Analysis

  • max time kernel
    75s
  • max time network
    53s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22-09-2024 19:54

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox fantomd12@yandex.ru or fantom12@techemail.com </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>jESl2Min6p1G4aXRBqi4P4of6dgMwqhF/VEhd6szJQ1qOjYZWoKsG9zH2XAFMHx6dH/aP8Gd4uKTtsIi751gYXLayM0v0IlxK4duo+TGQpEKj48EqlpCkkKfY/B9B7rukSx89I2m0oIIWI8lzMq6hH5s8JlS2gwS599WinI7C8o2XBnoB3qGOEGlMMi+LyRZNh/eFEqa7QhtbweoRTO3otM6nzhoaSebkbZNBz/gDSCUVGLERVHkocj9vCNiONXk+bzD+cYNr/k8kfB2hBdz2E2bLYl4m/0UabSlR/R/cmvBUBF8s9Dt4yLkHNdM/78e54/3SYdAxvV7NYTVIt6CTA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>
Emails

fantomd12@yandex.ru

fantom12@techemail.com

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (873) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3536
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3816
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\OptimizeRead.odt"
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3128
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3872

    Network

    • flag-us
      DNS
      240.76.109.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.76.109.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      ctldl.windowsupdate.com
      Remote address:
      8.8.8.8:53
      Request
      ctldl.windowsupdate.com
      IN A
      Response
      ctldl.windowsupdate.com
      IN CNAME
      ctldl.windowsupdate.com.delivery.microsoft.com
      ctldl.windowsupdate.com.delivery.microsoft.com
      IN CNAME
      wu-b-net.trafficmanager.net
      wu-b-net.trafficmanager.net
      IN CNAME
      edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
      edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
      IN CNAME
      default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
      default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
      IN A
      217.20.56.45
      default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
      IN A
      217.20.56.44
      default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
      IN A
      217.20.56.34
      default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
      IN A
      217.20.56.35
      default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
      IN A
      217.20.56.43
      default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
      IN A
      217.20.56.42
      default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
      IN A
      217.20.56.36
      default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
      IN A
      217.20.56.37
    • flag-us
      DNS
      45.56.20.217.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      45.56.20.217.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      68.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      68.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      powertoolsforyou.com
      Remote address:
      8.8.8.8:53
      Request
      powertoolsforyou.com
      IN A
      Response
    • flag-nl
      POST
      https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
      WINWORD.EXE
      Remote address:
      52.109.89.19:443
      Request
      POST /rs/RoamingSoapService.svc HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/xml; charset=utf-8
      User-Agent: MS-WebServices/1.0
      SOAPAction: "http://tempuri.org/IRoamingSettingsService/GetConfig"
      Content-Length: 511
      Host: roaming.officeapps.live.com
      Response
      HTTP/1.1 200 OK
      Cache-Control: private
      Content-Type: text/xml; charset=utf-8
      Server: Microsoft-IIS/10.0
      X-OfficeFE: RoamingFE_IN_76
      X-OfficeVersion: 16.0.18115.30577
      X-OfficeCluster: weu-000.roaming.officeapps.live.com
      X-CorrelationId: 0356fc92-dd1d-421c-beca-247eaffd4621
      X-Powered-By: ASP.NET
      Date: Sun, 22 Sep 2024 19:55:14 GMT
      Content-Length: 654
    • 52.109.89.19:443
      https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
      tls, http
      WINWORD.EXE
      1.7kB
      7.7kB
      11
      10

      HTTP Request

      POST https://roaming.officeapps.live.com/rs/RoamingSoapService.svc

      HTTP Response

      200
    • 8.8.8.8:53
      240.76.109.52.in-addr.arpa
      dns
      349 B
      965 B
      5
      5

      DNS Request

      240.76.109.52.in-addr.arpa

      DNS Request

      ctldl.windowsupdate.com

      DNS Response

      217.20.56.45
      217.20.56.44
      217.20.56.34
      217.20.56.35
      217.20.56.43
      217.20.56.42
      217.20.56.36
      217.20.56.37

      DNS Request

      45.56.20.217.in-addr.arpa

      DNS Request

      68.32.126.40.in-addr.arpa

      DNS Request

      powertoolsforyou.com

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

      Filesize

      1KB

      MD5

      8f63e2e1f7aa452adaa95e9af6a72aa2

      SHA1

      095e5603e3463dc4b6e5fe89643e1ab3eb1e1fcb

      SHA256

      dc27c7aef94100392a952dea1b300f19690dd9a667f4cf6b0f6250d0f9f0dd94

      SHA512

      b0b4ae124fcc14b430439642f59fa065cc8298745823b99d47c846da392091826e6ad17b985423ff1f740bfd767d5ce41b526c922b79e0b21ab179cd11307349

    • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

      Filesize

      160B

      MD5

      f5be6022bc572e944885ddccd8ba369b

      SHA1

      ca55b02adb7f28f8ef00bf0708f265a24734179e

      SHA256

      83909602c8593c8ae1831edba6470b667d49e31723a7971a1b7ddb81d6d62d23

      SHA512

      bafa0738fc1d3bacdfa7e68d72b18abe038da60a13ad9ba76263f6ef30c2c79442563d0ffa3aa13fceeb1d8ce2dd9abbf918e83fc91f66d1b9ee1b9a2fb8eb8a

    • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

      Filesize

      192B

      MD5

      45c47e1afa1ef8d94abbb2b818fd7c2b

      SHA1

      fa5d7394c5eba694c270aa58f3cc1caca7ef6698

      SHA256

      d50bed86e1a3f784b5670529fcf41492c57305d941a3bfc09fffb0864819a45b

      SHA512

      573176500e7c5691824a1f6324527b959cb81bb9e4d9ad18b8edd5f4aad001d5ed14b41d9e253788692f136eaded5e199f53a2b422aaf64a1e584010a2832453

    • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

      Filesize

      192B

      MD5

      a8b3cc7494ca8d145381f31c409c3ee4

      SHA1

      1b90f188f4264c363f602c40fbad94df016fe19b

      SHA256

      adbe5e288c9d1c1b24b17c80f1408d9179d70c873b74fd224e6486ec491f283a

      SHA512

      3351e8c9f5922d1318c4ee04c17d9e75835bdd71f0f1fae8892982f84b8d9fde2218563f6348108eb9e43c4217311e742ae67329ab2e251f8406138ee9e05fc4

    • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

      Filesize

      1KB

      MD5

      16bba240e1b215ee0c3e53d726f0eb1d

      SHA1

      d0164df1494ccffe9e616dc228a2c0f23f796d76

      SHA256

      10822a3e46f2400ab6dabb23bcd7d4e812549801b0e7b494e89607b2b6ab9541

      SHA512

      8f72c8c5eb6fdad4566613108936ce3a22e6b471cd0a45db529a3095929f313d04870c4d1a26057a5910eced76ea3bef9f0153f72f180a1d187ef0b2491ed69f

    • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

      Filesize

      31KB

      MD5

      1f91dd7191cff649b5c49b51fb0a3381

      SHA1

      819a41aaae4fad11278f1f0b4d2a3b23856ea4d2

      SHA256

      67b7a296af22cf260f79448323409f75a9cca9ca3c5a9ab32cb416b3891431f6

      SHA512

      1383a030868c8fd8f1fb0bc88a1c8b8f8bc97988421cf25cac864d27bd5af5fa810b83b5c8df6588a6dff9eb5e953b76a558b2325597e32aac3ee89ac28d448c

    • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

      Filesize

      34KB

      MD5

      0ac3764303d2bf87af744ef2753b2dca

      SHA1

      fc4fbab504336ef06b663cfde5c1ff3ec20188b4

      SHA256

      ece82d4c8d5863476f140e3ff3dbdb499c376c2ea4e4e7451438b7a5765c00bd

      SHA512

      b19ec035bd61397eba08151d5a4e3f7bec69d134d563c3549d90054d539c3fcf7e9166ae64a1a633f785ee08c079e80406049187df027a43a581f76de2c145cd

    • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

      Filesize

      23KB

      MD5

      96ccc7be0987912283e1c5a4c070c7cd

      SHA1

      b1f226d4749089d5f41cf8e780946da822331872

      SHA256

      73c0c8e5c770dced5eaeb154d129a77c5704a4394d94ebb4756b535dd7476d65

      SHA512

      bb6306f4c166fc484a58c8c2075db51bae5a617c5f5cd6818950c729cb1c69bcd2006e04c9144de1ced7da631545edc9ad01b5a79ca54e8af44d0b12d2cdebe9

    • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

      Filesize

      2KB

      MD5

      9252e1e71da501381c49ac43b000740b

      SHA1

      94edd034933ad7b7d4662a17ab2aeec0a5b61ade

      SHA256

      f7b33613415d68dd4dcb238c24c13dc0c02df6312d9e4b54d7f0b6562a6867d8

      SHA512

      569f3cdab25330171a9396d53d6703080d07748a090847b88603c67dcd25e88da3b954fe4d3bfda935b1514ae07adaf02720658c1aab995c4c97fe3e82af72b1

    • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

      Filesize

      1KB

      MD5

      a2c1f008482f63fb57d37c1718977d7e

      SHA1

      1facb9a2c5dfb2bbf1ab86f2dcfef2565f7b0fd7

      SHA256

      06bbab22f546f62ad05bb1f7f8ebbb63e3ef8b020e9bf1f405b267b7356ff501

      SHA512

      9c617f59281f5365a0f70e6ea7e3c2ad53a267d9f0ab01165913bf85613ca1284849fcfc305004db8a81d7e0fbe08027a587b065e99162387cf5fc8084727641

    • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

      Filesize

      3KB

      MD5

      3c51b9dd6748d25bfd3cfee75c3e3a62

      SHA1

      35930f43f9a68311cf7a1abb0d71b368e8c426ae

      SHA256

      64b0be9483aa9559836d7649319b580c72e62db2747fbbe8e903885966b60c15

      SHA512

      a6bf52fedaff5bca6d81c1caae2fec8b1cca0ca59b32286759ec98c7fcbc9ee98b82baf875a3932ea6ad2a2949e895c7b4ff5f79d54881506e69ff560259b462

    • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

      Filesize

      2KB

      MD5

      84aeb0d073df21bc60e395d1f7ad5cfd

      SHA1

      3e34943b2f404e82a457259ae65c9686e2a8ae6d

      SHA256

      44145d6bfdf70f027588f7d19c5763ea9131b2b3be376967cc593be1f6ef0830

      SHA512

      c6aa3e87ac533729ebe6aa1343b93cf52a1d41fdb8301387d284ab02ecff70046aa172014f6a2b96922bfe68a47f108e7f5959433a60978387b2ab87670509ef

    • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

      Filesize

      5KB

      MD5

      857efce4073bce380c8a4cfba7902272

      SHA1

      cb5af93d98c312dc708835d14f6fb7b219050539

      SHA256

      15db646269177d35655653408ac34dfb23e41b8ad9a9cc7f2383d28e3c4cda5e

      SHA512

      0d100b38174af3fb93ef931edb85a828338d6458b5e6562cf5cf914c37c114b0d339270014eb64a092094cb6174bbf862929d9ae42b542d923256581f47e305b

    • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

      Filesize

      17KB

      MD5

      8bd26571e5fcde7792b18e4a22afaedc

      SHA1

      a325cd67a6e8b9c575b27151ed1233e22e4d6efe

      SHA256

      2cbe5a536aeb41c524b1c710f2a4d186dcda0edad5584231df935d9ae33c3e4c

      SHA512

      81fb1d23ecf4e3c0032884bdd0bc6a198d6cb192473b85e06820586451b0a435f53faee0718e29a339dd945b9a1d8a2f518cae11ce7336f65812b9704c1b456b

    • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

      Filesize

      320KB

      MD5

      f24d86632d64a0b27ebc9cabd5c29f43

      SHA1

      3b39c287aac5bfa4c6b2e066f0a28803bcbb7486

      SHA256

      73af30a47488dd6e037e97dd157395415f9db9f3fa698ec6ae6eb47f7ce5d532

      SHA512

      ea96eba1e59c0342684f35d213ace65f106710b70fac1f837c77cb2f3fb7a4ac5bd29cbdfd73ce44821f459eda4fe543b57c28d3ba72f6e245f3e23e84fb8683

    • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

      Filesize

      1KB

      MD5

      75c3d0f03abe4c1970fd3bea5acb35ed

      SHA1

      49c943d9cf8829b589d6b3881091c4ecd897a1d7

      SHA256

      b18ccfb019326a22f6c6deb0e3d17303c799e44e9a6c6c50edc96d155e640d58

      SHA512

      612e261570480ff5748da236bf04f2ce39c71ccf2c7dd6a45e568077230352dfee90ff6fa917ecbf5c750e827d86744acc616f8ad889b448f37bb82d8d2d8f33

    • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

      Filesize

      10KB

      MD5

      adfccd70d00a8c667e1d42062c0c9cfa

      SHA1

      16bd00598f66ab9950d0fe40a62e8bd86f6d57f6

      SHA256

      e24daa16ad6cd2e50643ba900dd2bc591339d93fbcf25ef49467075132a27730

      SHA512

      96a33b941d12c7619801285f60bd2ced690debaaaaa4e953315d0ea73ef219ea6e39922bb086239b7d0ef2150c486268d690a0c02615ab6ac6a2389cf4ec3f6c

    • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

      Filesize

      3KB

      MD5

      64852031943a87c5aed6a7c899aee318

      SHA1

      3ba85d0fd19b42a6fd19e0f91823c4d5a0944248

      SHA256

      3085d1d2d5f76a349850080f72718bd06d02d53258f45d65e32dc5abecc98196

      SHA512

      6087613f075e6880532c3da4298f67947b3f51917d734072563db99024021928c8b415c734de5beec08acb6d915e18c8d81f06557a9d17796806b9c8358dc872

    • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

      Filesize

      176B

      MD5

      93e30a2effb2a2cd5abbe74ab1593e1b

      SHA1

      ffbc944a7ff0fca9b793814ef114ca981a41dda4

      SHA256

      6c99899b0ff3889408b62490faeaf3307d9c8dc742361202f49df5793253b8c3

      SHA512

      6539fe9658c169d81a8babf98c7db9676e254cff16830815aeae7ea0a23f75400bd50ac5e4eba1147e83f0beb8106f2d1e30135a4d17203abe4015a83e05d140

    • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

      Filesize

      1KB

      MD5

      0725a756f834267ae759cc25b722422e

      SHA1

      01e6b942aa484fadfeb9aaff40b34174f9d11ca5

      SHA256

      71769a759b53befc7ac00661a996be673f3121d72dc26fac6a5eff626e9cc7c3

      SHA512

      e156eec9e8d9abd26d5644f26bcebf22193002e90a77004ff6460a54b7e521cac23821ad58044c4b48e80a63280c8f2437437ab66665f7c21a11bf3a6c0a6ab6

    • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

      Filesize

      3KB

      MD5

      367ca85a4535ac51de9708286e0e83a5

      SHA1

      828dc9005a8d7c0ef809bed1695b964d59257724

      SHA256

      c676b6739ef7f40a66c1fa1f25d9de3b433d99a00be6b6894910beb19fbd80ae

      SHA512

      33c264aa545466a2460538d457cf991ab81e0addf952a0a777c69bee339c789bddba82545a757ace3773cc6c8be04466e11d89c99b01006edb0ee22e47971f2f

    • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

      Filesize

      1KB

      MD5

      c67a73082fe0bf54d7240fa4771ad480

      SHA1

      f25b04bc422c4230b3dfb31bf8cf4d37e2d226da

      SHA256

      8f2d0886efe3e8cc69bb47109015656aac986e72722183eb7e04fb7124b6e6df

      SHA512

      e2291ee33f8ba18c903e556d2b04486d94a867767c80255dda0010e340432ffb17fec27cb2ad1c54557efccd19cb672703ef2c2a2cade8b5d76f0237ee7e203b

    • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

      Filesize

      28KB

      MD5

      b665c1ef649c6d86597c40bbed7c3951

      SHA1

      dc8c39779c0b63b1309abdb96da99a19817ba413

      SHA256

      82829e2ce8742ca00b250530bac1772399dc8565dbde848ef4208c6f24e82de7

      SHA512

      29754ef255cf6fd1ef5139a07df051e4989946c83ea5af91036839863711fad026db764ac32e13d3df5d6fb5fa12e90153d9e1c28bc952b4ace567064db38a90

    • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

      Filesize

      2KB

      MD5

      76a4769929e7459a00fabf31b42b040c

      SHA1

      746356879849a99a45c41c9f040397217e70a3f1

      SHA256

      9781aafdd031c8210753cc4e659af311c3506cd679ac6de31f610f164e37c894

      SHA512

      566f945b279d821be6b5411d57e23cb3d5bb86126a644ed326b442de8fe740ffa50fc5d9eaf8051b4c59800c9f142d930ddb5607414f91b2fff6e796e0989ff8

    • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

      Filesize

      1KB

      MD5

      6f4f4886f84e280c499437cbb067e9a0

      SHA1

      a668698c8cc13e4e06d1f4b6105b8f9d000638b1

      SHA256

      9addff48843f0af1b6a2bc27cd52972864de48d59936dc58eaa67d8f1412f8bd

      SHA512

      a5bb0fac08c43c493e55e15f20d637b2f619e3e850ca17df80a79527377f3e0bc1d827d919ebb2bcbb7a35d09f8e9f44e9b53d42f63771a1ec10cc5a589994c5

    • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

      Filesize

      2KB

      MD5

      be94c4196d68ae4493d09f0c699357dd

      SHA1

      f6107b4ace08ff3282a3decc7a665bc64566e0a1

      SHA256

      f54252c16b7f23988c4e27bd7ecb624703920973a0855637dbf106bf348d1466

      SHA512

      50e71039da4d9f58e453cbef97207c12a934d3ab22e117cfe25c8086fabcaa3061f75640e9c7561cfa563222d90779d88e3aa336ca8748fe0c794333592cf85f

    • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

      Filesize

      1KB

      MD5

      c81eb60ee3984db166ba00f6cbc674e8

      SHA1

      cc69d62a39a8b3f73413b237ee46508038ea4103

      SHA256

      efd433f8da56bfd9a46bbb5c99c2c6156b83d8977f12a702b8354e0569f2fce9

      SHA512

      0e8306706879d70cd01edab03ad695c81b3230d4f08ecb90927292d6f54eb7c172ffa8d05cf028f6426505ae56c54a2e205bebedacdb3bc08dfb20d13d7f2627

    • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

      Filesize

      1KB

      MD5

      779d3b1d885d8a8eea22cb7aced22a60

      SHA1

      be00794cf0f8bac25d527c254d7f9b80be6ca564

      SHA256

      a957817b67bbc445ad3382498be0409e8c5008145fa2571f50f2559204a87085

      SHA512

      9f2474dee3cf1f975a0a1f04c24fa833a324a15090bce16ae85812df505ac4282a069cd8b22be5b6111255297fdeaa96da0278e1b20637dda2f6df80b373f728

    • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

      Filesize

      1KB

      MD5

      69f1f37afb81c2c3d6dc7d96822ca0af

      SHA1

      1247cd8303198a3ed3ee71636046207a432d2ff0

      SHA256

      ff9ee961d9d4559172937475992a215809b2167b118a1282e7ae5c351da6b5b4

      SHA512

      9b33bf1f983939473bb6b4b574c396a6e62563a91ae669f9e8884a8f3d3563a9ef93dea90e8f4e73e7628406c21b7a769b86e31bf6d1e20357f6c73bbb2bcd9b

    • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

      Filesize

      3KB

      MD5

      8ecdcbceff6d2ef5e83dea49430f34f1

      SHA1

      13ab87cf62170c2fab1f8b9a5317950171c0db15

      SHA256

      ae2e64092677030121b7819e042ab4ddf05856bd09d7e83f501d77a4815b8194

      SHA512

      a3018de55bb90cb8d80a71da78b25fea6099f54ab9057eb5242d50555cf6634e0acb8cf93f536664110e768038e8fa722d7507bac27587f0babe52f983ffdebb

    • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

      Filesize

      2KB

      MD5

      618de09705952f4a03f44acad4afca09

      SHA1

      72235d2b2159e559af4e2171a1f492b0e4170588

      SHA256

      94253617cf67bbbb26a383dd30cb9b44aed1e9535692a2afc3f95d03c8010609

      SHA512

      0064c16c62823d4cde6e49ce6f53c24ca4bed8e7aa0764330f14ccca615ffeae26ad55e99091c6b482d5107abea1fb970747adeea4f592c8d96108bfed9c672f

    • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

      Filesize

      6KB

      MD5

      c95ad092590b8bed4a1d80c5af6e1691

      SHA1

      e200eaf0761e5d499ee27d5ec5318fdaef1b4d9d

      SHA256

      793f5f8efdfff32746c5feebb88a3bd1f2c62877dfdf87e4fa6a9de2f27b90c4

      SHA512

      8dfd27683860391bdbd9934445e28f106287c390af83c7c8a1e3807cae905115dcf5018a90c779ffc63511f38ddfa030d5eaeb2200e05e6c86be65331928a96a

    • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

      Filesize

      5KB

      MD5

      3fe849e1a9a48456420ea19bc440c95b

      SHA1

      141bd0f4a84f95a3cfccfd0f5dd4b3883d0150b4

      SHA256

      826f92e6b30f98663cad6ca88688232bc09818297f11002463e6d4c9381f4109

      SHA512

      80a83241998d62939c9f9a61fb7971493c57cfd59a5d78dabd99010ed93be9b779f8bcf8bb02ce6c9f2374c8f1ff19825ad6cd6bc61b6d09911881e6de908145

    • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

      Filesize

      3KB

      MD5

      6dde265fab75f5cd4118335e99f08fcc

      SHA1

      15f9d465728892ffa36b1015e2bfc7aec5a232a5

      SHA256

      f7da14ca3e7da9e32ef72be44753f9e3661a4a6f142d17b13d39eb38a3f8799f

      SHA512

      6cc4042335132352978b4849c42a5fce13d31b23efc033d733c49a4f5dbadb7471fd0411b90d459addba82b32a70a703758be00d974fdef45a4eef1c44199d33

    • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

      Filesize

      2KB

      MD5

      08c5bb2149bb0e7da207120a870454a1

      SHA1

      d9df88a3c5b56e4c68edca30a51af0f6da812b93

      SHA256

      9b440bd3a3dd42e7b84ad58c3e71298c5f6e0c1cf2e870ead77491846a064712

      SHA512

      97c6e498a81572b8a52549054fcf807d9d79abc8fcda96cbba985318ebf339da9ec0432bae4497c5866f2b5de6a092e27363f17ebe6389d12c11e07b3ccac4c4

    • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

      Filesize

      2KB

      MD5

      62fe18cf71df416c760b18055c0aad75

      SHA1

      e76203d8ae4e4f7f500d3c3355604b60750c5029

      SHA256

      1d69aa346db9493c8817b6130fd29e934fb095ca66604b90f7f621ee24d1234f

      SHA512

      e2d5045b937ea20671f990ec31fd05ce026e58a52df04f4780abbd4832ff35c98535f28e1b522e4a158e18d11950e6cb07b82111db6b195940232ba5b387969f

    • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

      Filesize

      1KB

      MD5

      96be9d0ed7d246251dcfdbbff8dde065

      SHA1

      222005fcd5a7fa9a8998831b0c9b71bf21bcd399

      SHA256

      af676b7e40cc48ffc42df3c211c1c2c4ca3903e27896535dd8499e4c60539142

      SHA512

      97bcf1c06cfc3363d0d664cc05872a12d506e52627ebc8768e68d469c8c0575b33a71cf74d668ce03b4c18f48ebe6bb44eecadc00d121365c9fc568d18b93439

    • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

      Filesize

      1KB

      MD5

      ad05926fbe02d37b12169ce4779615cf

      SHA1

      3f4d53f1af733c83e7b1aae7eea9903e362846a9

      SHA256

      c8343dbf5d8576abffea769fcde25795b35207f82e4158e6f6846182414f2df3

      SHA512

      70213db4f779edd2cc7ffcdf3ec57ce6e72b0efcb52aae3f77333d0910f193c2e8fb077cdc7a1e93ad50a8f12af8f3b5d8c18395d41ddeb7d5150c2f7d071e76

    • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

      Filesize

      11KB

      MD5

      f723ef2a91399b480c4f88229105d591

      SHA1

      d004d9880b62fb10fed9115778be8f92d0bedc8e

      SHA256

      18cf9b6bc50aa956e3ae75e711984f2a63c11f2146a9d6266e6fcd506cbbe919

      SHA512

      86a5996211e5d0bb6663545db6d54c938a15cf98abc277c72f38a629a21bcfc35b4d91cb323bf94031ae4d058ccbf4f9742888bfbd1a38f65fd53dd94a31aa64

    • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

      Filesize

      1KB

      MD5

      d3dcbe08d61abd96801112db5763cf91

      SHA1

      ed9adc5d313d56dba3f884600a38201e5fbb0655

      SHA256

      599a0bb76960b9b87471336851f73c39b7160f9f2aba4cc5b2fd5cd54279b40b

      SHA512

      b3509b2d3e2eec28f5666c753741bc913a20e5de11e57efa652c490be07f1e80051f9867903c6da880e8e96251459b3c02ac385ddb9180c1c5549a4431c0b9fd

    • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

      Filesize

      2KB

      MD5

      04321cd28c761934d6d6c8ec0cb39e6b

      SHA1

      904e911386e433abb36caa7d4cd6bfbed6b2f056

      SHA256

      fe711aa051eb6c975e80b0f2aa39daf69dd89c9c1d97f97bd990e82e17347caa

      SHA512

      4cfd0e075b401855736b78f1d60b652098da9fc0c5f04f52d7b95ef4e9a808ad0b80c6ce58364270df150987c0d397b56342dab94267d541cf2eb103a2178649

    • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.fantom

      Filesize

      11KB

      MD5

      3d304f97676fa7cca10c1fb81ebaa78d

      SHA1

      34480570e6257bba87f7a7fb2d638925fd44ed15

      SHA256

      b5fb316a6142fffde4e12198b262b26bd30bacb587fe00a84ae6f02edee1ac92

      SHA512

      b6e601e1076974698761061805841701575a93254ca44f16e1f46ecb951dac6b47f16ea6af09784131374925fe292c9ca0e2d7e2695d8ccc0d73064c3c50ff8f

    • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

      Filesize

      11KB

      MD5

      1f931a7dbd344fd4fe3e4f8dd930ca83

      SHA1

      b3a34eb02ac88be37a18338a8e80c83fa746dfe3

      SHA256

      465810ecf86c14a012fe64a024599e3fd5d601bc23df87a53fe8d51ca7de5aa5

      SHA512

      3f0fdfcb17e3c3be5519b5b4cce25dd530b536045c204b17ee1488d62de3f1267f9eb9b1e3cd9576718d68bd63a932af9484879376cda6bd45ccbfde237821c8

    • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

      Filesize

      11KB

      MD5

      c4e7722c9362288eb07772aabae65f55

      SHA1

      09b3dbfc88879c210f5de6e022a601176cf2f934

      SHA256

      3a236d09804c85522a274043e4ab1d1dd2d0385d6caa8b9bd1baafdac122a93b

      SHA512

      414d7316a01c0de4641f21294e0686369800023f36b3fd96aab003cb0c39812d36c3324174a183292a42d863840ff370969ba0a31c0db93a995eb0255df7639a

    • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

      Filesize

      1024B

      MD5

      bb8bca85b73633bd16adc13379a99e50

      SHA1

      a92bfeb17de1849ed0447a4be36c7f6274c22fe1

      SHA256

      03a2bb39976efb93c1405a858f8bf9927689d35d6141c5a87bb8a0fa610e97f5

      SHA512

      5880dd579ff418a66e5871b175f8b173719c5d6145ce7b3892a46093e616d8648ddafd1e89fb7e2ed9e59ba9b731391cdfb36692d333f262a0be2020144aebc4

    • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

      Filesize

      48B

      MD5

      65dc3866a997b3312797cf5fbddcee47

      SHA1

      cb43c11b68d68565a2df2dc3423c7a18e107e9b0

      SHA256

      a36f3f4a71492161865374fee819621cec5cf8358be85fb651132f65f970ea00

      SHA512

      7e94b512a29c0e0a8c042b67bd0a2fc505949e90e6d1ed0506bc9e49086f577924d59afa153f498202a35062235c3774de061aa094295a32069fa747114b86a5

    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

      Filesize

      21KB

      MD5

      fec89e9d2784b4c015fed6f5ae558e08

      SHA1

      581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

      SHA256

      489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

      SHA512

      e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

    • memory/1656-31-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-52-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-1-0x0000000002540000-0x0000000002572000-memory.dmp

      Filesize

      200KB

    • memory/1656-2-0x0000000002570000-0x00000000025A2000-memory.dmp

      Filesize

      200KB

    • memory/1656-3-0x0000000074CE0000-0x0000000075491000-memory.dmp

      Filesize

      7.7MB

    • memory/1656-61-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-67-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-128-0x0000000074CE0000-0x0000000075491000-memory.dmp

      Filesize

      7.7MB

    • memory/1656-131-0x0000000074CE0000-0x0000000075491000-memory.dmp

      Filesize

      7.7MB

    • memory/1656-130-0x0000000004C30000-0x0000000004CC2000-memory.dmp

      Filesize

      584KB

    • memory/1656-132-0x0000000074CE0000-0x0000000075491000-memory.dmp

      Filesize

      7.7MB

    • memory/1656-129-0x0000000004E30000-0x00000000053D6000-memory.dmp

      Filesize

      5.6MB

    • memory/1656-65-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-133-0x0000000004D70000-0x0000000004D7A000-memory.dmp

      Filesize

      40KB

    • memory/1656-63-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-59-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-134-0x0000000074CE0000-0x0000000075491000-memory.dmp

      Filesize

      7.7MB

    • memory/1656-57-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-55-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-195-0x00000000061C0000-0x00000000061CE000-memory.dmp

      Filesize

      56KB

    • memory/1656-53-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-49-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-47-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-136-0x0000000074CE0000-0x0000000075491000-memory.dmp

      Filesize

      7.7MB

    • memory/1656-135-0x0000000074CEE000-0x0000000074CEF000-memory.dmp

      Filesize

      4KB

    • memory/1656-4-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-5-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-9-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-11-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-17-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-19-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-29-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-33-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-7-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-13-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-15-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-21-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-23-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-25-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-27-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-0-0x0000000074CEE000-0x0000000074CEF000-memory.dmp

      Filesize

      4KB

    • memory/1656-35-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-37-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-39-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-41-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-43-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/1656-45-0x0000000002570000-0x000000000259B000-memory.dmp

      Filesize

      172KB

    • memory/3128-156-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-194-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-142-0x00007FF8F4A83000-0x00007FF8F4A84000-memory.dmp

      Filesize

      4KB

    • memory/3128-164-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-157-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-148-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-151-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-152-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-153-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-155-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-145-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-146-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-143-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-162-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-163-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-160-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-158-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-154-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-150-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3128-147-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

      Filesize

      2.0MB

    • memory/3536-207-0x00000000004C0000-0x00000000004CC000-memory.dmp

      Filesize

      48KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.