Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-05-2024 18:17

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>Ol3ynne8weEPuFcKaIoCk/Nu+3v++zTXl+eokKEqMwUAYQlz5PH/zO4rnx1D1rHy+nprcKPRPf/SHOsYrbgoSakuTzNDAa9BWNo0HNCIrXt5u83Y6E8hlFL39+SIr4es6xEkfYhTtOebZc9G+ZvHHcxVj9fFqojttU/MFuI24hHBCAcM8FkCC6bID0uAqPHI+97uQaN3GKKbIBONnWVa+GaOdrkF9PZmVbVzhohZGJKKG4HZjQQv9Vb9wp3PcwwHWj+DtyOEl9vOIBzmREmYCPccwqPYjF7BXLN671+nM+iuOCRolkk/qeVA94rnnJBCurg616BN/nh1OP5VmvszfQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1261) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:5080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak

    Filesize

    16B

    MD5

    fb0f8a906b72a694d4dd846629953dc9

    SHA1

    d60160d8f4accdbc7d9e6086956fc3cc4319c08a

    SHA256

    c2a2948c6394ed5b615f9931e7752876d827a8b9f27280a971dfaab8c5d5ddfa

    SHA512

    171a51bd0880d6befaec507a2a76ec2e4fe870ba7047643ab0b6f36683e562db1e03a4b43d48bd8095dd8f35e7d5601031d757b204ce0a820b454df2147c0891

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    ac73363a657bd85bc78e8b4356d65076

    SHA1

    61db39465df14fbd5fd8633c1fad08b195f1fe51

    SHA256

    e432dc79eb3d5cc9b814820c28c84b274a58f411f52baf84de48ae31a7b733e5

    SHA512

    4771ca590b265c4d26a9168f59b7d0bc2db8f5af8a4f7e01347e9d3296de6a6617c2f3be72960a341a7f2c02229fa5ad395b0ba00e6ce1c397327ff2ac28ba88

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    eda3be8a3043716b37f932b0c126d557

    SHA1

    3dda58e23e7a030bc9b70474f27cfbb1609a5a54

    SHA256

    eeb2f0546e872b2e68c4b2d2f9ea1546b89cdb3bed7fa667c571e9771a0ccaf3

    SHA512

    3c90ad92fa0897ce86011880195cb2ccc8f8a3017a0bc8dceda449dc299945635fdda550bff8a5bcd121adc88961d86d5a2085333fce3b272d27104b1735db01

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    3fc0e3ae2367572f280fc5a6c5f5b354

    SHA1

    2e764c590b7dfb2e5bf08cd8f694953c610b8ad0

    SHA256

    4f6d83299cd1973f0084211cd505080c3717a40423dacc3e1dcb882f11132c3d

    SHA512

    fa8113cb6b2107fb659659d2aa8105b0c39ea82e4c0d5879725dbc95f170d888c54c5810d28f53f95d08fa8038dcfaa27689b237d7319a08fa4c1011ae1386b4

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    41022ea38d10ed7199801c7cb7f5b1b6

    SHA1

    75e4bb0e5ef9baf29b0b744d055c3ebbab50dc15

    SHA256

    fbb08d7b2ea0929b211e2fdcba93072345f3989e776375ebb97739a58714d76e

    SHA512

    f64f3e20b10f9d4306fa77b43dff00415c83effac66cce07cf6064771d103b67039f34789df70858ccec09a87fb7464eac1661d0dc822537e7ebdb505ea89d2d

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    e55d68c7d2169dc22ae69798efbea2ca

    SHA1

    861ab50c7ef20ffe7c132f1fee1f76cc7d5aafbf

    SHA256

    00288c1ea0c8a03142c3479bd024dbfece5fed8b4cadf61501e51061ea858be8

    SHA512

    6c5e25dcd0006489477db9b8de6abfea4060201eca52122c5b51a18966fcc81bae4a055a99cc54efff61000693bb5b9cfe158c3e3646f87c64d6464575e31c86

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    f82b20dc75f2bfd6eaa842dabfaf11e8

    SHA1

    4626739d2fa2c7c486972fe11a226ac6afc5187f

    SHA256

    43256407ff1e756f1ff770e953749b01e5aba578965d67aad0cbe29adf0df20a

    SHA512

    6a1c64bb0b300de3f08722fdebcd65c7d5e9f53d1255da559b0616bb41d312d2fd64272b520037ec6509059881df1675ae19a5ff497a35e7554883927bb9fb1b

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    686acdde0882a96d9809cb0fb66e85c3

    SHA1

    d7ee860972531280801c35f7554f43827a1106ba

    SHA256

    130a5c9a8c1249b444a0fdaf007c731b423af6dd1185acaa04c7d2f81fced777

    SHA512

    0a8e214ea965a9a9c8d19217b540a4d42ce99b5a0116109fe87c073f241cafe3f805d679213c0dcd2da08bc21ea8199671430a14fd9062b05a774e3e73d4b13b

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    3a2a893452e9d34f542a844a17f69187

    SHA1

    308e6c38bb40ec639083e7a58983da77658d8322

    SHA256

    04c6de3eebac8a917434edcfb02623bbbc94d8c23151458a0c7e7cb81805b139

    SHA512

    db058f708dfef7acfdcf76a065d711b2f86935180dedca7349861b98bece92e981b829220b6b4c45e088ae18918396dd698f0002c19707a231b65b5bcd226bbb

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    c2ecf9eb1cca7175a322184db7ecf8ee

    SHA1

    c987947599cbe3922c1409ab95fb515face655d1

    SHA256

    cba03920d3b6b4c0236c364d842c7578229f362c176b095fd146f35acc3d35fb

    SHA512

    273073875a0a97d4e7cd415ed10657075e01f90afd587b2d0cb32abcae144bccb8d1a3c9eb4c33414a67603b87e4b4b9afeca3de46f045df33636c3736a4ff7a

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    e4171c137abc550daa01e02c1ba004b9

    SHA1

    f970abcfffc4dd9a4870e8884499ac46462a6cb2

    SHA256

    9effe00fbb8c57867cd27e60b0eec1314a9c4ebd0649b5ec11d951d910c2daed

    SHA512

    8c169d47743681a57fc15ecc028d09f70f8b344e9e0a7155a8813f36ef9b9d57f6c000597bdff5ef0d64606edd26c91de14e754d7e2a5764b5a8066edf50c1a0

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    5c754d23f8bea2d6d6b52f33c88c8390

    SHA1

    2fafc091cbb83660b79313c9cd9d7a9f12c74b1f

    SHA256

    971df17da7c036ceef236375a2ad85c967835e6f651effd92ee96c551952430d

    SHA512

    6af9729c7def0355517bbb6e92204cc32075795bacb245c8772779d39859ddfb52b6640ab0dea665d8add88d7eb26b42e122365b5c20e8db20fbe1c0af12e342

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    c1cbed5d8007030e1958fb97df73fcac

    SHA1

    77d077db44560b684517f833b16b28f80fa72dc1

    SHA256

    30d344a0fe0227d9aec9252d5c89294f96dd00c97a065bb81504653a5aab1bb1

    SHA512

    4eb1efbf655b6324affeecaef06a0b6862a3454fd0a58c9458ac06c80cddd9fe4c146c84d9ff0d6f95d8af96a214b0c7c734513d5c30de7016b284f2e50e1919

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    60a967b99eb679494d6c899b91086080

    SHA1

    778b6486d8e91b01e46c75cb9dd959cf5e61e2cc

    SHA256

    54dfa39e74218e673574a3371dea52b17e6b27766884b0483958ffdd6e79d95a

    SHA512

    15dcd162784c7d12e53bb4da7919fade14a042b4689d359a5ec9455bb36cdcef729b8d45f904ad7e468beb1eb0826ae40eba02683671024ff86052786bf79fd9

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    7fa521830a58ed6a844a8485e8a2d78d

    SHA1

    501844f9ae0a23b4cfa8355ec9fadfd8fdb0012a

    SHA256

    414efde976c87628239b5f4cae660317a5e894612dbe7ba8b34a13dc1c7ad347

    SHA512

    025d4fe8a19aca5ece36d2ecc9109d4873451700cf81a9b37efa31d51b453ec5503f81bf27292222dcdd6531609cc6028ecd32afa0586bd7ac3beb78e5a54dc8

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    a7e782f54aab6a92be985bc8ab3c95f3

    SHA1

    3c14d065a48f65c8907bd07108ceedd243d612b1

    SHA256

    4337fad5ff7ec09315c4cb2852ed5129ebd17d2bee91ea1a9b92c6a76134489b

    SHA512

    c1f4fccaa79c4a9118d30f15e808a01afa69d581f85f8ca3ac04f54488608b7c3e7f9097e90e20d7d21682af5cc5bb40211b0ac4d0809a3f99fb0fd734065197

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    f676aa29cf2906910a6a04d9f09209e4

    SHA1

    28d914c16c4c37114aa5ab0a6fcbe59a0990114e

    SHA256

    7c31b3ed44c0f33d9d87b67766d9a0788b4c46aa65cb3b7ed3ab6b534a586d42

    SHA512

    9f86f892d5c2fff5050c37b9e19c70e9cd8ced029ace0c2b7160cb19994066c776717ee0b1d63a8bfd97bff42054bc56f2080de4398f3ed3018716d55df8d191

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    48fa2c35c7b79cd89a149128a67bceb3

    SHA1

    6843c7f5ccd93547e6f40aede314af35dc23d4dd

    SHA256

    f1fb53447845dc0c324c06dfb36798215dd70d8ff332129553d330c94ad5ff28

    SHA512

    181c0b1062541364b2def82730fa6daa48ddbe102d19bfca9d64255656c531ff3a55edfc4c11a01529a77b90625bfcc0ba9aff01cb14a2f8cf76e3b06c285815

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    b3be487142ca922a1267a315a79292c5

    SHA1

    e599b4ed7b255ea889bc799791638526e95dddbb

    SHA256

    e1b260c69e1304dabb32f107e9b0a30586989b0f3f5bb5d8d99b111839de7ee6

    SHA512

    39aefefee8621317f521b2b75e87595e7e3e606b266c1ee38a887be3179e565b51902d1b28ed10bda07ac555125d046f0cb896549fbf19cd3f2315471d44b175

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    305843c79ef6b140e9989b425287618e

    SHA1

    301fc9c826666d01f095a4d9353b738747cd4a13

    SHA256

    d663ba9b8bc8cd083d72058b3a9c5a375cffc77d1800294bf3f1a618e46b67b9

    SHA512

    856c64d0991128c870037134dbf951645a5af9b21f4e0da5a68a23f3f82decf1e9b7007b99b76118aacbb6e903a9f7890060f3009d5abff4d11caf987dd09871

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    e128d9e8606d656469ecaf2b20bbbc72

    SHA1

    96f5fabde3ef694467e7efa4229cfb65aea60852

    SHA256

    2d08a72aecede78f065170dabfbc8925ccda059d9120427481f1d39a0404087e

    SHA512

    db7cf118590425a83374df7428433d85f37e6bb23df4a0f007884e00fb542e65f924e15d522a52a5c84bd6613d2ab7ae5ab81d0dcec8b764859c560b9ce2ffc4

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    f2aa7784e100db466f2610dac6894f28

    SHA1

    1c51b36a7b68530c8b117840fcc23efaa7503a1b

    SHA256

    d92a3bc64f208f2b4c002a1e3814adbcbc98aa92469c3a016e12c437620a1eb5

    SHA512

    2286277274e240e2722b4e389a7d95d11382419ad1828010b2f36f8848b145ad8420b94812f36200c1a57135b1bc325b93825d6b9f19ce0748ba7c8d9580fa53

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    ff390b1317d8b465ec66fc910493fad0

    SHA1

    929df422d1670e92aae463fc50c69227a6f127a0

    SHA256

    b34586785fee89987549a5e15095de01305d290233bb5481f6f1c429da61bafc

    SHA512

    7a10547fa3a1e428b790cc048062a85bd663c70ab404ba88f55fa396d1bdac0b55ebdb7cfa5ebc20c1f5027de469974a3e28da95fe676b8387b0e17679670d23

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    813928108b6f7063c4228bdf30d8aa00

    SHA1

    c78dbe61b38bf997b0dca1ff0f2f7c9db24bdad0

    SHA256

    9e93068fbec38f9576b4e1af3d1af55009954ad15e64f67ed52968f355ec2d44

    SHA512

    39b928f6800e876be317a9e735ffc1a84034ddecd80b2afcec77af35a4a112481c5e7a863451d048f55206e2d99022f106384683e96cfcfdeaabdd813a62ce70

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    f53c137c2c6c23a72ff2414c65440b2a

    SHA1

    e6245d3c79c1103b909369a7253b44607b98db47

    SHA256

    39323d581aab48db07e5d35372f8888bef774030355fd6667d770ba8896b0d76

    SHA512

    a946094efe42a945d0dc894abec754b2ebeffc5167bc33dcc4ec77a08d51694a532de40b448a5e17421aacbe0c6de77da6aa4adea990ff56e2833db6dc346c9c

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    ddad64183203dff1cc37ff16bdc61cf0

    SHA1

    aeccc327e6e1bf02a3f3702b40485c441efe0e38

    SHA256

    bfa3e191e32fe2b69694c1fa4a4e7ae5cded9545761ee29accc72eec2ee7a712

    SHA512

    6b155e0b912cf2f08be340ff1599992def2f26a7bfde7dc8cd19a1c4e3c4fa32c78841b10f7d47c0b7e1b03d1036763ae776a1711fc18b74aee426e6aa6065cb

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    71e18152fca07a03d68f7d117b0c6efc

    SHA1

    d9daceb182bb93a5b0eee54e6b8b523d252ab819

    SHA256

    8a975a87a39ffca0dffebd7a7f50b23441871f7fc2e716c560214d3bde0b5924

    SHA512

    28bf774854a74ec556f3dfe0aa9d50bacb704ec8e5b8635417713e4e2f3a7cccf83aad268dea5319eca00bce96d5219b41aaa4fb6fac45a80e6e66728afef352

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    7ac1a92636e382b6d0c0503bf4bd0b08

    SHA1

    d49afcf211bb1205a04909ef6e5e4bbfecbce9fd

    SHA256

    825d2487a97cf103d7d34a0569d1fd86937424a49411f82a4736445e43894ae3

    SHA512

    5e849ce72316f583328a11e09a9549ee9928cfee719b350ff57aedb6c66e55e8899d9ecae3852b2dc7a0a86755a06685a30cfb53fd6c6247796b08308aad1feb

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    1f4a00ee8d32276c0db21f1530b33257

    SHA1

    908e9520f8d73031fca9d86c067e54f4954f7924

    SHA256

    02a8428a3b4738833f184e8b57861ce1ec6468e95e1eb51efbf2d71e23b04f73

    SHA512

    99b923d2488c19338e526d2e073173a104295e85f1a4b64862940aa5a0736d73354837a8fad83757a65607f2ce1bfbe299682b9ed5bbc654d625f5caf09fe2fa

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    b7ad72901994bf8f74ba4fbb786ebbed

    SHA1

    21131747fa15bc15a8f18a4cc961cbdb0f8e2b60

    SHA256

    67c752d5371e4503e6ee0e2e57cfe68f9ed74ed74442bdf2353a5b904d3760cb

    SHA512

    e0e2c9af86241c29689e639d3fc1e4ffbadc8ce44f046de6147fe2b6cb262fd44873415456411e02cc0d7dd1b99ffd845dde92c1c01773025368368f294d126b

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    ef4154a7e200fb7786cb9ed513fd6209

    SHA1

    886bedb8aeda7ed0f07722bcda74c1b2bc7a40b2

    SHA256

    35c41e0255ab976642e4650f5d954932b78feadfc6654a2c1ab2effe1dcdbc6b

    SHA512

    6212d7303cdd3ce277711680fe2b060c4718a1d8230b5cf5bb5599dd8869ae8d33aa7b57b4b76862bd69a31860c477b83dddbac9747a978d2a73357baa731415

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    36ac4977ccc9a43e7f45a5401a064961

    SHA1

    69be7d0c1b4adf6ebe4ec7b45eff44381d23a45d

    SHA256

    4c59bf676061da478dc92cf48ef62cdc0fdfef71bfa88c7f029c8e8c13d6e6f3

    SHA512

    49f6a7b59c7bebeb961fbfcdcbd582b230adfbbe9a4858aca6e3843d04b93179538b11ed2ff4a0e5641348eb66623acfa3b6c6955eb476411413c43a0adc8c10

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    9fdee4e583a8f5fda84704d8f8f10b7b

    SHA1

    8823e319bc9c2ff21474e955f428d9bc1561a458

    SHA256

    0c39cfa636e8b331c0173344c25223bc3c0877243c877dd3e622247612561344

    SHA512

    ded11376bf13c9938db9c988eedba8acd9128b8e8cd7045a84661edcbb7dbe1390547b17b876f3eefe048dfbb86d8cd2a66655ce771475cba2f4d54ae46ead27

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    eae0d54b141f471ee1d8528104d4ec43

    SHA1

    9f65c9a60a33027bc326d34aabb1fb7fa20b23c7

    SHA256

    126f74a0fb64acee6217405f4720a9df7bf469e9106000f54fe3a5b820e2697a

    SHA512

    3b9e3abbe827620ee89e7aa198b217d48c0bef0d91ac9afd9f8ede94c43420b69d9bc666955ef88012af165c9bb3b899a4e00b3f46404677f9e1134e7e7e949f

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    31ec77cf62688582b63c9b3e5c4bd4bd

    SHA1

    5dbf50e6bb1b7c9a5b26da9b4ef873f865749f2e

    SHA256

    3c420ee695d98ad051d90ed6a8083116a26fa8d66b9b2a2474f44ab148643070

    SHA512

    fb8952433a55f6e8bd19967fa526085ba93dd30c7c89cb5d37b539ebb59d48cdf4639e17e861b68129a09df4e0a227e2ef7a2a52e6fb3807b614617c1f691cf2

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    ce664e40d3c11205b97a18c090aa3705

    SHA1

    84b1a422ed0fdde67c6bf4ab4f32f383fe78eb36

    SHA256

    4edd5513c8d79bf907fe9df45aef51d2593b5079313873de5ff0780bc174b0d8

    SHA512

    50d72f49328c4321903e46344ecb85461e378589fb11899bd89acb483a706eb593b3a31b9452fbc6e0b9be65f240029436bda74bf0afbc2df583cdb4eec69252

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    ce06bd7fd3ba5d964ef0b45aad6bcda4

    SHA1

    a98c2158125da478621d26e8826579224905eae3

    SHA256

    9f5d3a1d0f23b852b3868e57b1208f05a9dbc6eda604628d2c73d436e51e475f

    SHA512

    133765b99f94401a6414ea7cdcb8c8e7564a23ef71e2e8dfc6c580619ed350e5b7648841eb0b37674181173d8583f84fb21b78cb77a625327ac5854e88421ac8

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    2bae7d692ea3dcb63d1eba31187c62ad

    SHA1

    88cdf1e48e81cb4130d5e0b37a0307d0284804f7

    SHA256

    8e6c26aa810e8d44c5ffc421712425f59ed082c12d739ae44ebcb563b52af333

    SHA512

    9b1a14295fc438a774272c7a5cd07429f4b463b975e6b252ee2089b30d4d660b738f6d91dbd5f435e8bcc2b73d3f88cbc1b7d2e4fff5b6c98f744bfd6ab83063

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    9ed73990d979e69674e01c6d1d4369f8

    SHA1

    d7a77751628d4fd0fdc545e0bf29d8168437de78

    SHA256

    fbbdc0fcf0eef502206b1bce15342acce2cda716ac170ce8deef43118ae5a2b1

    SHA512

    2d499c1abad765cfdb6618058a123d7c6b574e8676888ac57d01773737ff729844ca00282ff030207414bfd13e10bbf297fe99ca5d92885cd7add3ec137ef4f3

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    3060c427457f7caf099926061ed4f2db

    SHA1

    8541fe030a481df347e3b6f770fcbb2dfeb7b906

    SHA256

    2c4d8940ab47046334496d947022f6277fd930b8fae9b63e4433c23984d21cf0

    SHA512

    50e4dcfbf620a95d511190e1483c0845e1cfcaa380f417b2062b3aa5d1c4aafda101acb391bb0013c86a2aca087fca04f7727eba59973defd62ef7ce1fe7a3d4

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    cf6d655c01b71538b2d11deeec0dd523

    SHA1

    d5d24930d1b2609577f35b5de72327d3840ecfbe

    SHA256

    e700f28a008dbe2b3e5be8b26700a0f0a0eafafa175fcc9dc091a55ef95b0594

    SHA512

    49eadb9f00007de68ec7f6a1bd425b6e1d6accd987e81e6d6c3e11e9bc2b85cb3d21086d21db0b8d0301bc864865194775a9d6827fa3b2ddf051a98a47c6a883

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    00e14dd011ac89d9be0bedecdbabcaa1

    SHA1

    fdc8f09b904edc982387ab79b2183d320657f768

    SHA256

    c2e9ede01fd16ee907c28bb63b5e8922bed97bc5412fcb05e512d40993aeaaaa

    SHA512

    da4435060375c5fcc36d35e3ba3adcc23edbf8704574245aecd626725b21d4bfd629c32872a7e348f9e470a0c433fbc6e8b9a9cfb2663b6800965c2be15bceb8

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/2548-49-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-45-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-136-0x0000000005360000-0x000000000536E000-memory.dmp

    Filesize

    56KB

  • memory/2548-134-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

    Filesize

    4KB

  • memory/2548-1-0x00000000022D0000-0x0000000002302000-memory.dmp

    Filesize

    200KB

  • memory/2548-2-0x0000000002410000-0x0000000002442000-memory.dmp

    Filesize

    200KB

  • memory/2548-3-0x0000000074EF0000-0x00000000756A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2548-133-0x0000000074EF0000-0x00000000756A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2548-132-0x0000000074EF0000-0x00000000756A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2548-4-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-5-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-7-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-15-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-9-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-11-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-13-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-19-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-21-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-25-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-29-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-33-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-35-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-38-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-39-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-41-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-135-0x0000000074EF0000-0x00000000756A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2548-0-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

    Filesize

    4KB

  • memory/2548-52-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-53-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-55-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-57-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-61-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-63-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-129-0x00000000049E0000-0x0000000004F84000-memory.dmp

    Filesize

    5.6MB

  • memory/2548-131-0x0000000005130000-0x000000000513A000-memory.dmp

    Filesize

    40KB

  • memory/2548-130-0x0000000004FF0000-0x0000000005082000-memory.dmp

    Filesize

    584KB

  • memory/2548-65-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-67-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-17-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-23-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-27-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-31-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-43-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-47-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-59-0x0000000002410000-0x000000000243B000-memory.dmp

    Filesize

    172KB

  • memory/2548-83-0x0000000074EF0000-0x00000000756A0000-memory.dmp

    Filesize

    7.7MB

  • memory/5080-154-0x00007FFB1E7B0000-0x00007FFB1F271000-memory.dmp

    Filesize

    10.8MB

  • memory/5080-1457-0x00007FFB1E7B3000-0x00007FFB1E7B5000-memory.dmp

    Filesize

    8KB

  • memory/5080-149-0x0000000000850000-0x000000000085C000-memory.dmp

    Filesize

    48KB

  • memory/5080-1901-0x00007FFB1E7B0000-0x00007FFB1F271000-memory.dmp

    Filesize

    10.8MB

  • memory/5080-148-0x00007FFB1E7B3000-0x00007FFB1E7B5000-memory.dmp

    Filesize

    8KB