Analysis

  • max time kernel
    142s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-12-2024 05:08

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>FfN6e6WxGegF0QzvORH+H7pBzLaDITHQaihBp5GUZRoLgLnJZtzwNM7UW7LQGzAGb/Qj2QV7qCaJVAx48cM4Zgn83GqXLQeRkzf+zTUWGxCVrgJrzdDdNKCQmLnmAGeoW+TokMiVPJWu8lvcu9X89bIzgXlUqxtJBuUzQmAwBiMwkKZyt3b4rZpbvQ75RYWayF1bF+EIyHDt999ZeZGMZ8wjFop3UsQWIMwXRJNhFmkehLlISItSikRAb2LZbo2K0BXfrGCXZv19/GXXshNNOHK65hPTaLEborTy6EdbVYuVrwNC1QsLGRip6WHnnerlPHiamGAeCIQgzh8ElGgsjg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Fantom family
  • Renames multiple (1030) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:348
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:1996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    cc7da7eb8fbda0ae5c0dee58c4988676

    SHA1

    d341fa01174a1543063d6afa1ed05da1d6b58239

    SHA256

    119536b2d13900724a96e68b7ae797f292052d67fa9ffe4e58205968e1f0266b

    SHA512

    aa7858867b5213d0054721789c474bfe5cac63c358ecc8c0a81de315c6fecf323be7c1fa716fe98c5dc864c92c301f9f7686f8ed56f1a33ed48a62f471d1570d

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    4d9e1ac8830291765d17fc2c0a40eb9e

    SHA1

    3742128d7597d7d4820d00e3ac8b1bd22947acbc

    SHA256

    bc5f31c69fa72b55fe3e7d13e6b3c5cc6cd3789e4ab36a959e810dc9a94214cd

    SHA512

    6e415f7f044a9b4781963c36458954a27edd56e4be11ecd215d4c9f6414f0769c3d9184b5c3eaa78bc391f15ad6c455dd9b4017d808323a7b0357f182dd4deb0

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    f44907bc60d51f1ba114948c8d952b93

    SHA1

    c553db1c6e2ef962115c0c330a6f4699b4e3b13c

    SHA256

    b8c0054d035910c7cf08a2a6532e410c0938e18a8f9b62dc8e9566e50e7355b1

    SHA512

    502e38640b1628bd4e0a21e4253a11498c96c16c10a45ac6eb12f1d67fdc7bb9fb4293a832d1ec32b1aec9db7f48e46b86ce168c119c9cf32dbf661a32d4c584

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    4cf17b7fdf34cc30d062a0644620aa48

    SHA1

    57917ecab3e0a5073e7e8e14ef336749423599fd

    SHA256

    23fd1ea5a782b62b0749288279858bba61c1789ac78078a96bbfd127c7f229c4

    SHA512

    fe5eb0a5fa84ad122a45bbf9bb2e7cbcf8b1b1658f4b305c6d9a5359a7ac68ff90b09367c31eb257ace8790bbd97ca763af0b88c043e2866cf08738ea3422085

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    fda74c007af588c655b44ab56e14a9c0

    SHA1

    29c72c686b6eb74b6a3f1566559dbab6ddc3259c

    SHA256

    be6b04a6ea770d3a6a3a304a933e5a863caaf2188fa1c0a00a1728203f5f057b

    SHA512

    a1540e5d46747108831dd35be6c8e852438670f93a50faae4cb35a53bebc0e48adf13d9f897fd6f43fe23ff8e74032aeeacb575fb037a5bec769673a1d9a3bf7

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    65066029543e3f25b7dd1abb27698e56

    SHA1

    c6a2fd4275321c0f4c8629950bf8be0c1f8fc9d8

    SHA256

    ade0816190494474e2750ff768b97757c5531e59a61d8752d94b4c863d60710f

    SHA512

    53dbb0d2101a764fed4aa403b274a3cd64594c39ae0dcce3d9ffc9e24bf716b8d462a3d598563282ad3e31a7ca09a6d2e124a3bc92a61842d1131a6ae5568bf3

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    72a79f7a87cc914be292b23cb2cb420a

    SHA1

    e17bbaae96809c684c2aea54ba4cf3da6a1a931c

    SHA256

    1441ba6694ecd4c4ebf8aeadf7e1712b55d6838551ba11d3989c1ba538a18329

    SHA512

    f170aa9f6a326fea059b30f395094c6ae65e089aac46fd7863c77bfd5b1b46588e08f31749c0d4dfe26d83b1049705e9c8db48cb5f1a1829db34d1513690ea53

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    cb3f053eb2cb71c04859c2bcdbe0d7e3

    SHA1

    1d47524a65f141f9bde1b9a1fa4092c91da3a20a

    SHA256

    de2df46d1b1ce911e72edc8d3c0e2950505805cec4a82ed71fc0b0f756c80318

    SHA512

    c59a10478e96af8eff3ab30b9afee2f12874ec3f0bfa741743494b820922b05d01021090559ad4ac5bd54be7e75c53d5a38803d924e41f33c65a7d4030d7371f

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    e9d2944fd7ff0159c5d9730396263502

    SHA1

    0abacbe1f530010f06ea7fd0e511fa70e8c68ceb

    SHA256

    13904d8b48342b74e8a72871598c27f31a72c10462988b6bcea438730584d47e

    SHA512

    ddae9e2c584211d015ebc1fd55557fbfd00640dadae97b9befa7c8f07d5bfe55ace980f66906241e248d7f8a8ec02c8a6cbdf1a62d093d971b7d9f3875721e55

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    f825a0956802155d5ca735d7173b8c45

    SHA1

    625d56c30513e09f374b8d8db86851bab9dc6566

    SHA256

    0367f842838cb9e85e0e46c9d524b8ad946eca8dba227c72794f48714a2e9437

    SHA512

    0c5224477a5ea4da7a46643097d5d81ef89449fb8eed05fcc6de7a73f04aba5d5b1918cf2e005f4b3248a7c68f824724cded67c1846dcb558f765ca433d48d51

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    b96c48803c91bd67ed1bb6edef8db1e8

    SHA1

    014c3d132ffebac30749221083b251a056145fa1

    SHA256

    04ce7891836d2401444758f415ea87fa688450ffeb92344b4f74d81f159048cc

    SHA512

    4e73a8b24c13cee13c6990d353b71c5dfc778fcf885ed9542f763b528ab27ef89401e44f0b5a426227fa082720edf0377f536f5a2482d19cea930f60a82ec311

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    193ec0740154993634472ef961ff65b3

    SHA1

    b5823cceec771413baeaa5e0f553856ddc603411

    SHA256

    0a2a95729cc81445d0e8fc0e85e132eafc7c250d03269d36e159dd2e48abc6d3

    SHA512

    84978f67726ad3b38d07b8080c9bc31e0433d394faaf432dc681aba82d1eb4ba4b3787b30d78eab3aea04b53fd53fdbbbef765ad42e004e7505526d00026683f

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    217f5de540343e6f922e91a6f361ce3c

    SHA1

    65f06ad8714994666f16668bcb91c212754e9c3e

    SHA256

    6d3a967dd85035918268e5b0c14a3579da2f7d3c7fb82fd61905c117e5a4d743

    SHA512

    e9f383decd35fe5062c2728a2cb1a943384855b493a86c58486f3c173077bf203f7ad6183af6c51023e73f89e4ab41246d2ce51611f9c9c5251be4902cad0753

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    26bfdf7e6458b20ef7e870054760f8e7

    SHA1

    93f12dd9ff284b29c072999da23500b98569cbdd

    SHA256

    cef55028db72e8300484cd4bb63a750375ff872414ab09e3de5a2eec223e268f

    SHA512

    cc9ca907385826502967c29245c3892f0ff1fc1ea18bd5634ff3d6e562b3eaadafdcc9c8582b77f2b2b0fe267dd396520d09c0bfc34e118207131bf7e78c738e

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    23c6ff5cdf33a7634ddc64990a0ae6b8

    SHA1

    7c9017bd6c45d560b9c3c3b2536c68d1513c2b47

    SHA256

    fca9dcd545f28071036b08814a8d3d9d644af2e32e5ac77248487dc421b07136

    SHA512

    319a8cafd5c3f35fbd2b5cd3583cc517cf831cccc35b988188b7d57f1ac75dac14b029fec1374a90a3a961b54f1cbb81afafe57d5edc83833ebfd8acceb86eb5

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    9f53a17fea564b42839556f092d2d72a

    SHA1

    0a88bf2ae78b49e180444ffa8561cf464a106f28

    SHA256

    921c82aa23fdc594dbe6124ebe5ded444dd55b310208867dd6056da5c90e4f15

    SHA512

    19f3739c36b9c24eb3baeda2ab20b50f080812c0557aceccf73978dc5d8808e4ae558be0f2d6e3798bedb634c3125cfdd5ab74586fe5debeb6ac4dea8a499eb6

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    97fb2289fac96da9f1ce0e9ec29dfb9e

    SHA1

    6e40f66b9d8e335896887ddcd1f323cfcaeb239d

    SHA256

    305aa0c87e831ad1178fc6b0ac8b79f9229c893c9e4b5ba501a96201dfa09546

    SHA512

    63d38ddffae9d3752f906670c3292b8080a764dce5e02cf47b7510a8e11d59f8045feaa8e57b1f95ee26928b1f5a6d7ace4dea589afe951605feaf15f632770f

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    205e40fd21f06967868c39d025635992

    SHA1

    6d8ffce8596ba6585c06beab5cb3310659d33d3d

    SHA256

    cfc399ef63b0653570451ebdf3b4ce73bf857525d48dbfb8a6fbd341d6224310

    SHA512

    4680a16ed8158a8893341113b0934a3f6bd54f434f5fdc7011821af2e2e03c2bd5c5d83ff6af733441e791f9b03c892277657c5f1f41b1f72071fa5e9a97a6d2

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    2a29ce7f31e178c4c2797198afec82b4

    SHA1

    8152e8e713ac7772aa507f51a5c6db500a716e9b

    SHA256

    0d355636ac55072a1949a166c8444f8ec6138db54aa8d42065517d4399b266f2

    SHA512

    f97180ac525d00d6254aaa582d135f527cdb9779e28b0c364d3ef606555762b4dd443eaafcf9a8853dfbceae828ba9de48019bb088722b4e4a86ab053e1bd489

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    53e153a834555e0b93387597b6af4b21

    SHA1

    94f3e2dee7d0926c314a2fff0e58c17db8fcbdb3

    SHA256

    7837e8661fd254a18d1ef300005c5570a76dfca429971e0db01215ceb6b346dd

    SHA512

    c0c1459bb5d61a5c310389e41d9f1477b91eeaf851d70daf545151a9712e60ec2b5e6be143a089aecd40e24c991d058c9488d334b6ca3a5624a1955fdd822854

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    0585c82a051926e0b77f57b538fa527e

    SHA1

    10561455d0105dcdad57653275323ae1dfe71514

    SHA256

    7a05fc524353f0f668f9583a59ea55532092078695bd043fa1c53e64da08023b

    SHA512

    da99d48c460a6f2310e7819e959a1919bf58754f0b75a9e0457ae348fe6b58b3c2a97eb015158226fa223f8543508d50f775f7668e114cfa82eda62207e3fa81

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    7f3f37c816daab3b9ca49f5ef0c77521

    SHA1

    8fb329320c4e9819e59f6dcac659654dd230788d

    SHA256

    a1cbd3cb6045cbbd7af3ef7e93dd6147ee9dd167b3e89fb8141496ea8aaa0a22

    SHA512

    3133bc126040eadf4124fb16c89c37d38eb630108fd167bd80b470fedfe291dfbd89cb90ec4680426583afbeac6f724ad460cc74f461bf05d63d0837a521e4d6

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    0745f653399c33cf4e864c3ad431944a

    SHA1

    e7cfb7768299ef9cca534d20ab3cdf7ee0b5efc2

    SHA256

    8faebdb913102f9029dc09fe83fcfa6e7de546ee14c0f1b913c61f7389864013

    SHA512

    78a7bbad129e85ee5856e4eb6d271f765fe0eb996f14b53607cacf10bc5c0d060c376aa18a6d8dbb03610995c3bd235f00f3756a77a1ed02d72084672a41c163

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    1bfce8ba1bbf020208c6c205190bce19

    SHA1

    20b602a7f5cd7a89c19559a11f27cb301e224780

    SHA256

    92e4f0fe6e6bd1056388499e4a5aea4e811e86744740d81bc7997de78c17ce3f

    SHA512

    6e905afea1b7e155ba27e9dc15f1fd8318d6b795766ddffd761fa8bdcd64e2ad491d0293c7c638827b8499c438e4f21bd8448bc1d3d8dc5da8c55cabac8f8068

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    f7c5af608b0b38791dcafdbce7958b47

    SHA1

    9480f156b2eb761bb17953d72b229ad33addd82c

    SHA256

    9e77777620063f2536d47af64b06f136718ab65f118bdc1105ec0d247d44b7a0

    SHA512

    a04b1e261638264ed0a144c0d9c501b7b75df74d5229f035171fa12235cecab5d3aba3c0ba4c13fb36a979f37abee66e4e6e0a3eff12b78d490ba8ba0ed4460a

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    6b2161800a17b1206c9adaca6a43056f

    SHA1

    fd79a9a0e20f63ddc79b7c718329dfa67a831998

    SHA256

    9a663dc1328351d11f7f5ed8ac49b7c70068169ae72584f8f14946a7b114aebb

    SHA512

    a3b8f72f7f83858bc8e5906d77b2cbaa280434caf8c0da7c4f00abaf8978404198e9f4381b7e382b7ee9bdaf811664f23b5158bac4ee8519873d2d1189f55099

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    d726d0df6701ddfa62c4f5cdbd197b18

    SHA1

    9eb5315519f34de2a860fa834b2a4796efec0c3e

    SHA256

    22481202737660e6b14a8c38b49a78d7b479c251ce9c8c9981fd879801ed9033

    SHA512

    14c94e3e3d53a8b541c2de9421593904c39350f6367ef2e6ee150b311afd97f72019f8a2d195e1c1ba5e7ac73178f98a45ae580ef35e53158bdc863ae183b6f7

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    4d65f5d9134241186c2908ba3af0bcf5

    SHA1

    bee5b04d6a0f6ddc375c56a9da6d8f3456adc895

    SHA256

    035ad19c8e3e4e9f1bd97f982a9badc748163fb1a8eb26726b0521c4f3f1e76f

    SHA512

    57e8e35cbda0abc56feb7f3f0633dd2c4f5b0b0f7a7a0385f3f28c6e2bafbeeed2a160a1842af4898df5b84d49dd2b1a3bdb64b3e1fdd465e5927de7dd008ddf

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    690da1a826c4acb863f8596945d07c26

    SHA1

    b2c219dfab06dde7c75b8428438b1b998d306db1

    SHA256

    4bbc0bf8933b16b6f691894219692627ed0cba9b6c22409332853a2a559390fa

    SHA512

    63c7820a3d2dda3d6f05b822908fabc84c03ffe628459dc44f1f57fa701cd1baa61529e79982a3542cc509cbb000462047613f9ccfcfca950184edf6309f7673

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    3036093e45562af0b5d2975783c66db1

    SHA1

    74afcc18350fa7e08e4d3daac14a73e68b829fd3

    SHA256

    602f215bd612b41050d498c2929d406f1422dfabeb3dce4ec05d935046ce2f74

    SHA512

    a66b22e3fedbb4e72795678841b9c2eb0bf5443a488c9bb287bc9f26029a279aec26db4964f54ca2f3ad770f372ba8ac4c5ed3de79e6505ffc2b671366b9c2e1

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    402ef914bf9026857181ae319232e152

    SHA1

    5b5c9993a98ccba6e1ef1279db3db460fe6b1de9

    SHA256

    aa7bfa7b92b3abec75dd0772e5e45a2aa75e9fac38e5f24ab70b722343258408

    SHA512

    95758fd7e85682d9b99300d6d1ff98da1d5a1645aeff650fc7fd9119f28c293c2cd50d60ae98559859214ef4c5841bf52835a9b949c5784b4cabb06d8130d7d1

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    e988400e08d3872c519fcf9381d772a8

    SHA1

    295b669761d934c53762750a285654b2e9640de1

    SHA256

    9d98a8062782e23bc045f906a5dc6f40b22241a1f6ba90e54f2a02b93f9e536a

    SHA512

    553f5b0eb34bedb0990374da0fa1e7580f87d7e40a144e83af2b9bcf937a248cf520490509ab2863c42e9d9692a0c1dadb2ecc748499fab2565c53118b32f45e

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    370b730426348a02b4c0f9953789d947

    SHA1

    e0f4b043adcef7cc4cb2c4ba8893c839a27d5e8c

    SHA256

    61d6f3d9212c907d0b717bd9b0015cd4a99c931f227da60fd2b6f300deba812c

    SHA512

    00061d102edb869b6baa2514f23e13e3150d6e37452a9e82ae5b85b033f7a92ccaef0e4c898b7ff553db17eb796edb39c87055af239ef89175e1ab1bd9136877

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    9af6330df23b1c751ee06c5a267db7f8

    SHA1

    3078958ee1d0382cf7c28c34f0c49c9a4741eb01

    SHA256

    3917d6f9eb9237b05092600b1d8f14feae314495e536129d4295e92d956988f1

    SHA512

    3ba0ea92c0bb164276bd14bcfadb41a8221b473c003f7425f7b97f0c86557b71bdcd203df4aa226d18282f28134521976b1225536c82b867c02a3e4dc3b1a123

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    c96ac96953d350e5efae024f53d10239

    SHA1

    655e77885f43e038cf065a163d1dcb0d01e3286e

    SHA256

    802440ca14a3a2d0c5db885da78ff5d33549d0a84aeca8b86a974ba2f2f2cc25

    SHA512

    49c413b988236f88588fc1ffa12c1306d38d802e9ce3d9bf438a28c2517d9cfa830c1f320d2bdb3796fac6a9655c7d176ea89f6bae73a62b2bd52e401b34f5a0

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    ef7cd22a4b14bb5f7280254e962685a6

    SHA1

    fd8757bfa0cc1736be630eea66ea16212fcd1f7c

    SHA256

    6744e45fa24e639f3f90ba939076aad4e581e4957e97c55f347285659c5280b4

    SHA512

    d62d553fd0294f3c973f7e0d59ac15748437121c6322528d13c826af7fae63b62eae7ae8076b737e161e07c35cccf4fafaf9cd60650fef49b43fd1e5e1f30d04

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    e1afb29ed3b527dd8026f383d889ffe0

    SHA1

    53d758ea108d5e9969ae97ff8c5444c7db57ff85

    SHA256

    030655dfb8d3af03e069db43ab561933bb997a7dd25f20429d0df0e042c9ed11

    SHA512

    051a403b56d9b65f59ff27f298176bf282a102710709ce94e8a117f6940aa08e8bd46f3ba37624f265520641f79b41fe2774569274fc04be8270bab83dbbd0c8

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    bae8d82377c4013ccc82da3ddb3cd74c

    SHA1

    4b619c6dbcc91380fdca88d3e65f04c05b3a150b

    SHA256

    871ec39e31f51bb6899ebbcf9249a3db440af5aceb3844caf407a0146290dc0e

    SHA512

    fab8ea2ed6cb7ffe7550e69562872ba1184f0e25ef59d0a1ba844bfca96660a444faca4180e080b7a2ad43a66279fe9a38e654ee7613652557736c5006a0d0ec

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    4582a904a15fd86a318ff69d1388f8ef

    SHA1

    7f09c09b6a86039884585b00aa2eed648abf12b4

    SHA256

    4c539a4d7fc812a932e70193cb198837f118104a14f2703c729ab1f640016be4

    SHA512

    00370fdbd81d3b666e63dfeab39fbbb8661a1b63f06f939c76307bae7301ea60cfb7c0a9d55bc92e9acd85a52d00b7ce0aa9a08616070a3cbf9e8617c9c10b49

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    400fea2380d579b66d0b00a27837bb48

    SHA1

    51ebf13256e5b645c87ec5e43ada7d8967d86763

    SHA256

    a7a921b78059c578b246f0e68bbe48c02864e785074e6096a6bed60e426e81e6

    SHA512

    db07fdf32267f40f11b6440487b64e68c35d06d8b9436ffad6bd3495423fa7cf1770a5d010091a0cc1b8ad11174efa187660dc376babf46decddba9e26edafe1

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    e15f0f11c2c667376f2c2ce54e5c10fe

    SHA1

    73d6609f5dd2c7968ea2db64e8be1fde3a38122d

    SHA256

    07ed5f35741d43e8afdd574aa5ad329a4b5fc605f0f3b9a87d340187aad86332

    SHA512

    959dbd159628bc3535d0f7998eae09dd95ec5f47cd20aead788ef302ff8e2d0b74718de4de072d51d66cb485c867328a0901fda3b1c83394c9865e665c84052e

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    d33cde03b0403ca5d9e43f75224cf934

    SHA1

    b32b953c0b912915ebcf3716873d02ba730ec226

    SHA256

    05d124ba7cf2a4488b1bcf1435d79b3837498171aae2ba870599a1909b9d5caa

    SHA512

    62854ef335ac831f53fa113bca2a7cd8fc1b5fd7dc98b81d1d8df08c9ddb2dfba6e9402e4a408bc27b5bee82a36fac625651cfabc5cdabdcf51b62afe445611e

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    eaf65e55521b65c24a2fb96daf5dc897

    SHA1

    c67afc75ad2213e83d9aa9f96b488788f8a853de

    SHA256

    e44e56badd9b0d3bb5c7810b3df301e9f8a9d088d1f7048c4b30efbfd70a8f80

    SHA512

    bffc7a2ed00273f9fc36be64188d7dedc6656e96cbc472f3a171023e4340971b914bd6b8251d939430187002ed9a5f816714fb48672e9531142f15ce0aad85bc

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    9552369200a635599b08e4debb7b2eb1

    SHA1

    795bf70499cb4df5f5c99261fdaf99b6ca1b083e

    SHA256

    d66de17340b0cd05e88b6bd7b718ad7162034968298e40a49deddc9156ac2399

    SHA512

    9851bbdc4d050c3161724d5b06d7e1edb790fd400502cf5e0720fd25151f7d8ebb118f73b1163bd26c3adfcc7d3a602d3709b8b4aa9231d9929cae72b40cc5ca

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    121e63727943116a1e593d7ab730d2d4

    SHA1

    9402b153552df5dffaaa02851f3e3a0f97c047bc

    SHA256

    f8a61a4957657d8c00439e53b4ba53fa1fb600e5d0644fc1cdb145b2e7c26893

    SHA512

    a35d7f2e352db86b4daa644499b61e8a5b6ecee806aece6afb5f9f1ca3866a2c31339468c505afe95727b413949f83ca4c099a0a80a073df467e1066e175f83e

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    88cd4efc69752ce44e0caf84ca77260d

    SHA1

    e9cad3cba1ca052f7f15d62a81d00dde176ae3d9

    SHA256

    a167d9efba507b0448ce4c730ee8455af88b4cc10c2a3284522cb47bbde70f0b

    SHA512

    d8c807e0a49002f21ea36a0c2ba4028afe8a6a3e329ef1d573a3d0a2f5d74ce1b13b044290db422da2fc1fcaa985e1cc3223b1d318bfbf12c9b68cd67c6682c8

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/348-41-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-35-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-1-0x0000000002470000-0x00000000024A2000-memory.dmp

    Filesize

    200KB

  • memory/348-2-0x0000000004AA0000-0x0000000004AD2000-memory.dmp

    Filesize

    200KB

  • memory/348-137-0x0000000006470000-0x000000000647E000-memory.dmp

    Filesize

    56KB

  • memory/348-3-0x0000000075230000-0x00000000759E0000-memory.dmp

    Filesize

    7.7MB

  • memory/348-7-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-136-0x0000000075230000-0x00000000759E0000-memory.dmp

    Filesize

    7.7MB

  • memory/348-135-0x000000007523E000-0x000000007523F000-memory.dmp

    Filesize

    4KB

  • memory/348-5-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-4-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-9-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-11-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-13-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-15-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-17-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-19-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-22-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-23-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-26-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-27-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-29-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-32-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-134-0x0000000075230000-0x00000000759E0000-memory.dmp

    Filesize

    7.7MB

  • memory/348-33-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-67-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-37-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-40-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-0-0x000000007523E000-0x000000007523F000-memory.dmp

    Filesize

    4KB

  • memory/348-43-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-46-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-48-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-49-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-51-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-53-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-55-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-57-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-133-0x0000000075230000-0x00000000759E0000-memory.dmp

    Filesize

    7.7MB

  • memory/348-59-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-61-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-63-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-66-0x0000000004AA0000-0x0000000004ACB000-memory.dmp

    Filesize

    172KB

  • memory/348-129-0x0000000075230000-0x00000000759E0000-memory.dmp

    Filesize

    7.7MB

  • memory/348-132-0x0000000005370000-0x000000000537A000-memory.dmp

    Filesize

    40KB

  • memory/348-131-0x0000000005170000-0x0000000005202000-memory.dmp

    Filesize

    584KB

  • memory/348-130-0x0000000004BC0000-0x0000000005164000-memory.dmp

    Filesize

    5.6MB

  • memory/348-128-0x0000000075230000-0x00000000759E0000-memory.dmp

    Filesize

    7.7MB

  • memory/1996-149-0x00007FFC030D3000-0x00007FFC030D5000-memory.dmp

    Filesize

    8KB

  • memory/1996-642-0x00007FFC030D0000-0x00007FFC03B91000-memory.dmp

    Filesize

    10.8MB

  • memory/1996-641-0x00007FFC030D3000-0x00007FFC030D5000-memory.dmp

    Filesize

    8KB

  • memory/1996-151-0x00007FFC030D0000-0x00007FFC03B91000-memory.dmp

    Filesize

    10.8MB

  • memory/1996-150-0x0000000000150000-0x000000000015C000-memory.dmp

    Filesize

    48KB