Analysis

  • max time kernel
    150s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 01:34

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>Kisf+apXVOa7OivVRxOi+RuYYMETAnA79Xz2kAUD/FwBAz/UQNDDyRK5gaNj7vYXIw4JaKJmCC7o5XzRcHx2hshwyOQf2QnDwwn4omE0R65qk1Xe4N9pOqTpAe6FNzNS/Y0T1YAAB96QgmmuV5An2bC8qlhkIgfTpbUax+RK7IkRaEF2M7ExBiGPm7sGoZqeRmIvylCpvgQESTh73OXJwAv6SJ+CKgU4SouRK3cN2JWuXcpdZpr6pXDlSrDYAvL3XtkEuYI4orxvNRJCaQBrwcSEYW16rHeiYj4dduzYxxmcI4e8VRbUUKFUy6YQ96YbnNjW+53lP6cNQZGEl2S+ig==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Fantom family
  • Renames multiple (1025) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:848
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:2692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    162a32b5821a51e6bd35d211ac0e0d57

    SHA1

    645e7c630caae8947d5671f96d0ec90e26a8ce6c

    SHA256

    6753a5bd5431970e543a49d9a6bc1ef7ac2973e0ab2a97ac62936c2b5b5b4617

    SHA512

    6f01f414c31a87acbfff1cfaa726dd7e83d12a48570bd336745acd7360ae15eb35dd545175d5fe1a5b0754d5d6dab59c6aa4222d4dea06d399eea7cfd49529c1

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    5442939ee10c60714b895f4dc2667b6b

    SHA1

    79fe8556da9e410f0bb3eb2b73b85af9e962ef03

    SHA256

    3315d380a860eb78d4e2af6f4c0f0f200418b3b744baebec03961cb06a01164f

    SHA512

    36a18ab54e52dc6117738c1474b3ed38dc1a9206d346d6dcdceaf88cbd09ba2968c4eab41cf424b6a27618397ac24d0cd0cbb8a94f079db63129635e8b75861a

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    7f3f27415a184ef5ff529c49c5c29355

    SHA1

    d131d5eb03742f7c5f395c6bd07efbed74f693d3

    SHA256

    8d497c14601ff0477f4a43d927d8dd0c188978136d38e905b125cd17a6c21412

    SHA512

    ba371a57a5a4384ebbdad66cb67f6f2eb555d0a805187621579ecffc09fd8b3373fdc6efa561969e30a2d4a296d29ed4a8cb5666e7a69f2fda6f1daa9a054150

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    94ef5887a37f2b90db9ac231e2ca09c8

    SHA1

    bb97a9788c179ab25d368db5892c3306864dcfdb

    SHA256

    33cf1ec94f7af608a20a4ce9dd685849613c21ae0b8b5399631b7b2fddc86a30

    SHA512

    fff72df353d651acaba8be4af14a1b81235432be2bc786a299b4de948c1804fdee5cfdaa80c08fb185f4f64a308fec806721c724ee06b569779fa068873af9e8

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    68828f030f19bd7b5b77b84d66cc4411

    SHA1

    2f1765922bbd36bc6fb78cbae9cc93a1c04df9d7

    SHA256

    f582106bb561f290f7eb180e88a6978af6728a7ab358afabadb5ed42c1c93c6b

    SHA512

    4209751a1e8e41686967572b5cf638a7ec30f8d7c3efde15df842551b30ee3bb232ce90817e6ba882e1cbaa144a10029410522d23ef25963b5d08c07d78cfb3a

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    9d4887c61cd2d45bee47b60afabd7012

    SHA1

    3bfd44570708f1e0d1a38e701b4c73d719a4982b

    SHA256

    12e7f68cbc421c80040d456e89bde899553a150a064ca34b67247a795c1181b3

    SHA512

    4d4b83d1e9ead931236617d4969e9b700ad0dda7376d6261d54c9adafc15f5ab9b5cf797bcd7df917660ff81493b493219287a3adb1b11c645464449105f9498

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    d739e390a8f5d65e88f594a96e8bca0c

    SHA1

    31b48abd554ff35ffb930e93693ae364d399b399

    SHA256

    4d7988276b0c42c4680c9f34adf3675ce42c572b1d8fdadf89074a2f15d8b732

    SHA512

    40f8f71f1876a87504c440de81c0e59f5ba6df78927858d08df4352df5eb84bc239c264dc4496c4b1d9b9c705c14efffd354b548f32c9e0101ef5aa52a77d00d

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    f21a4ac54b88af0a2d3bfbb49e5ba62b

    SHA1

    51f829b29f3eb649a353b4608b273713d424b407

    SHA256

    c523fe011b2048edcc47f9142996e454ebaa2bf76982263e93d9e7658d387e03

    SHA512

    504b13a6ecab0001f8fb3e93e09e2cea9e24947a46f7ec215b60e4b24645830b392f7e91bd8bc45eff82ac2c591904a147d7e9612d373253db90bdc5c8a9eee9

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    67769178847eb6d29070c33ab5c255ab

    SHA1

    d6c737d4b070e5749e1641e0c4957ed269ede872

    SHA256

    9b44e6231aa8fb9af3f9f645848fca8219df9b8cc6a231a7cc2485db54e6c87f

    SHA512

    df191ddb9f5f7c29488badf0431f8fcb97189551d80c0f676e8bcbe39d055f993064b80be3994dd97e9794c76cdc4d90af18a9b172696c58da005bfa1244ca4b

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    8034baa592f8f06185dede057e9dd08a

    SHA1

    262048f20996cb2abe45eafb78b63e66651ba2ac

    SHA256

    09f068c2d3ce0b4af388224d135a90777470f940a5659ce9240649b32b44c22a

    SHA512

    8091ee77cd518d5879d82271ca0b513ce40724ffabe0e99c09fa941fba5a02355e6bdfe8ea3a7229feb2345c504e13fb078120e63feac48602b0c944038de4ed

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    93e81fb3059b1cb8daf0798a820a1069

    SHA1

    bd61e39c6e6327048a99150c4c6bacfb00a3935d

    SHA256

    ce567454232988c21015eb135420fc201beec2ca2a22381e3029ba52f577dfe6

    SHA512

    3da1b9e4c67ddae8ccc3405badbab4f15e7921be9f13a7d589ccbb0dc7b6065569e3fc2a00d46b9a325e7f81e8be81c353db74ee3b2c4398cc404e25f7b09f97

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    a1bd16f92c3e06e93fed5de7cc84400c

    SHA1

    7699b17b75bd8efa195e51756282639747fd6078

    SHA256

    92db4cda549cd189e3ce1446c0e9c53446fa32990a0eb8b716ffde1377beb04d

    SHA512

    91e3bde703521756105b2e5116f99ff5ddea5dbd332ebbf1d0a3196358a4e5f9f7a5ee0da5968b75eb8a53f114f932a17d059ac633f62bd87fbc1c9bdb6ccc75

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    4963113752a11cc9ce95b2104629aaff

    SHA1

    812ec44c9d8691d8262be84605617ec14cbff882

    SHA256

    797fdcf47fdb98dd29f2fc45a3df59572b95bea36899de8380b66e838d4264fb

    SHA512

    3e8cea7c2ea97aca4232df4476e924d3ab4a9f50a3745c79dc93cc1a21a0576be3de26c168292d12bd4b44eb95d05918b41704cb9674a7f19b4421dcff4d6709

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    97da775520e8ffc502b81cc85bffa78d

    SHA1

    4a2171f812ebd083eb9f3a820e84a146f5cdb551

    SHA256

    df85a4e603ace654b6a19553ecac8177c50363e4be66edcbebc4afb1b47112c9

    SHA512

    4b83bba82db573d70ae4c2b635ec0f501b2aeed93dec87baf6e11ef25f090295d77624ca101c30deff9bb40b09013ff43fcec3bc59985c649374e77dca0602d6

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    9bf56ebb52fa8124f79bec6a293f12d4

    SHA1

    1d63af3b87a1c3bb183a1688c38bd007c3a4ae0a

    SHA256

    b6121c0e1a845de0ec1a017ebed8b16e77461efb328f2da82899ab8f6b21f3e8

    SHA512

    61c035a999c913580e6e8e3038f2ff802a07d48b727e2afb3fa2eedf5283da4087375e3105ae92dc0facb3a28fa0ea4603cf96620395093caed54120c8864da9

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    fd727d0ae7cf587f9fdbea6b135d71bc

    SHA1

    5d0feb21aa1520cf211fdd3e71396364957789a6

    SHA256

    e8fdd451cc21d5f1d3bf4f964a9de0ede300a0e07c645c24ceaf18f814f1f2fe

    SHA512

    fe02916911c33202ef9fcaa30ab6bde5e1683530e214846b0e6770870ff87e30f77c78269b569971801befe1fef1d738c3188baf434c1a12497fe7733e648a47

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    de6b987e0c7d1c158066fc6db117be63

    SHA1

    c017741dddc0bc9e869882d736d4457612d6fee9

    SHA256

    3b49d2e5846032ed1c86cb683c138169ff1e9e7034531bd6f1a9d3eda99aadba

    SHA512

    7c1eccad059317c5733275aa41781a66c081394b582c3fe53100ed909924bdf1faae318b8231fb0386979dfa9d39cb529e5f2f25d842c2b532baa78a2a6b7ac0

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    33c17a088bccc4cbb5698239f47e216d

    SHA1

    44c1ec75300c8080762902a5b84ad997a3453fd8

    SHA256

    21c226e3e46ad567743ab531a51c8bc4c88874ba3cde48946cf57fdd30b52780

    SHA512

    abc3cb606e177420d2e5f67d9d7dfc7714b19fa048b7048766546627e527a1008334d41863bbc17c22dd6061832c7e524da52570fcde15fdf824d03790e4a068

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    6ee8913143185a57fe4a8092ede9721d

    SHA1

    82087496365716da9a3b3a422ecf439dc6494ee2

    SHA256

    61560b5b1a316eb0ff60b0382e3d8eb26f751913882515e685372a5ac7155b77

    SHA512

    6f897206e9dc90c7f4c925b993926cfaeb3024fe0aefa0bd2a61b66f817c19a2956625ee193fc3d5ce30ad9beee597c3762c8da47fd7d5d6eab6f7a534a720a1

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    e0d4ee0b0de02d51b891740665673472

    SHA1

    b4c837c26532297390f359c98a550eb936f677db

    SHA256

    10a3c5dbc65ddcd3391ff7fbda25386bc79e19ad054618d2c85e6bdbf0d103ab

    SHA512

    58b1dbeb41554b2b7e3c7d4300c4d2146d0b66bd4b43fe5dc840604b570afb8b3642067f0862c3489ad57a3d8a86253a56826184b14f7d7a734544213516076c

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    ea5585bc44779c9ff725b3ac3642026d

    SHA1

    a0a0d9fa9df82a21549a0b13c2d1f36d2ef9e267

    SHA256

    f78377e651cdccf847d429c7a2594f095fa2eef0f6af6ac5e890c7e88cc47e49

    SHA512

    b534f7724ff6f8fcba478285befbb6a5cff13f5cb2a4519eabc9853092c4a8a24d15c35bcff0000d4981fdd83f453782021d9a7b9e6e7a2df5b06106bdc06b6c

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    6582c438c5dc0a64247d5ddc388160f4

    SHA1

    1c127ba40c8a1e92197e1f66aa16de21b29039d9

    SHA256

    95331949973fe358db16d0ada090657a2a5a9354779bcd00b80f18dd4bd0f68f

    SHA512

    eac104de3fcd292247b1161e047787f49d77b104d6e7452a1b150089e08293baf63ed44ae8f5ff2ea4c674dce313ec8e0beb034dd31278df652fc559835c2ebd

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    2243c16eb5bc6dba2e8def7089604e3b

    SHA1

    3346aed4078c0385608cab926a5a74be84f9195a

    SHA256

    91f7fb24049560a40a4745e87ca1b923009412a0185500935586df4106dd56f7

    SHA512

    639ca9ddd7c905bba7c025c688472497232eb032c99dcc2852afdb9b1200490effde2158c8e753d44c7b4bb249df014b6d77f022aba223f20c9c23744d66bf96

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    decab41112d483ed11f931231887fabc

    SHA1

    1118457ba4ab60b436ac1113847c78390ad736d2

    SHA256

    d26b6edb72e0812e5f43506627141d51b999fe8c27dc03fedc400c9c70e8eed6

    SHA512

    0ef8d2b97c409152c64b9ebd8b830ee2cf8a929463f25bad788a5e161493a6c05220b5a7e1a0d07e60c7b1664cbd6d2b96fe171720dd3e2806220d4dde9b391e

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    d78476e797ef925826bb00fb9157d6aa

    SHA1

    5cc8b9115c1867a59bb32b3e02425df07f7cd8c9

    SHA256

    748a6fb27088c726fa766b1a96a02510f22ca9ddf8aad2b75b0aece55c724f6b

    SHA512

    0a846f8ce415aab9e6e867e1ff308c9fb11f6ac99d1399482bcaec982bb5f3ad18f62c06b6f91dc8964e049560342ef8e0d0ab2557c3dac774cd57df16c3b972

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    d2bd393ffd52dd27b462c6736f6e3f6c

    SHA1

    f1bd62a137ef413fec40bac7fe1eaaaa2458aac9

    SHA256

    559c352a0b5c7fe872c83631b4963b016d9e41437fe52c54144ecec32a4d5a35

    SHA512

    cf74cec5f3c8536d402a0c3213f1a18aa6a418814513fef22ac408a2ddef226339570576c229a3916454256395d8769b27a370a64f2dbb058344af79d2be1896

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    9fce9562278b6ea2e6ab8b7b88f42929

    SHA1

    dd19e3e7481d18f1734e2350a2d5a5d523a93c41

    SHA256

    9f33f263f161046030ea7984ad3f58953344a360cccf1f717d06986c31803854

    SHA512

    942182c72ec8f2d17b4caaafac63171232ac632614c0d0fa948a497715e3491c7019be5d24e11e6219fd9f7aa3dd481b7b2fe5f7055be0c28321298e15079df4

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    2ac6b2dfbd543db07ba86017c40aab0a

    SHA1

    04cbf88e1644b0eb5811e3207f87c8d687185c84

    SHA256

    937bebeb2f276e03258dbc3894742efebb0cb1dffd19f93735f35ecf54341d15

    SHA512

    f1f257d570621f083b7915ac4621f1c7980bd744c3aae240a99c6cad56b8160b537c16876a4128d8cf18c1fbe10f03274edc146e017ec665cd12d94791f3c3eb

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    1bd7553807dc253c46a1db9738de3382

    SHA1

    c3e726cd259a30ba0a98b64e3937d028b49ff1e9

    SHA256

    eaa71c8a08b56b9079e26f56d4d6b14b37ea673c2c3b3a8604ceb8af05481aba

    SHA512

    da2f8b751e8fd2d8ef23ff39f360e7dfa67788bda8e07c09430effe110fb776096102f7fadfe331847c8dfa084d9a23b48f06e1cecf0546d0ef168be4f62121a

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    5f5e190fd9628c7c461492c6153561dc

    SHA1

    42fb0cf7f8315c3849849928360c2aac097e2223

    SHA256

    b7515998ac092f5793f813b6fa7697ff7109b32b943a717d4855a78d9695ae57

    SHA512

    13cd9436670468a8dcbca6b47a4b55454c8c8ff291c1cd4418c68b62ba377074c3d129adf76a994f42b0d3517329ebfd77dc9885dc8c0c723362dfc24480e05a

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    50a8cd816bc4ac98b5e21af1e9639de4

    SHA1

    a45238a1f83fee1db5ad288cad2c65ba1c5bf498

    SHA256

    eca778d28e43ad6964765e383ec606b1b7b5428febf7bb7a83018a02388dba39

    SHA512

    4d90d2d2bb0d95067b6afff510ecd4ffc2d39a4068d74ff403081f75c9d66f8baa8f083c97d3bf7d5f97009a203d88469d93c599a6f07dc9880091299f080ccb

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    73af682c0fe95c174b8ba0f18d2cce4d

    SHA1

    bfc8a915fb2bfdefbe8b6e72ed9a1258f189afaa

    SHA256

    30ed71570a463db5e55829409674d2304972a35b1e688e8c0ecfef73ac1c7ea2

    SHA512

    b43f13d74348a43075bd79da87f75e7e920e83cf9b5fa3d9706c0e598b15b1095bb08d5d21bf88ea7a92203d06e7337db108dc996af9ef5df509d35aa281afc6

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    dbb097141bd8a621afb5fd1e02f4ec29

    SHA1

    2a480ffc48cde791cc854ad2944b868bac590a9a

    SHA256

    424059ec661071abf58bda69e1ec5ea01e6fdb3cc2a20fb7d4a1e34cb4c8c5e0

    SHA512

    e0eb932c8f8e948ff1894dc18e5d5e09f967dd8b52bf569f9d0afe5b8481ad2eb96935120515900447a642c4daae4cf18d0997e5c6cfc323293927266da43da1

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    3eef7a9952e0bdbde65d122fb662f891

    SHA1

    500837900f977b4db6c398456e0fb4e810148f9c

    SHA256

    3a387855a089442b9ff9d8178874dff6b25d4c35caa657a72e0de05cff16c9a6

    SHA512

    23e7fb99968efc77500811a6f76ca305d5dbaaf88ac56865f59a37bb3fbad731240fbf949d5573994f8bc80e1015a744511a1ca7fc87ba88e1b5c6f879084b01

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    034920579a52c053a35ebe0ace440782

    SHA1

    30d36caa39f57e33f36aef53b783c50fd6a1b98b

    SHA256

    34e653b1a615276a28a2d22938c344d4308099582b0b510562c791008cef85f6

    SHA512

    2c1dd7fde9a45fb52575cde6f14bcb884275a3898cbee49b714081f936f10e2082086d0e0213f78f2ab743bdfa236415fd07b1c1b49ae00fce52814bc85b3fca

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    79aab111d2d937b08815bbcd7669e896

    SHA1

    215d9aeece8adb7ff9d3c6e97aa86b39ac877369

    SHA256

    72fa45a1f4fbc03338acfc5dd5cab3b81b92d8e8689a4ab01bd34c161fab7617

    SHA512

    5eea851ab9bd6d501430fde368259991e976a0ea91f54ab4e818a24f8846a56d8915a092a1123f88e9ccbc08b3263953e7b2671aee4e0c4cce9c609e253d4f44

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    d1f014da0044b81e2dd68a0450326b75

    SHA1

    06554f4de451a021fd2f9cb408c94a429e4a78d6

    SHA256

    a30556a03b62fc3ac6aa1b74b43e39f864c02ad9700f8a0197043367a1e7d2f8

    SHA512

    0b88085a033c8575953ed95803262f575c0e6c38d7438ab10b845c491904e85acc7c9e8deda93b8d33e47fed44b8536415046a5e607bfc9041d16011584d65b3

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    f40cbad21b7f220c4e21c4e24bab9760

    SHA1

    117caf9af3e6fd728f9bd5a85f53f28f815f7e9c

    SHA256

    1e4c66476fab073f6ed9cf3d491bd818d675a13e77c52b383533d4dcbf21f9c3

    SHA512

    366bc2d414b78aa03998d7d3ffdbb9fd912274e3f9a6e50b01c152ab4da62845218c1734cc0f65f56dcb114bf8c239f7b944cd5fc7629b0bba60040f46b7ed5f

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    5a495bef61e6a6cefed5f7bdadeef21e

    SHA1

    0fa36d727450fde631f63880ac4885c7bdce26ec

    SHA256

    0087c7fb239c58013bb8dbcac1c13b6c772a9170ddea667c2534744697d99868

    SHA512

    f1e0b1caac27af11c885ab57bbd88b94bb5ced74986d63ab804311d9b3c7c65212a2b47509fdb96e5e0cac29e0cac98ae77cad4d3a11c8049d21341f136f545f

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    08248c56df59c5b02a1e8c39b1fc8f69

    SHA1

    9a0bd130bc6db0049e8c37f37b60721267608d41

    SHA256

    79174c3f447f6f3bbd0f5ccb86b90d02d8f32798954110350eefde6b268e605b

    SHA512

    5022e634842181cf27cecbb07d260aff61b5376304627fe70685e16e293f482fbc875771a33704e447b96cb636891da101a07026b0674de664482feb8f32491d

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    b33ce7dbe8449ba952d6579426e0a4bd

    SHA1

    43987ac785d0f860b002796734dbe10f11245088

    SHA256

    e03ff694e9417bbc84d3a1d9f410b6374de03aea317c691b40fb5fb3010d3efc

    SHA512

    4cb1712581b5d27aa2170150b25d34dc8fd945f849cfc80425f994ebac082d30f03100cd04ae7be5f5b72fc1396cd10c753fc19325ec3e5b9da529fb055a15d2

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    7ab268e1ab9d1543c9f8ae4562de9ac7

    SHA1

    0a60290c41cf6ac644ed89b077060a9ae5b09aa5

    SHA256

    eab6f68518132b4eaae6ed6849777e14381b37e24d5ee2f2322a090f1a4f02e4

    SHA512

    bee73f1336022bbdb81b8cb5747f47074dd42a77e83dc2488d773023af3f69a8b7f01d1c8feed0d7cea8f1f06b816c8125d4f71e999c7e5398f66b9c5de4cb83

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    2986d52d1d04ed77b9381d6274ce3aeb

    SHA1

    a5796dd6eeb9b18c8673f6b0221d062616e5519b

    SHA256

    b1637d7f387a0651b7785ee0a4b48fd35a51425918d15cf00bba2274eacfb714

    SHA512

    0ebda4f52925e83dc0660d836e76be0a02a28f96c281f467bf94ffc9ab48920299920bcfe78902537255273333c6871c93ff045bc5e5e40dedb43ce7ddf82a38

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.fantom

    Filesize

    11KB

    MD5

    050d38cf6d0e4f378696b3ba9bdca25b

    SHA1

    d66d8263e35f5c9364a5da68b7a47ae449dc9b8a

    SHA256

    914e1ba4b867737e20e3880ed5830db7fa9129080abad5ff67f980cb187252f8

    SHA512

    458dcd56da28522df982588332df2a78e1d4e321bce32694313b4586af352dc0957860de685252b9f4beb1318140027ab334a425fa5c5eed536e397a207f4493

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    e2cb3a1ddc3175fc98a469d8ee94a495

    SHA1

    e105d870bb67fbe903fc95357ae2b408c05400cb

    SHA256

    9818414c805d97d2d7b9a0b2487a2c6fc308ea9d99a5cbc160c94d4906ea701e

    SHA512

    0029ac2e7b4e5b04f04897a25c456ab48c295521b4e0b4969a0036b79ed5540cdc509f20ae8ae580de9966c1ff73c70438eaf20e56f6a5d41216c532054e5119

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    b74270e6c1d2a28539280c74f92a7c68

    SHA1

    55604227f18c63b665d36d88407581e3e072e353

    SHA256

    3ae5763856386de48d13a1ffc51e0c5381677c142c5691b4e7a54785c4bcbc9c

    SHA512

    dc1061bc6441e9865754850c26b686db8ed14ff456d6cba2b9fc4e860b09ef271afedd0442b6a848d0b8bbfcf9e262c9691df0504a48214a3b619cbbb2a0ae90

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/848-39-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-32-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-1-0x00000000022F0000-0x0000000002322000-memory.dmp

    Filesize

    200KB

  • memory/848-2-0x0000000004AD0000-0x0000000004B02000-memory.dmp

    Filesize

    200KB

  • memory/848-137-0x0000000005770000-0x000000000577E000-memory.dmp

    Filesize

    56KB

  • memory/848-3-0x00000000743B0000-0x0000000074B60000-memory.dmp

    Filesize

    7.7MB

  • memory/848-66-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-136-0x00000000743B0000-0x0000000074B60000-memory.dmp

    Filesize

    7.7MB

  • memory/848-135-0x00000000743BE000-0x00000000743BF000-memory.dmp

    Filesize

    4KB

  • memory/848-6-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-10-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-18-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-52-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-4-0x00000000743B0000-0x0000000074B60000-memory.dmp

    Filesize

    7.7MB

  • memory/848-5-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-8-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-13-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-14-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-16-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-20-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-22-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-24-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-26-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-28-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-30-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-68-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-34-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-37-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-0-0x00000000743BE000-0x00000000743BF000-memory.dmp

    Filesize

    4KB

  • memory/848-40-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-43-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-44-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-46-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-48-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-50-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-54-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-56-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-134-0x00000000743B0000-0x0000000074B60000-memory.dmp

    Filesize

    7.7MB

  • memory/848-58-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-60-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-133-0x0000000005360000-0x000000000536A000-memory.dmp

    Filesize

    40KB

  • memory/848-62-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/848-130-0x0000000004B10000-0x00000000050B4000-memory.dmp

    Filesize

    5.6MB

  • memory/848-131-0x0000000005130000-0x00000000051C2000-memory.dmp

    Filesize

    584KB

  • memory/848-132-0x00000000743B0000-0x0000000074B60000-memory.dmp

    Filesize

    7.7MB

  • memory/848-129-0x00000000743B0000-0x0000000074B60000-memory.dmp

    Filesize

    7.7MB

  • memory/848-64-0x0000000004AD0000-0x0000000004AFB000-memory.dmp

    Filesize

    172KB

  • memory/2692-149-0x00007FF8572F3000-0x00007FF8572F5000-memory.dmp

    Filesize

    8KB

  • memory/2692-632-0x00007FF8572F0000-0x00007FF857DB1000-memory.dmp

    Filesize

    10.8MB

  • memory/2692-631-0x00007FF8572F3000-0x00007FF8572F5000-memory.dmp

    Filesize

    8KB

  • memory/2692-151-0x00007FF8572F0000-0x00007FF857DB1000-memory.dmp

    Filesize

    10.8MB

  • memory/2692-150-0x00000000006C0000-0x00000000006CC000-memory.dmp

    Filesize

    48KB