Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-04-2024 02:08

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>QRPASkJEzHtzJBET+vKvuD6IJvG83YNG06uKa3wLrILfXPtc6IX3LQm0ard9JtyrNBpYP6Kd6m+Si1orwGO/Dtp7kJjgwOjCLuD2rge+oNzd7HX9cl7dxpXTIB7Apm5HumAriX56pI2eOllbnOj/Wp6PcezPz9fdOafpKxsjBJrSIs7Dlr1JxNbVJ2i70HlcngsBPtJNRdC7R0O17ZsBcDoPVYjJekkQNh2gOY2cCncxERcs8lNMfkHWz0V3WtlrHauOvbpJyEKC0vev7H5yu+0zTV83PcLZLgEJIDR9p24rjMM/ei9rTGl2iPHnDdA1pxYQErP1kFU9Titp3/nyPw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1027) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:1576

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    b54076a275ee8e0c436bbce0566f25c0

    SHA1

    92058094e9c5a50b74745aff1a6b3b5326e6b89e

    SHA256

    1d370ea57ce7d8ff680467897e1a7873829c95240626f83694f5b1dc4682a7a2

    SHA512

    3ad6567b938bed5220c2942ec02478e8833fd5d29d22becc9295be102c1f956ec9876a1b834d876ff5bed645543306b58412a6c6b7ce99a26a81d92560bd07f1

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    c9cf4f42be486a11f980b9b2ffc58947

    SHA1

    abdac9c59b3941b26a8c6760346820699c865d11

    SHA256

    2877fc96d39f2e108994c845a0353f29c6c307e4ba1ee33964f8089675af0301

    SHA512

    7ab39f855f230446aed558d00d0ea1a7c6f884a7db58ed55b12556139635669f2717c321ec908f9936f20892eb44986a4c67c84c0501f2bb7852b1641082d28c

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    ae6a60663a8be056a03c02bc71a412e1

    SHA1

    f1a88f47c6de932ca7991a9bc72eb630920ad0cd

    SHA256

    2985e97423232e553a5eba4e8c89a92fc8b9a0c5876050516d60f2286df5dcbb

    SHA512

    9ce0e0b591970eacdd815cbfc6a2cafd4e3afe105ba7c97e925a795089e457b20bf42661330135ccfc3db205637581e327de2a40b9359b1fee18058e199d6f40

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    955f8fcf61cf335cddb9774cdbd06847

    SHA1

    e674cbdf56b843e7dbd13ac204c9ec03c7368de8

    SHA256

    b5c488d2528fa42efa2f679d25eeeb12b372e1cbc8e80ba3c933762330265356

    SHA512

    7376349bc05f9d70838bcf557b148587ed56128c14dd2c3300ca9721470cb09934c7686d44c7e1c600aee06f323ae6aa77851feefe001643f07cf556c29b0a1c

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    c625e42f2fa7b340bb7246d9177ef991

    SHA1

    41928e6344a244e9174a35db52dc6b4ad7d367af

    SHA256

    48ae8d0d77e3be1899c80c893605763683f90881e29fbc751a2a237d29cbc0f3

    SHA512

    a4ccb220b4ce27c63c725a8e8f3594c20ebf20716a5a61435efee911ce52348d8378502c2fac87f507b5a2b63ca6a93723058993e6c069e024e33b11cf6dee84

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    457b794c19aa84264181943cc91be68f

    SHA1

    825dd63c32a25e1762da0a9a1b2237bef1c342d0

    SHA256

    a289ca29d988dd00ebf5b75f7dd71becca21a8109d990f564925e3d19d21d024

    SHA512

    7a07abd95b9ae96f879bbf3ba0bfeb244d0260b32a17f0606e385f8c071ed93c9a32c891bc283e4148a40560e75324a3984e9faf08883da62fc48e71755bcdcb

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    e3300d7dd5439086172ad2a4ea984537

    SHA1

    5e97a280512c2dc871272409f5ba8f5df3a735a3

    SHA256

    7b32d613d48e1f7dcef9824d34982fe92ad37a2a25d1a4fdec85ebefd9c400fc

    SHA512

    0e2a3b969852f6bc5e1b1dc91972b35997255df440f123f365f61f65755e4a978c4ea26c18089d44bfa0658248e64257aae6d4d3315105341ceac18bbc996db1

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    046b3e44a0fbd7a48db390aace38b885

    SHA1

    50ba797e94a9e28ca6e8a49b181acd3595282204

    SHA256

    249cb5cfc05d04a9c4f7950bb25a1beb5be7623432fefcd210ea3359d338702b

    SHA512

    fece99b3ca96b941e0a4b64087bc4f07eea02858f914f0f84c2909d9cbcee1f248f469624bf5b904833bf35d259e44ec4b4fc54603916bccca61af4d6e38f779

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    7d922c209b6cf92df3fea0f09612c7b5

    SHA1

    81b4a778355e6358fb9d9c1fadb2a9a0a8e0b494

    SHA256

    9e9eb6f30d43294074518aabdae219d001ffe078588152f6c1cf7565d4022e52

    SHA512

    f5ab59391013859dea590263f1a3dbb0176966f79e9866da359aba82a5e69119fb1a1fed077277511a885046e7e6b564f2516b7ce2990ea6f771fb0fed6d10b0

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    b211add51845b4e2e1154320d1a4f9c0

    SHA1

    729b0fc83cc06318851d733b8e2239e0f30dfbdf

    SHA256

    930a01417d378317a42165cc97e996e91142f377417e7d05961ce39e6d18331a

    SHA512

    b89840d5e83b3472f7f5788d4ed320357a3a1aab0e928ea193b0bcb37ac836abc15215e8d40a092d0a340d6a228c650bfbb738b82dc08b648cda31f2bf6edf9b

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    e5a869c1d89a56e1853503ac6c6e2f8a

    SHA1

    30d453fc855137aeeec4403ee6ff522b47d3a674

    SHA256

    433293d9e6dc9d385d15bc3f9c3afd1282d490e7a2da36e199e0e9f80f121602

    SHA512

    b699547da71f4bcb7c251777f2951165c49c688686e1d9f0cbf3fa8d505378ab8df93114e55a4fa612a43196061b29fbbc460e8206a10c7e223fda1868f0cc31

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    23e2ce9f15ec42b451ae55be2a700208

    SHA1

    94b5e5fe15941ba355364dc0c070bbf497a53086

    SHA256

    8bd8a69fbcaf36c4acde9c105a797efaa482f19acb6e2c498966da19d9aa5aec

    SHA512

    94aee164b193e900158bd0a66e122a08f802e0d38c3385abc044cd8d3b719e3cd22a81b7b188cef8308d2f5a2a9090bbef69d66b84b7140596193ac09cd5c3a4

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    95fd2fb03f086042442b446082faee5b

    SHA1

    1c81078a950af6e215773e56f7937a904e2691eb

    SHA256

    345b9756e78cf0774e9bcf99ec9e1939e845c0ff6f42f5f79e7eabe1bec512b8

    SHA512

    568be2dddcfc6dfff49e471d210645770d5dd231cf1cd12077b4dbb851628d5ed8ae2cb83d18ed6bfef0d5eb6a843c0e7be09b4a1799da18aeda65eeb63ce0e4

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    a5172fa9811d49a34a6942dcada30e80

    SHA1

    6cd34ef228257b03f0391ed29f6fc50e4deb66aa

    SHA256

    459739c7d3bf3ae4b490a82e04dd6c3cb44d4747feb8c84fa2d306fb2ca9baba

    SHA512

    a1ecce7e841ebfe325123a0539ff29ae25134654ee0c32064c5f6a4d144a28cfd1076843e6c4d242a910672fad54529a0589aaa9f8157027079c499738db5ac8

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    4cda1bbc99457e6c7264f81c8c6cc579

    SHA1

    fb0137a13d17ae49cc45ab7bd128b6bacaefe6d0

    SHA256

    c27736156f69dfc788cbe064da46b82d8bfd7fde78851fc86db2b6c7f8d2a50b

    SHA512

    59ca3e926a80a161d9b72e8f2a3a210140eb590f858818fc7057b64b0dea8e77c65e0c1785b437a7453c0c15aece3c177f66fd9b1d915356baf11dc75bcc10ed

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    c22b77fc340cc0fec5ab6c7211ed5ea9

    SHA1

    8ae83ee0f6a13b971a4268ce7cddd9267dda9d4f

    SHA256

    40bdb47f7c01d95e5978e44c6a80fffe7c90069993f104757133216f83e1e7e9

    SHA512

    b75463d5713546460962a571131d3a9df3d2721264f1bfc3cef0333e2ba218d98f075e8ebeeec2939853725a7bfe64e1631490407e9e5a36506825dc99db5628

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    275c164172deb01679c6076291a7273d

    SHA1

    0800e3ae221efcd1fca3d51684eb6c4d3152d4c6

    SHA256

    5c9ad615c58f1bebf15dd151102bc212dd646179e3f5665173df91c480eb3c69

    SHA512

    1e03d66933877c7a779c05f0d95a480ef25e2cab3f962a45e2bad667707a4b8e62e28f7ac788dacf7aa80644b89e455fe719391a66619259d71c97c8c36d6945

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    5842312d9d9ed41c25b46824814906ba

    SHA1

    ddd252d86407ddaf369acfc7cd859ffdd000982b

    SHA256

    cd45fb660775fda768b9c92cbf567492ad3d8d4f9de3a58a32e4372c5ce7ba7a

    SHA512

    98e3bd45763ef6b7586f40a4dc1449306c6bd7c3890b9561c05c4c27f0765e182c08ca29c108cca208248963891da547fec2935f161833a036a06e53531c6683

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    49572506bb2f540a814a23736d026b91

    SHA1

    59b80b933afa8789291cf4633fa5cec48a0eb700

    SHA256

    6b24b2e7188c47ee708d9316b7e6d1b7efdcef5d132997286164b0f09d11bcdd

    SHA512

    e922a84166e1912cbd9b98c72f7765dabaac29d6cc7e82727d7bb1a19012f918280af405eddd7322c35c201c98ad88ffb4b85e294c0a7bc10ecb8d49d9fa80b6

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    03acdd991a95b323205667a9892ff348

    SHA1

    623a9670cf7ee4540a748e3890a1373a300d6a2c

    SHA256

    b54cfe5efb542ebfb4c13f50705c0cc355ff832d8727bab6d9eac3d073121839

    SHA512

    b229dc903fa4e254fdb01b72693b7bdf0346a98b6a3f876b9e68a1e89ad62cd22e1b1a0a019d15626e5d5b9a5fdb450c2852558dec67d2219eae2e9465d02411

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    f1bf040dc94b5ce832b55e0203613337

    SHA1

    e002de128973c070d0fa8d39be9a67ce3bc2b419

    SHA256

    3a1f99d9c8876d835774d69943b99f2d1985c99807f39d7a1c7cebe85f646de0

    SHA512

    ba3f5f8768018b1c721c057fda894b8219a0ed1de91b59a161dc4a924a3c9dd9097a6e93cef90c2116b46c2cf2750488ae3b5fe2e0cf72c6e9d6fa3d05b23867

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    3ae1079d25ab92f5f8461c81d4a58e8a

    SHA1

    b5eaa490691d2e26093eb446311bbf056e95a066

    SHA256

    6a8e0e43baf8f1d86e147eca5c2d3ff364dab5cacaf200e78670dd6f6ec6089d

    SHA512

    7165b457f6da598933b856b6c966fb038b6b75f205f431c9ca6a5c25acf4f3bf921377de2c1dd6a40057df497dbe30029225f464b2520774b30efda136fd035f

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    c43e623a9136ac42aef5143c72174d15

    SHA1

    da4b9a6128a2eb1aa5f987b73f11b75c82838644

    SHA256

    600ccfbf9ded2a895e09dc5c1115fbb6b388ce6c612ad94b4e1e88b0e4f9a040

    SHA512

    7bbf9f404f1cb3b9e00148491671085b3aadeca211209450e711a4e0331bb9401da41b395e3fa14ddd082a73bea421d5ee92946f41d5e4f9a22bbfcb085b5f66

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    9c435021776cf60347c767b966330d9d

    SHA1

    d4a0b2354edac9a8d0a7f3093d8e12fd8f0017a9

    SHA256

    f96b1b3fa0030fdc9a4fb41015b5569f59a2e96f6e279ff9d1b99fd28caf6cae

    SHA512

    0cc7f6068584973838c4b89d7dd1c7dbe19414e843c5415cc57af74e1f9b7f1f8ceaefc3d02c30d1b39fd9b03f1303251b3cf3fa828030b4538ac63ca2d6c34d

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    ffab0e1cd13ba47b84ebb32003a40e3c

    SHA1

    bb9493bc8f63f40900af405707df1ec88c67e3ec

    SHA256

    dcb340a15a11c4e5a2d0fdddf40800fa37e7c52c3eeb3978bcfc5c5c4f75258a

    SHA512

    37932806e68343bc63a4f358a6b5e2a755608a4caf03adcc4222cca5095af00d44ed159f151514f31eb24bc47ed42f7fffd381cbba429b9981a2eb37f00a3568

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    cb960e718300ce4477b56837ac75d332

    SHA1

    b3e4a6fd715d388750dfbcfb5a36830fa47858a6

    SHA256

    82ccbd378352204479374e1388372308805208be0ac8285129caa6d5a3e24682

    SHA512

    4c41e0b9c5d655dce1d41d7999af0d44c2edab7c93c189f57a924a0335d63d35e2f2ec2737f616923e0d65cd48ddd52dc62b9edd9fa15596cbe54cd284f2f5b7

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    caf64798610482db649fc3c907337016

    SHA1

    bf99f44e90fdd2c3f9c499663c2e0f85c81f62af

    SHA256

    9535497681929c7129c6983f3d81e4b35d802b4d3f16ec9f64934b1800d3de4a

    SHA512

    f9946651b549f2182417d182a995f4fbcf265927484b676fa67c76ce89918fc84cb871818c621550fefe00d19e879f73d15da1bce940adefcc3480c215f68d81

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    ea408558dafd2f0ddddca503f61ab078

    SHA1

    e5fbc1052e8341ba4ae208941826869b542c2d33

    SHA256

    5a7241de3fbf19e9fba1c70c48d267e0a6807ca566834007cd99431994966aae

    SHA512

    097a631e627d7342818a0dbac78a45e932d073a4a3a1e17204918a4227a809b61469dc73be758b0e673e5d8eda495719faa3a31ac54b75de165c6414a26aa9ab

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    6fe453123b88b3237eeb9649d18d8d39

    SHA1

    af6726b2f84088d4e592485d074f96606ee0687f

    SHA256

    3794b595d77c73e90540a5b9250618fff043ad203ac3fbeab767b42874ca2cea

    SHA512

    4193ec3f443516bf924a9ecb6c96305481426e1277050e5ae0f87cc037583d3e948afe768dcd315d5f275d0550fcfd4f79337bcd35ff3aae3fea1decf1e04920

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    c7bce12510bba6959ae530631a9760b1

    SHA1

    7fee4964194aead15726b17355876a83c0a332de

    SHA256

    3497de1472e5ddec20538337345e3b3c4af1c8a1474899c91462ff1430a8f170

    SHA512

    141d9c3f53caa697e29ea048d67941f5d54570d750b08fbcee52bac369db588541c179e756dfb0bc5ae85927131b603ac7d7d8bf0f63cfe1bcb1fc90249048fc

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    17bbb2f69432067f3ca4c9620e2e7f44

    SHA1

    b42f5df1fd2409ae7ad78e858bbc6fa66c9b8644

    SHA256

    0a36706e3ba65fb1e761e8cee00c3f67095d1174911ae52cc881d0a4f3ce8422

    SHA512

    6fac9482b5a727964d1d7516b1222ea84d6c779bf0d81539a88771fb2a17211434d79ffac04be70f119762b8094035c00d6e62dc90ba98dd5c41cb1540cc6cad

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    cd160f194140bc9539fa062895828de8

    SHA1

    de736f16da807302a2cce595cc962d24b094ba4a

    SHA256

    52f7f9be60cf1dc49b158594bf6fe8e64490ce8370a5d787654adadc469c6911

    SHA512

    24fdcd543c2688fab52c7490112529cdd82c255b0e5b28cdce3c05cc5c1cb6aee5a61d18d6e0325096fb435635ecde4e1ee6994f30f2aa32e79b986179bc662e

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    04bfe038fd1a49c4dd918b75df789df6

    SHA1

    81875964a7547d9069576e05134b2a38847c9a5c

    SHA256

    88a4489d60c6219a3883206225c81f3a04cb9fd6ed507009b67b355699750562

    SHA512

    5fbc42a3e96044ce8a7742cb87a3d1f0f69875d2642e38eeeafca68b7b3541e81aeebd988d56ed0390757d316614a6482966e700b240d1ae8b0b6c1ae2dee6b2

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    ef12e73e5253af48a65b13d1ae00d0e4

    SHA1

    b29de46c632763baec10b7be5475aa35f6c6def8

    SHA256

    c1135119ebf3f6160123d795d07eeff3325bf14c5cf4caf8198790f3d7e2d8f6

    SHA512

    d02d175ad43bbeb92e4188124cd1633aef211b358698f4ac3d63431873291e8560f96a2b678e6ac8915871713282346d48c0987d45e4838678aebdd63f442fc8

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    d2cafd77d407ba9fd9e5f1d39b2c1e42

    SHA1

    12704fa5b3fa0a011e2b49733def70c5935ec9f1

    SHA256

    c46b49a17cc206532f8c810fc9cf50b6d0df2f89b538749817eb7af2cd619659

    SHA512

    60823d484b8d587715ae8c94ceb5bb05fa32b4a53f8b00d70261213d80ed9ff0135976bd26fe908fac214eaebd52d18e368d5bb01055c7a86b118739d1ca1bb2

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    64422db425f11418b6e2fbed5efb41df

    SHA1

    c895eb1b9c9c64e47da8abd5d0de91906e27a557

    SHA256

    59a0e4f8ec6dfa09ca91cbc5d9fa3db9373fc9caf01e71382f7a9a5229a16cc8

    SHA512

    39d8d1069698abce69b1cc93edfec2b769bdc41d4fcd958a0b2d3afaa6c845d7e9c71620f19f84811857b805a264e24902733c2c3709622a0bc92c6516efb4d3

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    23e0ac26ac393208fec85a03823e20e2

    SHA1

    c52f3bb8a85955ea6e2c9e2d052bd135efe810c3

    SHA256

    f306a773b4ade03a3c751315f7180f7076eb857ec7aa4f269880bc96b9f8a6ff

    SHA512

    82d1174d4d611752a40deb58bb549f9951d79d08f400eb8c3df78eb5db91709815631319a0a6384b892eb8e951e0ab16f3d93ffb1b4822294ae70ff651bf702d

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    fc02d77fb2e2b30d91d0bbd1adff0bda

    SHA1

    20e18298b21027794f94600eeaca347cbb62e73b

    SHA256

    b44709120d94d0237a5bf3e26d0201761b08bac9c7469c67b940f5b4928a8a0a

    SHA512

    47b8698e60bb37a04c92b14bc6ef81e657edb9aba6cd0b11501e0422773d83948713c7103c9710b1ca95d7ba474619686b58b2296f10891425a2a75c7404aa63

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    0493adf80db365f149f3534b49ce251a

    SHA1

    cefe5a264b72467f623ff09a0d65321bc05ad175

    SHA256

    40757006cd54a8ebbea4fb9d6235ce091444885f678bd703369c061dfa4980a2

    SHA512

    09aadd94b99591eb61c9986a690a382f7e8ae3313ea4c761c6c0a436fbd183c7c33a43c2e86f3181e804a6f3f3642cafa31e9827d450c9ac3862575b8140402b

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    aea62267665842dc92a03f235a7aabda

    SHA1

    4375842894f2015aa02b51b23ba61aa0b2c6048c

    SHA256

    1192dc0ec61cdf87d19ec5103b04b68d0b3db5df7a0efbcc01e4807f0da273af

    SHA512

    e3e536717ccf49b0376692248bdcfabb9db3dcbd5d418913660de38163145f2d69023943e9a9cff80869cba0a1b13bc22d22b0fcaf52c40af600fb19289c1592

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    365be41a3cafd3ecac6f130f11e1146b

    SHA1

    66a9feb9d57d5b9e7580fa453ef892abbdba87df

    SHA256

    c84d28c83170b5f64d901dae0aec6b52503dd13b6c9e6a94b421507b062fcceb

    SHA512

    c024746442db25b0be8125a000c3df04e34de00b398285e85b2f5ffb490bc09ac7214a6e3dc2e683d02ed88247d3ef24ddec2e3d5f0248b5a18b5f1352630dd3

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    d10f60954126e1a1c0fe5bc6cd95ecc2

    SHA1

    4a74a2971a099190ca079f7f0f71229b163085c1

    SHA256

    2a8051f8d22cb33f5c314b1805cd749a29aec852b69762bb1c2a119c77501de2

    SHA512

    c3aa223f28ddfd3f4e7738d3bc94e824178d3f5147698fb3f96e3770d12db93c7426163f3269b31b5b49d955e3dfc93632cf2c3d4eccaf550adadd2ecded4524

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    5f5d63ec995a9a7952f5980c6d6f52c0

    SHA1

    d680c61e202ab9be6ef495e15f2e4039535104e0

    SHA256

    49dbe23d9a003831f55bd19d360b89f030ea51de0bf5aefaed2329cfbbc9f060

    SHA512

    f46e71620a4f9ee487aa82744d6c69748ca42b921a402bcf2b8f7c4aae91f2dcfc97bc826b63ef0cf65fc08f1a9b3ea974b3663597ec69e79d35134162f21178

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    560c48a569709a10555e2dfe64124ae4

    SHA1

    974429dac2669f9d7ad3c253d226494eebbbb975

    SHA256

    4d2e7e856f283b5e6ef3abaac9877b2a0f9035629c524068aa1708f2691a49ec

    SHA512

    de5456b99841f899a17969f04a808f928772a8502fc6fa4f45ecfb00dfd73dd881831aa95d88481e2d8d93da0bfa82dd2c2efe75a028b0174ff42022222687a1

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    189129d955f80f510ed09a40102a63e3

    SHA1

    a293f9e97ffc927b97ec5115d71b020d8e958130

    SHA256

    5e38a006a5165f653146d22d9321731ccab97377ca6bb6ec6c9e37805268cdbe

    SHA512

    19a5bf72606a075660fe71d1a4c54bfa05834bda53bd442215346f77745614587ce9b95289e94e87db89303fc7bf9ea2d4bf424a10cbea2fb3f7942c6ed8dc85

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    67e9ffac9e95ba31f05252689d05da7d

    SHA1

    95cea4705dd28e31637aa614068fb73c7c5d8c50

    SHA256

    06095c1f9081838d9683a869644bd995491e71249018ceab70bf5133c6afd63d

    SHA512

    d8385e06a72e158d815cc4a2a9ee3c3414146e7fbb75fe8fa0dc3c7bc3ed94dc5338cc3def6f254db6551096e291890c5c66f0bceea12d69cdda937a9f364604

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/1180-46-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-54-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-1-0x0000000002410000-0x0000000002442000-memory.dmp

    Filesize

    200KB

  • memory/1180-2-0x0000000074ED0000-0x0000000075680000-memory.dmp

    Filesize

    7.7MB

  • memory/1180-137-0x00000000055E0000-0x00000000055EE000-memory.dmp

    Filesize

    56KB

  • memory/1180-136-0x00000000024D0000-0x00000000024E0000-memory.dmp

    Filesize

    64KB

  • memory/1180-135-0x00000000024D0000-0x00000000024E0000-memory.dmp

    Filesize

    64KB

  • memory/1180-134-0x0000000074ED0000-0x0000000075680000-memory.dmp

    Filesize

    7.7MB

  • memory/1180-133-0x0000000005360000-0x000000000536A000-memory.dmp

    Filesize

    40KB

  • memory/1180-131-0x0000000004B10000-0x00000000050B4000-memory.dmp

    Filesize

    5.6MB

  • memory/1180-132-0x0000000005130000-0x00000000051C2000-memory.dmp

    Filesize

    584KB

  • memory/1180-129-0x00000000024D0000-0x00000000024E0000-memory.dmp

    Filesize

    64KB

  • memory/1180-130-0x0000000004B00000-0x0000000004B01000-memory.dmp

    Filesize

    4KB

  • memory/1180-34-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-62-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-64-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-66-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-68-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-30-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-42-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-50-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-60-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-56-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-58-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-52-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-3-0x00000000024D0000-0x00000000024E0000-memory.dmp

    Filesize

    64KB

  • memory/1180-0-0x0000000002390000-0x00000000023C2000-memory.dmp

    Filesize

    200KB

  • memory/1180-48-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-44-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-38-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-40-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-36-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-32-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-28-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-14-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-26-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-18-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-20-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-22-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-24-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-16-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-12-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-10-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-8-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-5-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-6-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/1180-4-0x00000000024D0000-0x00000000024E0000-memory.dmp

    Filesize

    64KB

  • memory/1576-149-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

    Filesize

    48KB

  • memory/1576-151-0x0000000002E70000-0x0000000002E80000-memory.dmp

    Filesize

    64KB

  • memory/1576-1203-0x00007FF9CC700000-0x00007FF9CD1C1000-memory.dmp

    Filesize

    10.8MB

  • memory/1576-150-0x00007FF9CC700000-0x00007FF9CD1C1000-memory.dmp

    Filesize

    10.8MB

  • memory/1576-1601-0x0000000002E70000-0x0000000002E80000-memory.dmp

    Filesize

    64KB