Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 05:48

General

  • Target
    Fantom.exe
  • Size 261KB
  • Sample240817-ghxtwatbql
  • SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Path
  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
  • <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>Tp/13h0JYueCaH+HlUr+8gPGzQ6miNH3LgEl2RknyXe+HVaXnpJj2cqkHwqPEnxs5OTabpyJ833X08XXS7dn08Mh5dWnhW9A2nhapfQZGeFuA0SWfJBB1W4fnDsf5rrJSyw3mviaTPVEbeSIroWQ4BoZJnhbbn3+7WAshMu4t7fMkY2MxEytBPJgR1zRm5YbScLwl8G2UCwfaJauZ/lNEDVJwzmYsimZtMsg7iGr7wC9IdO2K5bkl7/p8+0P2Jh4k+ddi3bInn99bKwPUzPE9GvXHK6iGBSaiA/I5ItpPLVQcV1CCHT5WwhDjsIcy8F1ftewTotoVoUUBu67GXvkdQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1717) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:4720

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cef_200_percent.pak

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak
        • Size 16B
        • SHA256 4a44ec309a79abfa1de0730a18cd1b6eb5590665686f344f27781aee76c8c614
        • MD5 SHA1 SHA512

        aic_file_icons.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
        • Size 50KB
        • SHA256 559340e2d0170a3c9aa1189034664883cc7ec696f1a6e5bcc0e16e1fb2e18d41
        • MD5 SHA1 SHA512 SSDEEP

        selection-actions.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png
        • Size 1KB
        • SHA256 93494d4af83126ca3715eec8a39485a7b8982a65a71ef7d52c2f75aad804686b
        • MD5 SHA1 SHA512

        selection-actions2x.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png
        • Size 3KB
        • SHA256 de093c1dd05f51dc240cb7408d29a4d464ccd6ee5756d68da8b0185e6d3bc765
        • MD5 SHA1 SHA512

        s_remove_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg
        • Size 720B
        • SHA256 9d83407c835cede8ac382c355d9e53ff2b0af5946e8c503de4e75ea56a143ffc
        • MD5 SHA1 SHA512

        duplicate.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg
        • Size 1KB
        • SHA256 c2abe949172c5b282c16451ab05a3a565fbefc39c02dda7164d3f5048913a690
        • MD5 SHA1 SHA512

        remove.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg
        • Size 1KB
        • SHA256 5379e71c3572637278eb2265a2e5915fe4f4359d54448e1638866e1c6dbfd91b
        • MD5 SHA1 SHA512

        s_backarrow_default.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg
        • Size 896B
        • SHA256 891c53bfbfef44a3c3f0d5d025192511ac469300fef653eca4f0b1a13d89e84f
        • MD5 SHA1 SHA512

        s_comment_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_comment_18.svg
        • Size 1KB
        • SHA256 ecf72a8d7cbf9f512fa86c0757e657eaabc442ddea775554b6e5b519c88f975b
        • MD5 SHA1 SHA512

        s_editpdf_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg
        • Size 1KB
        • SHA256 8bf1f4852a6e610fd3867858f2d22dba5d8c1c9d3d68b79a133d710581d4bdf2
        • MD5 SHA1 SHA512

        s_export_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg
        • Size 7KB
        • SHA256 87fda47e68102f71a5c77695deb2a12fde089ace927e64097278c05a460118cf
        • MD5 SHA1 SHA512 SSDEEP

        s_fillandsign_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg
        • Size 2KB
        • SHA256 730769426d84cb6edb5217a79f4276b1cdad8e7ca654316c69a7624ede3005b1
        • MD5 SHA1 SHA512

        s_folder-default_32.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg
        • Size 560B
        • SHA256 e787f38577a1664d1e9dcf89ffff4a27f8134aad24e447c7ec1973da9fd83c0c
        • MD5 SHA1 SHA512

        s_move_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg
        • Size 1KB
        • SHA256 e7962caa52cc32387e6ebbf41de8f035aafcd5613f12c7b865c0a5877dd42e9f
        • MD5 SHA1 SHA512

        s_nextarrow_default.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nextarrow_default.svg
        • Size 880B
        • SHA256 350457ac9fc2ebb8637a8e97100ccc122cb579b207e23cba43fe619467a75b83
        • MD5 SHA1 SHA512

        s_organize_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_organize_18.svg
        • Size 1KB
        • SHA256 14194948e48449c7c16d68f71547d87c35c59f6a8cbb187cc220526388637c65
        • MD5 SHA1 SHA512

        s_rename_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg
        • Size 1KB
        • SHA256 8b342b587637a0033b54430264b202efd5670fbc4650459ef3cc02ce3c8a3c03
        • MD5 SHA1 SHA512

        s_sendforsignature_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg
        • Size 2KB
        • SHA256 8b18a322143bbbbe42fb7025a85d27e54fea6bcaabb0196ad6f227bc823fc240
        • MD5 SHA1 SHA512

        s_share_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg
        • Size 1KB
        • SHA256 a467ff2a14d10565dcc8165dc8cf659dd4950e926fbd9d7e0d176c46b9f13cbf
        • MD5 SHA1 SHA512

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js
        • Size 3KB
        • SHA256 746f9a1b3ca52394bd84f1287e2f54d457169ed3d6aa0ac8d475e5b902199559
        • MD5 SHA1 SHA512

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js
        • Size 28KB
        • SHA256 6ed0d00bcefb7d9c6c6b5cd87ea0f8adbd6f9e9cf34266c466147d3c0aa65520
        • MD5 SHA1 SHA512 SSDEEP

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js
        • Size 7KB
        • SHA256 db26c72995a8e9d587bb187b1652d9417620fe5dc42f2f8319dca758a7b0206b
        • MD5 SHA1 SHA512 SSDEEP

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js
        • Size 896B
        • SHA256 06853c6e2c0922ee7b537698e2d31d0b9d4c2dc40ac6f12757a2bb25194f6e76
        • MD5 SHA1 SHA512

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js
        • Size 4KB
        • SHA256 ba316c97fa6b7dd6f54edb023d62078606109e26c255d018585cd50912549fc6
        • MD5 SHA1 SHA512 SSDEEP

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js
        • Size 1KB
        • SHA256 a2aef0c2e1b159c4a8dbae5203cf1bb803e3df21a627e81915b39b30a5b11f72
        • MD5 SHA1 SHA512

        DECRYPT_YOUR_FILES.HTML

        • Path C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
        • Size 1KB
        • SHA256 66c7a8b66d9a576d27804bc63bc6f91c3145feccf5f3e833fad7dcf738c00082
        • MD5 SHA1 SHA512

        win32_LinkNoDrop32x32.gif

        • Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
        • Size 160B
        • SHA256 f945379d40c8e96bc7e29d1adc8adc8607dd3bb7c01e2854c723841bc9bdfe22
        • MD5 SHA1 SHA512

        THIRDPARTYLICENSEREADME-JAVAFX.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
        • Size 192B
        • SHA256 7ef746be73858dc48ac366f44d05c7ea936f09177252f6378a7c39e1113a4526
        • MD5 SHA1 SHA512

        THIRDPARTYLICENSEREADME.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
        • Size 192B
        • SHA256 91ca971f393ad6f42d7c891223dd306f03532a555249d8490762b33108a65437
        • MD5 SHA1 SHA512

        directshow.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
        • Size 1KB
        • SHA256 9d1c9088ad02b41606077ae6ac8e11fecbbcab835c15fdbb6b6312d3f5f120b2
        • MD5 SHA1 SHA512

        glib.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
        • Size 31KB
        • SHA256 71156eab589655724552b5433f39fbf9ac9265a61a8b5f395231574600d2d6ed
        • MD5 SHA1 SHA512 SSDEEP

        gstreamer.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
        • Size 34KB
        • SHA256 01a7a550d180c6c6b24aafdad93be7c6ff12c15c4a20ecf3b89abb56d00cbae9
        • MD5 SHA1 SHA512 SSDEEP

        icu_web.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
        • Size 23KB
        • SHA256 e93a2212c907ec769f2ec8ca129fba85f6510ad632211fda5efd25d98191b68f
        • MD5 SHA1 SHA512 SSDEEP

        jpeg_fx.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
        • Size 2KB
        • SHA256 fe1a551cadf55e4b208b710496a2a9a169f2d4301acc2ecd19eb1684de5ba76a
        • MD5 SHA1 SHA512

        libffi.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
        • Size 1KB
        • SHA256 9147fd426c60246adbee839174a117c8945dda492f451f304a25577386c69977
        • MD5 SHA1 SHA512

        libxml2.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
        • Size 3KB
        • SHA256 c0186a84df1770ceab7544def8db394606c99518fa64061795ff3669e16714aa
        • MD5 SHA1 SHA512

        libxslt.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
        • Size 2KB
        • SHA256 1fab69ebbb380b712f8b39059a5ecfa06550d7b7362e3975b4cf0f448888ebbd
        • MD5 SHA1 SHA512

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
        • Size 5KB
        • SHA256 965e6001a6ef52ad1d1f414b58e34ac93a5ba6b75411a75533a17975308888d6
        • MD5 SHA1 SHA512 SSDEEP

        public_suffix.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
        • Size 17KB
        • SHA256 b4c948b2a701281b2e8f0b6f82263b022638d73f74c629fbcff0a7a0357ed76e
        • MD5 SHA1 SHA512 SSDEEP

        webkit.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
        • Size 320KB
        • SHA256 39e07fee7d4bc5fa4b7dd9a38fd30f599fb3854e7503ffdcbe675d9a73475e24
        • MD5 SHA1 SHA512 SSDEEP

        asm.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
        • Size 1KB
        • SHA256 065174c735c07f33c396c5dd9d783ed232141e2c45464b4c9c098b7e8a5a3133
        • MD5 SHA1 SHA512

        bcel.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
        • Size 10KB
        • SHA256 5c8b73f6742e357aee0efc13c8a0ca74b415b140a8b24c79317ec18cd71b37d4
        • MD5 SHA1 SHA512 SSDEEP

        cldr.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
        • Size 3KB
        • SHA256 591a7f3bac74db31bdc271067dbf61f72da32b9dff2ed7d93d63332c7ec2b403
        • MD5 SHA1 SHA512

        colorimaging.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
        • Size 176B
        • SHA256 1509cc3b2377b536c688afbc2f9ad74d58f49c43356f69418f9f256e6096e623
        • MD5 SHA1 SHA512

        cryptix.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
        • Size 1KB
        • SHA256 d4895fa674ca0c57c855b39618c7c9deddf113ef86124baf7a1c614f01e7fa94
        • MD5 SHA1 SHA512

        dom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
        • Size 3KB
        • SHA256 b9ee415b13d9ba905b6311a05e8bced076737ee18d5062699b82a8c458c47669
        • MD5 SHA1 SHA512

        dynalink.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
        • Size 1KB
        • SHA256 63fe729cf6e55b765d998acdc8155e10749e7c3c26f3cf381bf8efb46f142f38
        • MD5 SHA1 SHA512

        ecc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
        • Size 28KB
        • SHA256 d9264d5532f804820159c7fa8dea5d089154b2f2b8d7bcae75d2a0546707ea20
        • MD5 SHA1 SHA512 SSDEEP

        freebxml.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
        • Size 2KB
        • SHA256 e0a366f84b2fd40b8e7cf229bf368578d268d41e1b138006b7ccc1f26f1ab0a8
        • MD5 SHA1 SHA512

        giflib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
        • Size 1KB
        • SHA256 da3cc1cbd820b8777d78e1a13b07e51001774939b321baec44d687df7aaf856f
        • MD5 SHA1 SHA512

        icu.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
        • Size 2KB
        • SHA256 c3cfaac8767432d28de7523d74fba9258966c4f607cfebe69f71716148a72db2
        • MD5 SHA1 SHA512

        jcup.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
        • Size 1KB
        • SHA256 c9fc52b9725a54fbdff2596fb944feca4eb9e91023e29d9874ca716e6fe90bb8
        • MD5 SHA1 SHA512

        joni.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
        • Size 1KB
        • SHA256 7e0d84eb91ffc2851f623bd438c0d01dab6ce581086bbe45685629d7fbd22ea1
        • MD5 SHA1 SHA512

        jopt-simple.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
        • Size 1KB
        • SHA256 42772ac4c8b7d00bf6cf925ce8bea2b0321bd9506354d4d81354270825ff68c1
        • MD5 SHA1 SHA512

        jpeg.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
        • Size 3KB
        • SHA256 4069d59eff8f50d129b69713cde6d37bf407f8287c9052d3bd709e5bb5b42f4a
        • MD5 SHA1 SHA512

        lcms.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
        • Size 2KB
        • SHA256 5d416d5e013fd36bc353c8e1894ce98e3c01f53d979e61e0aaf715c53a987b32
        • MD5 SHA1 SHA512

        libpng.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
        • Size 6KB
        • SHA256 4588454b167b46e8d3f6e9b33fff60a88bee39208c42389f4d4e2519e0ed19c0
        • MD5 SHA1 SHA512 SSDEEP

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
        • Size 5KB
        • SHA256 8dbfb58e72c397dd72eec0279a1b321f79e921e20f8b9d9feda73ea4175aef07
        • MD5 SHA1 SHA512 SSDEEP

        pkcs11cryptotoken.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
        • Size 3KB
        • SHA256 6a7785dcaa653c955749e82bbc588ea15d8b733dc9a8c6f3f2363e6a5c570c5f
        • MD5 SHA1 SHA512

        pkcs11wrapper.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
        • Size 2KB
        • SHA256 bacf23d62007712c866399bdf7f02146c1c05dc4d40ffa558b6e1e45dcb8b1a7
        • MD5 SHA1 SHA512

        relaxngcc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
        • Size 2KB
        • SHA256 1edd88ccad5832c7d4c53bcb2d36e581de0850ce7191be2de2f0bc4e523e9f8a
        • MD5 SHA1 SHA512

        relaxngdatatype.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
        • Size 1KB
        • SHA256 45ec5613fc740092c7b13ccc89e02761cf0d18830a99957000a8dac8d414e48b
        • MD5 SHA1 SHA512

        relaxngom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
        • Size 1KB
        • SHA256 2907c4294defd5c29d0c2ade935233ffd5a33ec83b2c4eac52aca1875338dd1d
        • MD5 SHA1 SHA512

        santuario.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
        • Size 11KB
        • SHA256 a0d30a81a396204b68ed66f1e8fa52e361a748d88c2d2d88d7c2f18d6eb44564
        • MD5 SHA1 SHA512 SSDEEP

        thaidict.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
        • Size 1KB
        • SHA256 af43e5a22e020c0addb2d651307276726c500ebe670355030b95cb19c4ea67a3
        • MD5 SHA1 SHA512

        unicode.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
        • Size 2KB
        • SHA256 0803ea46eb716004ac3855bfedc127f3a88801022a2bbd776ba626865c3ca054
        • MD5 SHA1 SHA512

        xalan.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
        • Size 11KB
        • SHA256 52eabe7ef3f0121608bfb5aec98c5a29bfb1b3868d96a3f32a920c745b053632
        • MD5 SHA1 SHA512 SSDEEP

        xerces.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
        • Size 11KB
        • SHA256 f9734884a89c4373b5976c79cd87c8165b86a69748a733398fb23d91587ec38e
        • MD5 SHA1 SHA512 SSDEEP

        xmlresolver.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
        • Size 11KB
        • SHA256 5304651c40e883509dd185b87541db24d8225a50ca504fc3a79ca3c49d9c8670
        • MD5 SHA1 SHA512 SSDEEP

        zlib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
        • Size 1024B
        • SHA256 d72207a0a09e65b7c209275729e8101554f3fadb59ec24261cdb284954b7d509
        • MD5 SHA1 SHA512

        ClientSub2019_eula.txt

        • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
        • Size 48B
        • SHA256 e0851e77321e14b1f7103b0a08fb0036a3e66776013115697bdc0e211a42da22
        • MD5 SHA1 SHA512

        WindowsUpdate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
        • Size 21KB
        • SHA256 489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065
        • MD5 SHA1 SHA512 SSDEEP

        memory/2848-19-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-133-0x0000000075060000-0x0000000075810000-memory.dmp

        memory/2848-5-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-11-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-15-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-17-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-1-0x0000000002280000-0x00000000022B2000-memory.dmp

        memory/2848-28-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-35-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-50-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-57-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-7-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-9-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-13-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-21-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-23-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-25-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-29-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-0-0x000000007506E000-0x000000007506F000-memory.dmp

        memory/2848-134-0x000000007506E000-0x000000007506F000-memory.dmp

        memory/2848-135-0x0000000075060000-0x0000000075810000-memory.dmp

        memory/2848-136-0x0000000006080000-0x000000000608E000-memory.dmp

        memory/2848-2-0x00000000023F0000-0x0000000002422000-memory.dmp

        memory/2848-3-0x0000000075060000-0x0000000075810000-memory.dmp

        memory/2848-65-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-67-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-31-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-33-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-37-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-39-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-41-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-43-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-45-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-47-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-51-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-53-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-55-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-4-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-59-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-61-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-63-0x00000000023F0000-0x000000000241B000-memory.dmp

        memory/2848-132-0x0000000005230000-0x000000000523A000-memory.dmp

        memory/2848-129-0x0000000004C60000-0x0000000005204000-memory.dmp

        memory/2848-130-0x0000000075060000-0x0000000075810000-memory.dmp

        memory/2848-131-0x00000000024E0000-0x0000000002572000-memory.dmp

        memory/2848-128-0x0000000075060000-0x0000000075810000-memory.dmp

        memory/4720-650-0x00007FF8CEF13000-0x00007FF8CEF15000-memory.dmp

        memory/4720-156-0x00007FF8CEF10000-0x00007FF8CF9D1000-memory.dmp

        memory/4720-149-0x00000000005D0000-0x00000000005DC000-memory.dmp

        memory/4720-148-0x00007FF8CEF13000-0x00007FF8CEF15000-memory.dmp

        memory/4720-662-0x00007FF8CEF10000-0x00007FF8CF9D1000-memory.dmp