b0e176c59

      SHA512

      0013992e2654a45c3e0fb3f85b0b44f3b0b28f0927c2a1452f29696656f78a70041975a5bf62f093bc2ea37a01e51a8c9a2ffd6425f41f820e45146aa3f0407b

    • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

      Filesize

      5KB

      MD5

      320181735d2d5681e1a7587878c06c95

      SHA1

      f94f06a57d0a15637197750a735ad568da8c6bdd

      SHA256

      0ef92abce109df92a0c6dcd0c1b81733d3a88e529c4e4d4e8ddc72fbeca34980

      SHA512

      74bdcf2aa313cad70bc5a585b0384a253e842898ec32054c13f107070ea8cec4c009480fb672a8c124a2128f0db0a3078706ee2f333384ae7805b2f432c1eaee

    • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

      Filesize

      17KB

      MD5

      6c0e006cbb570aebe778420593cb1aac

      SHA1

      f070908449865cf5b7dfe912de8b2b185740c143

      SHA256

      c15471c3823016c36da8d8de0c23ec1e644e3856054a0693c332ae9d9d310f0e

      SHA512

      8b89db73595ba68a6b724b6382c7826148a7c825596ae41793300f82e27e89da96f734133897aa6b703ccbba0ec1aa2a14c51bb3a024d6a6e0e6ff971274d8d1

    • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

      Filesize

      320KB

      MD5

      230c48d776a71bf362f5b7c8f44d4bc3

      SHA1

      dbf6bbea852fda2328c499031bc0607d7ccac17e

      SHA256

      f1adfb7cb6f70c806804ddfb2cd1dcc91849b25a0f3b72be474b132b0faf41e2

      SHA512

      e40ecbb1eab752096d240e886335c80a2726c662e3c2e14936eced19e0ee2ebc34f2c5fb2c37c01463026cb2414ab0386a47fa81fce7ded46706054d31dcbf3a

    • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

      Filesize

      1KB

      MD5

      78e0ff230da07cfe8f9bb3a7a7c70098

      SHA1

      76400a37a1864a817498290150aa5f4b3110e655

      SHA256

      d23650d8bd3a64f2b8ceb9af3c5d6ec0c0d554b1663f3e26488fa00616364cea

      SHA512

      40a25b6fd69817bc890061704f7efe67d198b1229557bdcaa0473bb9f439c7e8d1fdb6f87d2b77843589b71d077ab0298253d5ebcdc7327b623decf07d450d1f

    • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

      Filesize

      10KB

      MD5

      11a55bfd4944a57fb7cd63db9a23e32f

      SHA1

      57347d9f85250b9a97614d38a96de8167d183775

      SHA256

      fe33d4cb76337475eb90ddb9ed7bf9498407eab3f0fba53dfdc6ab83163dd5f4

      SHA512

      3b8a6226378afd1063dc9751898c54e5537ce1645f38c0cf5d48dd1572800cd8f007c839f876c72f4d7df75575645676e2dc24e7654a3b4b6fa57a17dad53922

    • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

      Filesize

      3KB

      MD5

      0b08ac58b6fac8071604dc2455575475

      SHA1

      23e24aacfeb5efc2801ec790ebed371474432f73

      SHA256

      4dae7a88dc86de62a86a43824fa93eb0996db1985b330ac552dd6abd1e2d6513

      SHA512

      f52b17d9626d6c98283e32c6ab9d74e0f5edd2778f4d2f02775a124346940f7579eddcbb8ea51cca1981d604089d8a1fe6c362993a7a912b07919a1cff1085b9

    • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

      Filesize

      176B

      MD5

      0c1808e0810ec054549c7a43e516f752

      SHA1

      b45af6483bbdb4694078100e67236c127ff62df2

      SHA256

      be860011c04c3c42c4330c3f0dd87fde277886f6cc3fce5201b9a2dad569b27a

      SHA512

      83e056d1ab762acee9dcde4bd1bebfa8b0096344e542f553c5ba04139fd6130f9ee7522775ad1507862bff1f1e884cea373442381a9f100d81df7524cabbab3f

    • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

      Filesize

      1KB

      MD5

      7a647dd252588ebbfe31369891ca1197

      SHA1

      9635a06c89ef58c1e247aca9e413c5bcc7c54b70

      SHA256

      906e925fcb0bc6e6fbc731638c2e33cc5b2d1623ea81a5898eb79f44cdd39bf6

      SHA512

      f98b116928bc4db2a217d1f31f3318a464712a7f8c7f18f72361d4c377a007d3f24acd5beb2ed800883941f6200f7a5203edea38ccc3d402b550fd5f3788a34f

    • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

      Filesize

      3KB

      MD5

      47a93ab5c00a753ece6d95fba7da22d3

      SHA1

      b735d4bba7190cfb5fac872fd5bf166b785eb08e

      SHA256

      bb1f701f7d2dd7a3067117c337ba0ce4c022334cd08b7724bb365dab6c58f2eb

      SHA512

      aa8b839b734b4a20044f192363d1013472fa801cb11ba9cf1245bd0bb82064986488a0e51ae8b19910193e6e2e67517dc72173c1f59906f42edca39e76de5677

    • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

      Filesize

      1KB

      MD5

      0a4d1c107a53e17e640983e2ca1699df

      SHA1

      df45a3c2aec44cbdc81e69890085a05ae44b54da

      SHA256

      5ce8f9d5c803fe0370fe014056551b82ac298b438e7e45534c217bced9d4e7f0

      SHA512

      0b8c3017fa85a4d0681cfd167180501d8fc163adb9ed3ce2309fa2f41039a7cafa71633b8c02701eccab95d4380aa176476f55106904a2746dd19d570f3f6fd6

    • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

      Filesize

      28KB

      MD5

      beb25fc18eb213be3c5c0af72b51a0f5

      SHA1

      31d29abc4b40e70dbbad9f42b80f38635c7cf336

      SHA256

      a0d99ed4d487bd32e2c879e3c3bc7cb6a9323438231ba1d201151ac6aeb49313

      SHA512

      59c00d7354a7564582befbc606e7cb20b999462dfccdd0737c6c08214aeaec3f7f49569c2cf31e0f7775100e074e9f71f7bcf002629f4becc273926da3742bf6

    • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

      Filesize

      2KB

      MD5

      7791df1278b164f71154a31b30208d14

      SHA1

      53f110114a6e5209e176a1b792f1f812286de438

      SHA256

      3eb9217b233b16d09ab3f5ee329c30a2b2be4f3594d74b4fb6a3249d6e7555ca

      SHA512

      1c825a3934b97ff89eda302ec8ed5c51e68e46fd02cbd99340d6a574e12c58dd192f54c6c0e8ef0eeea11868491d262ccb18da955d28b68b6637034262bbd857

    • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.fantom

      Filesize

      1KB

      MD5

      17fda408c3000d5fc61df649b9cb5176

      SHA1

      dbd047df4a4c8d419b961cad7a60a7f04aef79cf

      SHA256

      725d7b453a86883f6de430172d8e9bc15817192199313b0d5a197910c1175715

      SHA512

      0f71887877ab307e457b324bf9d9a05410f96291136f1ac4c7149f16ab3971effbb0ce7e156fea7424b6e575c958dd5cba10f705889458be723ca06b9a04fddd

    • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

      Filesize

      2KB

      MD5

      caf9f4a89b04b34f21b91993ef3d127a

      SHA1

      250c87c2a371458478bebd9c45b053fe0ecfd026

      SHA256

      ed8ad75c81d6db563daaa9d7fc09ebbc59c7e39e440a48b5a2780d7fe6792c2e

      SHA512

      d88f38ee2adff7247a36e840f12c2da7d5208bef471e6b9d5b7670f5af4bf1909279fd09b604f62108008547b3c2a27671189414bf5b5d7b5d8e1e559bf4c131

    • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

      Filesize

      1KB

      MD5

      18f2a48f4fde2fe11fd77aed8ab28956

      SHA1

      2db5041dbe7bc4df45dbaa290b0624e48d62ea00

      SHA256

      83c1ce6c6f19ccedc7235432050fbc8cd16e861312e5dda2bf836ca94b1af455

      SHA512

      823368614583d1891caaa4a0e1aadd8747579177309ee3ab42724a6f4a14bc90416b183195d003ddb46aee31e59aba45e36fbd5e6604c26a3f185536f4538a84

    • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

      Filesize

      1KB

      MD5

      f72368cda6f225344490efc8022b8118

      SHA1

      982c5a1b8301771f7850a868a793eeb20d5c0bf7

      SHA256

      764848efd6ba55f43441840b64bf7c0d30a10ad8fe259bd46fd13c347b535a6f

      SHA512

      7d6da3d32249bf608366cc7ceebded6deb2960086e6e54560155a7bfffa2da34266db46aa991a25e81d81480b597abfd130c79ca2b741359c7cd4c0b85ff0077

    • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

      Filesize

      1KB

      MD5

      f6b0072f127171ed4e4155c4e570b9de

      SHA1

      153693853cdfe64745538f4ee9bf497f8f5ecadd

      SHA256

      583a334e8ed9486b1ebca329f85b71d8a4c8170cf86a882e419672a3169bdffb

      SHA512

      7c9119d68bbca4a51dfb2ceeebdf107e858ab83030aa1f95394905b075dcf3cde3d0c01e9910ba5aa02092c134fa13ce0775461f686bcc2be50757a83788f8ff

    • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

      Filesize

      3KB

      MD5

      f70741d46b419ef75b76d53bff2efb5e

      SHA1

      6a18d162c5e8b0697b5bd65280897564cd05c31f

      SHA256

      973845f658eb3ad34ff6e18592e489d74927b27f75ef0644b47c864eb1d7b4eb

      SHA512

      0265cd86ed7d75379a8c4ae0316f4d64c0eed2231d255314ec3f65d5abc5f6cd71870e65555479922072c1be3a27ec5ce2f22f58349dbcd2b4f434a95a34a733

    • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

      Filesize

      2KB

      MD5

      9481d1163268d5b03a9e6aeffd48cc83

      SHA1

      782f132ceb9e11c97e991f5624749792d7d3c51b

      SHA256

      41a8345e193cc355e7a7e42e12add6a794e85da792ccd16caf564a69ef6d1151

      SHA512

      0cf5f637086807c4ad5a44ded89ff86aa5356d6b2cf4bd037f151536d311787e1d7f46ad963a41aeb5fa517bac04364e448ffceac667ef471f830feb7d5ba267

    • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

      Filesize

      6KB

      MD5

      e5fa66930a7a3c41fadca3b4f1fee7ad

      SHA1

      06155904ee2891fb0c690198e793748d554d2262

      SHA256

      cfb3b79214017cb29a584cf3b7a4d020b94da209dab35d90173aed639cb1ce8e

      SHA512

      121c152893701f386e4f0c4d22661a16d50d71d79e2612fefa13f3644bcfbd992740e2fe3d335ab0cae9a54059672e56ff4cb8ce3f2ae2ee19f2ff93b87943e4

    • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

      Filesize

      5KB

      MD5

      24f7cb34b939b0eb70ce9417a66d6b6e

      SHA1

      9716dab3e6f3c3d19915bb790cf4c51ab2a67418

      SHA256

      1bf16d4d7bd73326c6791cce7f8bb2708b9861e672bef531d49f096367030158

      SHA512

      4253f3df836072c2dae498dcdd92833e9f7910d3eb38a3775b1bed1256c4604a78f4d10a26dce16b32ad835230a3f26c219a2198075350e4e618c13d4fbdf766

    • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

      Filesize

      3KB

      MD5

      7869dcee40e261d6cdee16613e02032d

      SHA1

      3bad52d28f854a93612d76f538c7f61d8ffb7ef8

      SHA256

      27ee2cda741593083c76d4096415cb21d8d256f86352c698e9b6d61cc579e73e

      SHA512

      e55b50c12ab4b0f6822964c5154fba56b4f012ac41295a1eb6e7a1e7245dcac096732cb80f9af50f2d164f0f0d048955cad9661ca35ec9913fdeb458600732aa

    • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

      Filesize

      2KB

      MD5

      987bfb28a8fbec6e42a91d25dd5d002f

      SHA1

      d386996eff21223d00fce45e5cdcd15446f52e37

      SHA256

      88de8773f6e95633842d288b9c2c3edc2e0794c79e6b4b89316931edaadc37be

      SHA512

      3c73efdf404273b5f53e08e7f4b016fadc1c65b3a85d13fac40e1724fbc54960b87581689908c5228285f9708d3137ffaa38463d73038c9ac8279e046e63bcf2

    • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

      Filesize

      2KB

      MD5

      9516274f1d57ab9c16d88de107373cf6

      SHA1

      3971d19e472d2c00f45fc042ef29d8fafb0633a7

      SHA256

      9f87c643ff388eace78ea553f2eec0edd37e2eed8eb11007df767805408502b7

      SHA512

      610d82c2d9b244dc379a45a81ee5106aa27a7505af9a25a3233f1abf7d0186b21f46c2dcd53ecef5a90921fac6f1940603e0b09b5048b895fc6a28c42f58b0cc

    • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

      Filesize

      1KB

      MD5

      f323ff342a8c847c89ea627932bc1b29

      SHA1

      6ac0b1fe03173625dd37fc57cd92f1a3a26d24b3

      SHA256

      7eaae8f8f542deb25264200c5e23533fc700bbaa1bf99930497de0bccb70ba9d

      SHA512

      78e62c6ade0c114101e9f739b8a9754cd3034f15c992f20b2a9da26782a759d491065fd81f534406624931abc9a6a047653d6452617d53898cf4a31885952219

    • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

      Filesize

      1KB

      MD5

      599a3ac620ce88d4ec2ebc29a73b396d

      SHA1

      43a6cea5f001f43889fbec66056996dfa8b845e4

      SHA256

      5e464b45be10ef8f29aa132715bd13e982709319b28ebfdbce76c8605a5e8c8e

      SHA512

      65c8311208fe755dbff808344a9d4328f4e4fdddc3975b45a5c76f00baf6f783dd125e2ed7f79f7f508bc91b92030ba89ebb218b5be5157757d8ac6e9aeeef4e

    • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

      Filesize

      11KB

      MD5

      4c7ec4bbf6755f719dad7e0027a2ca73

      SHA1

      3fbba6d443ef66d2dd4cb157fd1c80381f21b674

      SHA256

      0d07e6790321449fe757bf69059c268daa5f204f97ae1d4a23fa3e64d78114b0

      SHA512

      b258de7bc271273b0e7e134a031261bf7819e4b33d38347ae33c6eec5d8a34cbd374b3dc29afd373e0a581b3b637ff07d09f390002b1136e0dbaaa4e14257cdc

    • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

      Filesize

      1KB

      MD5

      bed752a2d7bf1b99b1f2c4bda1122651

      SHA1

      1cb6a881a85416ca6e6351847c6254ae8679c1de

      SHA256

      34a6e1cc588d04746eb5fb253cf16eb8fe75d77848a26d9eb607ecc825fda865

      SHA512

      b8442c756a04d35f3a74398408ec9a7122447b4e58c77473e7baa747283274119941932938e41304132f14a939d9b46680749cd3ddf0b478abe983e2cfccc668

    • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

      Filesize

      2KB

      MD5

      dcac40eeddf25f9d4e2132d856350768

      SHA1

      320542ddbd96992bda4e684fc775a08a609e081d

      SHA256

      1c651e1fc1c42d9f0ecddc12cc71bed93a98f4bd39fe8788c47af81679c9014f

      SHA512

      24e512172a3db5ae0671376bccf091fb212b422e5b345f57caa3261c8e6d27fb8af5a166949dacc017a967b93e5b275fecaa32705dddd8ff75480c2f9b590fb8

    • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

      Filesize

      11KB

      MD5

      fbf3618d0bafd5b9ac327c1fd80ddd53

      SHA1

      809d5405e539a5f44e390ee6f26a4b89301bd41d

      SHA256

      44905d27a2c9442f848bfa7f42bad6b5ac36b780dd4386f661e2b8e708e35a88

      SHA512

      30b14b10bc8523be6249753208e7d0573e99ac2c72167315e33c42064745b4560bc4e972c6622936a2faeebb3b7530341fd5438a5c429a20d8dd0979f719cf9e

    • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

      Filesize

      11KB

      MD5

      e51474959f2af540d7ab5b24c4ece3be

      SHA1

      647c845040448bdd3677e3ac7f9fc967a5e85781

      SHA256

      c22c7cfb41819daf360466161db36f72030bfc60bc01a24df6cccbbea6653a63

      SHA512

      ded0a94303eef515826daecb8cae9a8306d0b49673e8c81d53d608c9f47e79a5095f94ba59ff787ccc6dad0709f55f77a950ad8edc0aa606728ea97aed938fc0

    • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

      Filesize

      11KB

      MD5

      b365c5d1bec105f278cf87f70cf80ae4

      SHA1

      5e7f9d63c3bcabbb11a71d1e02c9d3d5cc54a11a

      SHA256

      0e665e421df7aad88a983201b56e2c385e8a12d526407ac9bc2be989cca63c21

      SHA512

      9238ba156c317b8ac29f23e60efc099a25415e026bc8d986c09d7c072883a7ad5599a019a981251cfff0e7f0319e5378eebef5dbd93a9507fbc6e69375ee8fab

    • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

      Filesize

      1024B

      MD5

      9dc66d1fad44414134db5dff2aeeb7c5

      SHA1

      340a3628cbac31af9df5bbd37999ef806359dee5

      SHA256

      b6d3824305d5258aa6c64d887d9b22ed30b799231d3112e7bd535f71ec8f2fa7

      SHA512

      2cd5ec7f19921601fe2badec33bb86357dbce0d4ddd67259821f08858e75ad5e08fd2a664856187f3d64aa8727161cb3b7e9c5ffc72d6ec54d544875d9488d9f

    • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

      Filesize

      48B

      MD5

      17eb1d8f815b47ecacc798d362ccd0c0

      SHA1

      94c4bdc965f9fb208ff4b249bea785cc1b5996e1

      SHA256

      9296b81790ca20a5ab48f000a4408d32c82278e3d65f091e093e2c6c7699749a

      SHA512

      e30bc9f91ddda4661e5a7c8d7e3b22ef01b4e21bff84daea3a92433fd0741c547d6a0b75b7938df5e0387b6661e578abf42b213125032a7ecba762e51618b625

    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

      Filesize

      21KB

      MD5

      fec89e9d2784b4c015fed6f5ae558e08

      SHA1

      581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

      SHA256

      489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

      SHA512

      e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

    • memory/2208-132-0x0000000005130000-0x00000000051C2000-memory.dmp

      Filesize

      584KB

    • memory/2208-46-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-1-0x0000000002410000-0x0000000002420000-memory.dmp

      Filesize

      64KB

    • memory/2208-2-0x0000000002530000-0x0000000002562000-memory.dmp

      Filesize

      200KB

    • memory/2208-3-0x0000000002410000-0x0000000002420000-memory.dmp

      Filesize

      64KB

    • memory/2208-137-0x0000000002410000-0x0000000002420000-memory.dmp

      Filesize

      64KB

    • memory/2208-4-0x0000000002580000-0x00000000025B2000-memory.dmp

      Filesize

      200KB

    • memory/2208-8-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-136-0x0000000002410000-0x0000000002420000-memory.dmp

      Filesize

      64KB

    • memory/2208-135-0x0000000002410000-0x0000000002420000-memory.dmp

      Filesize

      64KB

    • memory/2208-134-0x0000000074D90000-0x0000000075540000-memory.dmp

      Filesize

      7.7MB

    • memory/2208-133-0x0000000005360000-0x000000000536A000-memory.dmp

      Filesize

      40KB

    • memory/2208-5-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-6-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-12-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-14-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-16-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-18-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-20-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-22-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-24-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-28-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-30-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-34-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-36-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-40-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-44-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-138-0x0000000005560000-0x000000000556E000-memory.dmp

      Filesize

      56KB

    • memory/2208-0-0x0000000074D90000-0x0000000075540000-memory.dmp

      Filesize

      7.7MB

    • memory/2208-131-0x0000000004B10000-0x00000000050B4000-memory.dmp

      Filesize

      5.6MB

    • memory/2208-52-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-130-0x0000000004B00000-0x0000000004B01000-memory.dmp

      Filesize

      4KB

    • memory/2208-129-0x0000000002410000-0x0000000002420000-memory.dmp

      Filesize

      64KB

    • memory/2208-56-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-58-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-60-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-64-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-68-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-66-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-62-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-54-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-48-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-50-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-42-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-38-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-32-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-26-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/2208-10-0x0000000002580000-0x00000000025AB000-memory.dmp

      Filesize

      172KB

    • memory/4212-889-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

      Filesize

      64KB

    • memory/4212-610-0x00007FFFA6E00000-0x00007FFFA78C1000-memory.dmp

      Filesize

      10.8MB

    • memory/4212-152-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

      Filesize

      64KB

    • memory/4212-151-0x00007FFFA6E00000-0x00007FFFA78C1000-memory.dmp

      Filesize

      10.8MB

    • memory/4212-150-0x0000000000DB0000-0x0000000000DBC000-memory.dmp

      Filesize

      48KB