Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-08-2024 08:53

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>fKor8HAemK6ccgB/9WlEjVKARp68igFcOXn8WUR8qNM0+PZhnOJVLz8kfBfcuFGuhiAdJd2Cc9ejQl1gsz/9Bp1HNffzxwEO6oDQsdKkn/lfU9IMdFoYdbMEnP7Uce55r/H7oOkXohkFGwhLoQDMUbLFeuZLhwoW09TQcIziX4a9c5T2wZcPZY1FpSzWT85HMi2wysidTU3j84BnTvk50d6ilmtGnfUcXwSeLMCt4bRYwxL4zXBpZGaPLWA63cln/kD0VHykQGFXFtuCQPOJDcMT0M0nYVmjBMj9736JY6rMifTyJ42D+EBquKoKoo2jPrcGcGl9bphQ9j42kTomiw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1130) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:1728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak

    Filesize

    16B

    MD5

    879d418dcfbb3026711ffe84592ffe3d

    SHA1

    031b7c58132e012f78c50f09be5609cd55d3b64e

    SHA256

    b7b9ceefba94a6ca3cd95f2c891c1552727c12aee4ce4ba9af34092682793bff

    SHA512

    c4a7fbe811f1ad31221c9f957b4771033d4e579a1d4a0f9a99c5817bacc5830221998101524be0bb7a44d6792d3e5e81c41e84e28189b6bcec4e9fe4cf1e8ce4

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    89f777ad9b879a387e8b06fd5cb49d4b

    SHA1

    b892075325bd66d0fde4c9a95a7038333610d35b

    SHA256

    4548b26a57e7fdeffbf176499e0b36ac31ed59160408decd6be4a41bb47933d2

    SHA512

    faaccfbbdc62d0c1c62c0b970e2e24b374d8f4c377ef3ccb3fd8a791abc21ca87972e40ffce2325285dc21903e605713f08a3391b9ecaf6e2884e2baf49297eb

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    2f3484eb2058de1bcaf03fa928c113db

    SHA1

    5838e596130d686aafb2346e27e7c8b72a971c3e

    SHA256

    7b3885d9e0809070dc85ffc2358f9b79ecc272e534989a9515f8695818bcaf5b

    SHA512

    6590399a5c0dc2c3eb0af61bd2e2329267c3abe01bc7eb6872c246b4a9de696a144478727a49027b15a579ff15fe3819955226a31cd23b0b4e60c13e5dd85c68

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    fe60bc892c585ce54490df5eb8b69a25

    SHA1

    691f6987dd0375d311c4df605153064f47e783d6

    SHA256

    306a12fe232e62530e543da9a1a55257f278c16807ea83f3f46fdbf4ceacd7a5

    SHA512

    164388ce6cc141f01248de1a1f65d7e6638313abd3524016fe26ff6f5a7c6f212edc9c14f098bb1a49bb2c72a9719cdfb3d9ca472a568db5096bbf7079c31926

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    647582c0901dfd9c00d1c693b64055e7

    SHA1

    81a36ea6d38799d4d407365ab951b6e4e3626055

    SHA256

    08dc2558288756e467c6b5ed250181a0d0d5dd51b38e18c66d9cc282fbc7e382

    SHA512

    c924d621e7cea83100b9ced0ee9d63e88de833fcafd9db6a539aca2e07ac7efa52cbbd09b3f93ea3a6b0edb02b1c4640b8a2a3a43987aa9e11268b0ce5ec944a

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    16fa80fb6af54169f3e7c4bab64f9e22

    SHA1

    d1672ba51f224c14ab0b3658580d65f13c3f5256

    SHA256

    c1a990fa15960dccf9105085bf0c5e6ccfc016df4fcdaade425c193ea8ecfb99

    SHA512

    819b217d2026dd1d9d4cded4fb27e6f41f5aea1872a725e35f490efdabccb8ade2a10c9f6e4059de12b72764f6a4ea276b623f3f3c29ba02423154f729005207

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    95c897d0b53521faf54604f1804c1edf

    SHA1

    fd0d008fead81701cd6c39a8b2f75f3ba66d52c7

    SHA256

    8f0d321bc72d858a99667a7f59e2a47d23c1f3560917e454c40fbeb4797cda34

    SHA512

    866695d55041f4e0cab41eec4c2be9aa43a01756a7e64352dae69040bda049be1cb89f21acf69668bcba8cd02cea1804a86c26223815d9818f8678a3a65d0c50

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    ab82e734f6fbd3ce4f483639b52917a4

    SHA1

    8d96d26870dc7c1cc76c8688d5050c3ca181968c

    SHA256

    cf63fabb2a457255d4418a423438d9c3cc3feb26f858897c84ef25b55d304961

    SHA512

    552c54b02cd3c49eae7fe283842722114c7a8491fce93a6136a7db443873da233d93b334f6bc8361e7e984f1b8f70eb375f203f0e851b950e095790666e5857e

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    861228c754852df17c6eb1e40491c54b

    SHA1

    3889248d4067f75461114a97ef63b51926146843

    SHA256

    bd0153bda284df6732aef7694e22d486bfefb3d853cce1374cf441bd5ac54aef

    SHA512

    32111e1b09b38c27e5c3cf9281d1a4040a288f8fc1b91e2a3ba5fde63a0f8d98bb34b296fd752f4ee3b5c0df42a00760793e7f87ef117abf7f7a5f960cea8101

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    f17002be225f27ca6a450e32712b5004

    SHA1

    bcabf661f8b7b182919a22f2bbf66f7faf75a665

    SHA256

    9f04c1baedc7b2048e9ffcc682c24738aaaafc621c8ba71ffe1be6fbbd7a11e6

    SHA512

    c1d7940cd82a94d6e8b1be46b34b82e7ee8abb329b380c848d772035c1632ba567dff4e33955f41c033a3a7e067e2b3d4e13d8b5fa52661042c82eb058a691cd

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    66fe6996d6b594a7049d375d8e11f6ae

    SHA1

    1356f4c4e7e6dfe133e3281b5d7512d9c81b10c7

    SHA256

    f1b1f6a447b864808cfa49dff7e0231ac1c40bbe4bc2d0a6b1bec9a2ee22611e

    SHA512

    c788c9e36f3ccf7a935d99a3a68667a227b7d2a83ff2df2697419015b4f2c8df1d336a95b7c3962e6388867fd3ce6d629d51d9ba504be774a35424e4533805e3

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    2d566d8dc3a03597473c8797f9583470

    SHA1

    ce3e6b012b977f5228f48cc862103ae119183fbd

    SHA256

    345e8bd6b8f8d5b2248afbc654f2dad29176a4597685880ecae9d2ec97d0f4d2

    SHA512

    120a4adbea1a4d7d4fdb3da999fdf387ed09e63a44a846e446dfe78e83d807d78d2e889888aabe5eeecf43e8f849bf922e063fc1d71c5b555251fa852c253c9e

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    5ce62b8be2c7ebf38cc9fe76507de8d1

    SHA1

    a296094fe55a8aa61dd98e7edd29466445311d5c

    SHA256

    c82f3b7ce3cfd51be918eaefe04927b9381102266cf9681f1d84c88534a217ba

    SHA512

    39021c2a3934f0e023452b9b0bada8e83a3dc673722a619fc481bbba72a77bba039bcebc390ed6de2cfb2c1308cb6fff32913b41008cd9fd8d859b2b8a56163e

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    b55af3269fa41c194788bcf6fbec0882

    SHA1

    355e97ecfb0e5669a76b8153e1c6c63a1da6d8a5

    SHA256

    8a4c96153a3e80513f6dc80bf7af5dc9c7707e6470f3719f29ab404558823a27

    SHA512

    edc832cfaf0e921495779f417361fa02b859adfac3f91db85ed2d1f5f3d143d1391a943397a18494f353540371a14baa080a09b2c6ef1534823fb51d774f9bd9

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    c26384d0783c18bef95435456ce0da22

    SHA1

    7f4a6f8394445f566f345a5ff134d3d76e4990ac

    SHA256

    023a02a5456487db1817293be7111a77796f515a4128e2f1e4e1490fd0dcc2fa

    SHA512

    d6a3707802e5c2b9ef84b05761ddad1b10bbd12e284ba973cb943acd147efa0def908a5ec6209110feac18fe077e48a60edd61ec1601e7e728a8d7ca330ee229

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    b2286199619c5ec0783d307697d713c1

    SHA1

    e4eb3272e6546e12a2e312ef76d360b0ddec8105

    SHA256

    eba76ceef7af2e347ef3b55b752dcbf4e8063b697d1fb81c70c3cad0b3bbb9e9

    SHA512

    94c688715f979f11b4c8c8a30f85ab9bd21cae0eff0e98176b5883d39f20f2011f5db097f30456f537c5700e6842c034b4161575e9d89bc44bdd22c1bad09164

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    67def08cefcb5b35284152c043750d58

    SHA1

    684b6f6ace3e10a6a8e1f8c7ea3eae4e70716f17

    SHA256

    93ad69845affb02222fb6d8a68ccc92dce46914a785423aa7261b9cfcfbe579d

    SHA512

    d6ee52c8560f999516b2b1f319b807b29fffd1d2c2c8a327a8a12dea42554567078adb60d6358ea8bc83a32dc66b312fc480455e0d59b9bec2f8b7c29053f04d

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    93bcd16bf68ee5ed366bb0ce48604887

    SHA1

    cd1ddf1a21d7c62526f510d8f302568fc6876970

    SHA256

    69c8a350993b5cbc81c2f0150bbd8f7e2e50245b0b7da81a57e167c1d7c6418b

    SHA512

    73430f1bb6d6bae8fdc359f4ae16ce530914cca3053c6f436a5153c6ce2cd0569629882c6f203c0a21e8af22372da4b13c1deed5a9b18aff490627e0d5d6c7b3

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    7b149e4e39b6246f9370f1b5ced2f8ce

    SHA1

    823a4c6901e8a83c04b4086adeba9a946577979c

    SHA256

    7adf78ef6f2dc08fb2ed79fb56a1d201bc5034eb82e56bd3fa9d31379af4ee47

    SHA512

    9d3c392b01c94c0812514f33984ef269b8bee48a8f77b12bf185567c8433361bfeb1ad281f9ccb47f716dca0fdb8366df8e853179f28ddfcc4e1c2dca046b993

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    223d15c584d8a05203c0e7443402316a

    SHA1

    2eafe96f0d1a82be6bd7a74128e7016b3d211dd8

    SHA256

    e92472806c877c383ec1b50f05ef243f2194f8a1c66abb976781a120467a102d

    SHA512

    40fbc7f86c01aee71b68a0d2f8ef3d005cb5d9519395c6416b0d933bd178c2aaef6b7492207587be41a4345397e31e2da9de7bddd15ed9e03b0032e017e15e2a

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    9ac0e9c4991ce40d7274ac5d5c451708

    SHA1

    c2e95bccd337bb9a967dec7a199099ffc5f17399

    SHA256

    b02819299786e560211dc7105004ffe50be92943e3bed3c5c7a3722c6c68fdc5

    SHA512

    ca6a70c20bf0b25f17affdb135443dfa8fc75deb630b4e13903183197f31f54469d4b0ff4e12f801738032bc733cd945c5d2dd41e98bed384d8c8f48ecd3be7e

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    d448e58370fd07421a9bb38eb0ff4d9d

    SHA1

    8382c49f6ce0b28e5fa2e1f1d87f1da01b93b703

    SHA256

    6c2f5ec16bad958a1b8984f5107308b877fdf64b38c08e35c9ff6e1ae14e3224

    SHA512

    9bdc0d467ceccb3b4b00b23ea1b14f36da2132844a637f9e3c3d4d19d0e3d2f98d7e504e64fffac8b1ae43b20f3e025d08d58ed8ae4dc8ab3951ed98849ec3bd

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    67a8e18b478552135e970c2b0731a7f8

    SHA1

    42995c48478b995a4d84a853ad8f9a7f07a68dd3

    SHA256

    d81e4a1351ed816ca85203da7032df5c5b61d50a3171dc80dde8bb3c2fefbc59

    SHA512

    9e56a7185cf2917fb2832589d33b906446dfd67ee20e36d14f6754f9fb6c9724839380a950b5bf1f32e12616278bf9f06005772cfb1286eb3236c73e0733fffe

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    4b8dd3948f4db6bc85355e028db24f88

    SHA1

    f46172f800b6adabcb3ad7bde85c7b1935f09e64

    SHA256

    33147482aade89b4ae8799d39033434c67ad16a3fbf14085f8d487d63ca7a372

    SHA512

    25f0a311e658d5b0a6f889b8d0b6ba91d54028c7c4077ec1d5b7089a6129441c806c69ae5ba9e5446d93a1e256e0882150c6f50a130d6485cf76a4c646be4d98

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    da57e3e9ccc61974b6ce20c05d612244

    SHA1

    75086ec177f14a59c7933ea386b0e216ac4dbad7

    SHA256

    df55119d52d7547cc66d056fece95d14580c609668c1d51818999513481c1bb3

    SHA512

    65c263529048ffce8c3385b26ec5c13f8703d6cd69665e89de584927062102d755633f03fd3ba44beb445908f464786761b1a1b818406fb4c65adf784b03356a

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    b7e411e6a2b26885c239d9d6bffbe098

    SHA1

    0c7a8835a43ea39e10bca4abaf4b78908198a4a3

    SHA256

    e5ce26d65fdc558f9add0f65ef61ccedf592364f7a25a88af3feca3d60010d00

    SHA512

    9bdad1a10829218f6920204c1f543cc3aeec3125c5189e8323a4ae534d206fa5eb8b9b04def152e2e999102a0f46277fe7cadfa90c18d62cfd06fdd8108a7743

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    e3864624776b974ccf39a6e3a1d06673

    SHA1

    7578d5636a6b89d74a9f8103b5adc931af372b24

    SHA256

    a8f5c0b1b24466a0425a69e92d2be85c68f4c6ba79297e5cc511d0778c5becbd

    SHA512

    9f05a68214280bcb5cf9fd5f0eaad70082ee127bac87e8e2cd8dee2835bde0611913328a0be18081d15118401dc5eef2be4329341a7a5ceab11e536d9810b4aa

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    26e0b1696cc685e7ed87dc637a239bcc

    SHA1

    de94f0b7d482edf0bac61b9725d659a0c07c2d41

    SHA256

    cda53484b43ac60332b62c57cf623cc32f0c05cf3c96d127daca3ecdf5b6c315

    SHA512

    06b2af48e14944390c8ca718702fdf0ea5d1fa61faf0f8f3d871f2f91b2dd16206af0912eb888f0719e7102e1192b39250bf414426f928fc7c03bce1f6aa4b0c

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    cd18ca8fc5df8c24727d9ad8117465d6

    SHA1

    5fc72ce4c5421efbfb4b33415b0317010c927c76

    SHA256

    89f44822020ade6fb674524829c74e9e79175dde631e4bbbabf68d0c2c1e0839

    SHA512

    a4f80bf3e3ed1a6843b01e855710bb0628b95152d5a81d5647434e7e1f6de194de08d19f6866c9d0a83714b38362ea05b4080464ebe14aa93fc533cf9d53a91b

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    3adc412bfef27e90622becde9778d8c1

    SHA1

    6f67da1ed4625cdebfd3bfe17c29b82d191f4246

    SHA256

    78fbfe405533c02154dd1c566f455a2d0b8fd4aea12e1e4ecf7fc727572c13b6

    SHA512

    363f81a11f4d93346a9e16f66b806cc9dd92539c53823bf48f91525b733ff1b0de85ae493f5f29bef74a46117a12f6b3fe4173f5e6aefef696a17133540a5592

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    dd43ed1642a581a87594805370211bf5

    SHA1

    330db5fe20f10dc1fb3eeaf74eaba84f3b82d543

    SHA256

    67c215a9b1d1e976f5ea0007f6b0cd91edc184b81f8a15cf6aab7f595e6f8c94

    SHA512

    ca63b3d7b36c2242b1bf895c9d07bd1036237e72bfbd136e3d410c6e88e07b6c7c4cde0be59e7be57c1cfe16392cdc26807b4ee4c6d67ad367d61fddd599b486

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    b81d5187530b479f036a9cd31a6ad310

    SHA1

    7972fe37c8f0ac98a8d0f6284a33d6643900d394

    SHA256

    1cc3eab0f5b45696f9f37bb76148975d1b22dc5356a9cf40c54aceb162ccf6d5

    SHA512

    31b2c2bf9acb85e6ca6a0cf1e16a8667eb69e9be284e62877e9c641de75a8b30045afb17d664174cec4edcbf5ebd7e8c4e60d1bcff38e74bff5220b2a901a9b5

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    fd6098bb9fc5cf8396bd017456a961ee

    SHA1

    845671ee2c25f8dee58bbbd1da05d37788165910

    SHA256

    2c95f25c2d8b50299b12990cb1a527c6f439c2a802e24bf6662f4a9318200651

    SHA512

    cbb21944c8ef51af5a1fb84eea432b57a00450cd9fa79d1ec9a271ed998c6f2370866be430dab0407d15e0a37cfc772e8cdfa0b24097b9b3a584928861829132

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    3258ad34e9f7ea87de3bcc84bf90c9d1

    SHA1

    84d5c07c6b27d9090fd7f34cb9825350f114ee11

    SHA256

    15945ff34e2ad36e8ae45e4dd6fd41fb1b608ca9edc6c4787112c00b144e2690

    SHA512

    34b94e3f58eba2b3cec4a6797484f18011488b00c58258abf0a2718c9266b564d836487ad850086ee1b65822e0eadf7d872cb0a9cac75b335eccc127b904fbe7

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    5830c875c6c95e427acb8ce2c747bae0

    SHA1

    8f2eeb2041571c10bc9880edb284de5a104d6194

    SHA256

    8897dc929c564f4975bd06dc38f7a50ad7c174a0ee6e854d368fcf76b07ddd3e

    SHA512

    11b5f3577025ad3b8d2543dcb6a94d9ee5b1e4ae94613fa858658a604f477b9daa82bc6594b42735f89fcd3030ea75d23fe93dc22e070fe998bf919f8e947a11

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    0df441d14ef5ed6c1b29211b8c63297b

    SHA1

    658b3544a98444e8fc5ab6537cc1d4feb31c79d1

    SHA256

    f873e3a6292fd3f461e11d08380bc6fd45db80db5fc53d314b76a0a35a923866

    SHA512

    e0e1204a449b6d103b4f3685664330757239f3d2d840de71806bc552bdfe00a2fcf86ba4d5eacd6f1836921a35d0c8b1dc392355b6d2d1776d17a73ca43021f7

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    c583b273050581e183faa8324e410d76

    SHA1

    8507d6d3cac6127e00b225fd735310df37b4b2a8

    SHA256

    c1aa75d5a49db80c4e6a4ea58b1d3f0875b837e7efe15bd78f6f5d74465f7033

    SHA512

    012974539846fa7274f3cbe373f7d0e359fecd883fc9e15e1bdf5897800b41ee7862a504282a6e3b930fd40cedcfa2c0e917b8547de36a3b88a9a145666fdad0

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    d971c9203b9a5484b62495c5ebfefe18

    SHA1

    92583cee0339dd15855890d8032ed435b1ff91a7

    SHA256

    a847336ed289e4b8d557946c34a7905cdfa30fb5c6d335343d325a78c309da55

    SHA512

    163ab8c6cf3f33f9441032c2109f9d01311fc29c757ab96f92e2b9f444a7ab8e5b1440972f861fb19aa6237dcc896076c46c6a273432b50fa4c0c9ba97449a66

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    805653c1d92f1e94e7b16dad558aa617

    SHA1

    68529ad31b93d9b3755f383ef9b9b973ae5b802f

    SHA256

    c6b85f299a07a944a39bd91b847288c379891ebaebf096e380277a733a2c9240

    SHA512

    59fd490b6c82aa51c213fa0b521387ce14e98d9c01479e6ba946e3433cdba7b1b23ff177f25b87bb47ac207e6db46fafc6619eaf93475b68601f388d70ec4cd5

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    f8fed5e828e8ae617e00fb6489a397f4

    SHA1

    c758710dc75a9f3a770ae8adef4ee69e9421b5fc

    SHA256

    860e88c40237af563d076d8390c9632996211b8926f54dcf538f2203ea4e19f9

    SHA512

    add432dcbcca45d5542ec7888f98ee0792b256fa5be5b2097022fa10bbd6386a0cc948e970d219fc5802b5b768169961c4dfce23ce51f55c39850db0cef6b79d

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    fd088818abe9c1e211559c2d7784b0a1

    SHA1

    80ca98b83ed139ed9bfec68fa4db1acc69a8f4ae

    SHA256

    905fd827876b8cc846ac25e18f2efe596745736571512303645a20ed95a7bc40

    SHA512

    c4acf77598c2e4fa5810a9a7920a557a9cfa5a8cc92a380aff117be701cebaeb6e140482cb631c164004c96b40ae9f55fe7e227712e006fbbca83b7911208252

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    f4cce18719ae29cfa0871ba25cda6e50

    SHA1

    e11ea0309b7285fa06b888a4cfb801956f6d9659

    SHA256

    b514d96a9cc3140be088c5c623ab755225e939ea2d63d08f03054894b2ac02a5

    SHA512

    4bb95376acabd2f5ef154eb395e2ba4b6efb4293c9c1dee85731d97df5556fbd429148e12826d32585e1bd1c3243a261baffc6728afeba20598fed7ccffc09cc

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    1447b4e739535bc44d6984b409a1c5e3

    SHA1

    61ef6feaa15d5bb4442740b07752747b804daa11

    SHA256

    a6b97f4f5e4c1718968f949992197ff45486057acc720c439832372ccd3d4d89

    SHA512

    607b0815c1c29e387d586453d0a7088d7ffa8cff115deed85351f2de9759e9d33cafcee5cd29c6c65cc43450bfbe6d9f6a5e76531c1ba3cab916791b1bddcf2e

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    0673ace35592f8119ce4aab536ab9ee9

    SHA1

    aec7da13f8b10e356d7257d8eb49ee8453ed29bc

    SHA256

    154814ae8bbf806eea1418cdabe3b2b3f2331de1f83e5c200a0bbbbb45738ac2

    SHA512

    b49613f7bfb0091cc246fbbf4175771abe19306b26d2d66cc6eee4c3e4f4030679d68818d5b76b34f9a3642730a5687981b6a963711204af593023f44e70cf65

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    30a91d498edfe74e37740f1d96fc4263

    SHA1

    c5e10dc688ce2632e0848f9f1355f63f8f6c224c

    SHA256

    3ff3522babc4269202ed92c04e6f3269d698febd0792b28788dd97ec817f31ea

    SHA512

    e429813bfc97ce50a6a1d60c565037850a901061581a76e873369d8cb21dba6fa1fea838be34d09411c645964f299a1b5a9c18ad57263d7414263bf432cdfe31

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    5b02303972f345c71c8bdf87191c0627

    SHA1

    61571a18b5771c892c2a26cb823a879ad52ffb1c

    SHA256

    211ba335bc05f0b35f0a325b35b9519d4ae399baf6e48b6914581a1c64c95395

    SHA512

    1ef7ac792fa58b4fb05f6e91e714835092746671953f4dd3a42fe825c5eb00ca7c73e3ce160d7ed148b25da466998ed6b090075277fb0de41a8b50303f14700f

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    5e41717535b396217f89a9d8579bf9fc

    SHA1

    c5e9c7562fa1ed984d9a455981481b2488df2807

    SHA256

    d5489afc9f637289521a5130ddd18e6803570207c6e4c1b0bca533a2ce192efc

    SHA512

    e6d45141d11b79591c3e30add38989ac15832fb8103fb22b2a5af59b1383c373ae7af849dbbb59a3069483a765c38f815c37046a1d7ab5f5650bbfa3f789fe8b

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/1728-149-0x0000000000280000-0x000000000028C000-memory.dmp

    Filesize

    48KB

  • memory/1728-150-0x00007FFDF7FD0000-0x00007FFDF8A91000-memory.dmp

    Filesize

    10.8MB

  • memory/1728-2070-0x00007FFDF7FD0000-0x00007FFDF8A91000-memory.dmp

    Filesize

    10.8MB

  • memory/1728-148-0x00007FFDF7FD3000-0x00007FFDF7FD5000-memory.dmp

    Filesize

    8KB

  • memory/1728-1534-0x00007FFDF7FD3000-0x00007FFDF7FD5000-memory.dmp

    Filesize

    8KB

  • memory/2500-132-0x00000000747E0000-0x0000000074F90000-memory.dmp

    Filesize

    7.7MB

  • memory/2500-0-0x00000000747EE000-0x00000000747EF000-memory.dmp

    Filesize

    4KB

  • memory/2500-32-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-34-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-38-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-40-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-42-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-45-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-46-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-49-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-50-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-54-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-56-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-58-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-60-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-62-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-66-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-134-0x0000000005270000-0x000000000527A000-memory.dmp

    Filesize

    40KB

  • memory/2500-133-0x00000000747E0000-0x0000000074F90000-memory.dmp

    Filesize

    7.7MB

  • memory/2500-130-0x0000000004B60000-0x0000000004BF2000-memory.dmp

    Filesize

    584KB

  • memory/2500-135-0x00000000747E0000-0x0000000074F90000-memory.dmp

    Filesize

    7.7MB

  • memory/2500-131-0x00000000747E0000-0x0000000074F90000-memory.dmp

    Filesize

    7.7MB

  • memory/2500-10-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-30-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-129-0x0000000004C70000-0x0000000005214000-memory.dmp

    Filesize

    5.6MB

  • memory/2500-18-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-20-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-24-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-28-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-36-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-52-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-64-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-4-0x00000000747E0000-0x0000000074F90000-memory.dmp

    Filesize

    7.7MB

  • memory/2500-6-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-8-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-12-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-14-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-16-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-22-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-26-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-68-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-3-0x00000000747E0000-0x0000000074F90000-memory.dmp

    Filesize

    7.7MB

  • memory/2500-136-0x0000000005D60000-0x0000000005D6E000-memory.dmp

    Filesize

    56KB

  • memory/2500-2-0x0000000004A90000-0x0000000004AC2000-memory.dmp

    Filesize

    200KB

  • memory/2500-5-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/2500-1-0x0000000002320000-0x0000000002352000-memory.dmp

    Filesize

    200KB