Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31-01-2025 13:47

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>bnHDt+YN1cDOBYbnlegsf7LU6XqAnw1gZkq63dVvdlCUXMqun210y23XhN+hwvHE/WhHafCqNvUF/fr0GPr/x4ecWS9f2qsssDq4ulXp15/XyDZXB8sYId9hJisyg6EVvMEchm5+PCynVw+wpaBsGUBLuxSONXvZnzqMI+rLHAcGnvgg/hLt4n2bpXcd0waYAHeNBVyJUxIFVzbsbfC/oFg/DK5LmjFbPrclcAnJksXVgyHl3Do6MGA+05KbLHQi7GxoLV047c+VPeRXw8HEjUe4q/IPkSV3swGLLe1vFk0hVSVtivz7K4cN6DevPzsM1Z66fmIkFsmYo44hzk7CGA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Fantom family
  • Renames multiple (1022) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3904
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    63cd4296f5792226e278f78c2ba24f19

    SHA1

    e44bca5fa9f5874751575a48751bc6773ec241ea

    SHA256

    0a1588bf787d11b1e4d064ddc9a50c9b2fa3a99b9690ac6cd1bd57566e0fa8b2

    SHA512

    4c736852619059572ab50cb747ec110c720d118fba321b59a1be1e6c7d1a56d8e0d5954ebc1f83d66c99cfd16291fcd1fd9aea878c13fa2728d7b7b597546fe5

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    6bbd68fca581ae554cd6c1a887cc237f

    SHA1

    af00eb6c145b50905a6e6f387983136997167d1b

    SHA256

    c93ec09d64e3bdcd7068ea281b74f651b00c03ad026f73c47acb6fef96ac35e7

    SHA512

    e138d4d59800e994494a3cc66c7eafc8b852bfb1876013b761f509d576ea39c2f7a59e175517d5b72120f88c9da0929bcd9e39736fb7afce9df258ea7419ddae

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    9e160eab7a678192228ddacf6486ff20

    SHA1

    e9906a9faf348d9e2713a59ea75fdb7d432ba4be

    SHA256

    7a414479630ef117cf9d123c722dec06950c8f460bf944c28832235250c2d590

    SHA512

    9ae9caa2f5f31722ebe94775305a9963a751734fbb28bd2224f86e2f91cdd5296385c762d40f6d4a2889408bf8db6a3ffad7b55423d79ba9ecf2859f9cd1a267

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    df02ab6d834b35478783ef3d613840d6

    SHA1

    6b237240be1a216f440c5edc2fc6294b9121b426

    SHA256

    bcbdd1f690e83a82a8d736a5e09b4cbbdf20db0ecb2390efa01c80567bcd6434

    SHA512

    b26044c9563ec1f8ec54a5a0c4d8ac12c5451faa9f051e981c36ebf1e8b09ac7a37f654855b5a72390e195007d6c6550651948e08291c614780027e63d8fd532

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    916e700b3a15892c54a6159da86af726

    SHA1

    dced05fdb0c50548ade214416d842d767b9d9831

    SHA256

    ef164dfff99b5b04765377b186bbdd8e3eeff79df9793023d5518288722ed2e2

    SHA512

    a377cd27805cec9decf50674f09cbd1f8665b922b90eadcbbcba41414dbec3e51d71c2d92989903286e09b54ecafe7583a93dff0810932516ef76da3cbf9e9d2

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    87099617c5e82c179195bf539ed34ab1

    SHA1

    b2389c656bcfbd73698a27687cf6eb2529bcf57e

    SHA256

    ab27fbab6b575c020b4b196ecb19cf4ef130b74fe80de37d57c12386ee50f1c5

    SHA512

    acde3cdb1c36eb99ec1c99d3427d4fd2101b203aec07405b593edbc51a82ab2ff6083936d6d9a1840906449e9cf976d8561edc05fd49b92c21f592d051734fd0

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    ad642652cd63e5b8699e8b54659e06fa

    SHA1

    a95fde061a2ce358fd2f06adf8dbd95a389fdf09

    SHA256

    3e842e9117cf5af1b0df09a485c518d9cec883ace65a05b458ff62fee10ff9fd

    SHA512

    0329b5604070bfef48e7440e44ed1257f395331b07f03244f375dcabba595ac8a7c29c3ff23fa255f9f048a1a03db29ee5d04afd74c4d64be0141b4ba6c69cce

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    f6c59f7b39cd961dcef398acd984e537

    SHA1

    cdbd41fd947130af02d94443eb248739b0fc352b

    SHA256

    cef319056c8dbc3263a741acf76431d7ccb99e029a12ca35b6498d88063533ce

    SHA512

    41a7a5da51540cbb42b455a434a38d312f732ee81a5008cc8268f863a9651f3b74adf86432d7ab7022e1e41d0ab05f715bf03b34c201d3274ee1b41b809cd7e8

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    b5dab2a0258832da9742092443cc695b

    SHA1

    651a289523038b826d683d0619c7e4f06d95f190

    SHA256

    b24e6741b730d6b39bbadb4bf09f45afcfe2ac15b812c4dfa4912f0fdd257072

    SHA512

    cf058cb6037a94b41da88cf46e826d70daef240123867115f51f12a14146c5c4220e22ecaf3dce684bc0c3a184e0837d43ee50a697275136da638409e6f95354

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    fa862825bb987e5da8422c8f2a425c77

    SHA1

    7b225a02a887e9f3639b40b40500ebaa13151e44

    SHA256

    758aece22f1d226a7db0f5196b04cc4c4429676b432f1972e9a195fb1f10d6e0

    SHA512

    0fe99ab4df6ef9a71a72e251628607a1cc91888d59b7f06b3ae097adc271c03b8de4d3a96429e4147cf1d26d063123f4b2d1bba7223bf783840d5b33ff517321

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    c8365b6e09c18c907ea194913596a0c6

    SHA1

    18ae77b109a919e8f142363cca8345d90df197d6

    SHA256

    37e359f5a1c6e601e73fa0048c30ac228703190b24816f965e0fa3cfcffd0706

    SHA512

    a2fc09e6285ccef612492db48455a0db6f7f91349783cdbe7d4b55e452abacfbc7b12a54a91b7413e20930452831fa9893542504e5ad69dec26bfdb8cb302f11

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    059d301877d07fdc5d533f544fb1cf78

    SHA1

    892a8bf595fd2051028b8a22f3963ad425f46059

    SHA256

    0acfc781795f5d97345cd9dd257c2588a64197fc3e107f3dcbf3dd826673deff

    SHA512

    62f2f7a6a767fc8c83f8faa8343c29e3e1e8466d7f4c549f9ae2c8c3f6c78fcbedb1f3fe69ee46d9ec9120df5526e78ea8e92f5e50d4a39988a54f7481297e6e

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    6eefae4f5e552f55373a36bad568c05e

    SHA1

    89f4381ff5b77e573ab8bb171b5d63f2901f2067

    SHA256

    0bb68da0d0b1846e84c904c8e385a4e979337f0037efeaf161bdd9b054248cdd

    SHA512

    e0a6303757f116aa17cef930f5d935700d2cc7366fe86a89720df32171192e7ed5214f4fe096cdbba2bfa14d370e05aea4ba3df7b8a9b06dea08fc83ea1951c0

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    d03373a73b5955ac01ae2a5f16c5a0e5

    SHA1

    de65837faa1486221210be3baa012e746e154b8d

    SHA256

    b01c412340559afd8f80a0dfa6855eb31358ab504a6780f3aaf877eb621c7588

    SHA512

    baba1d242440d3feb30e5657f07637f81e1815836453cbae3bc8392d49313abf1034e286968764facefaafb01194c441cd908937a28f852883a36ea0e3544c0b

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    299634a2b595c7916ffa703b05fc36b8

    SHA1

    cf0c7a5d4299aa4a80cd28bedf64f3e5aa882a6c

    SHA256

    107b29df94b68483d44fdc4162dc52c1e859db7493e3859eafbea0680f61f9ea

    SHA512

    a95389d8d3c3e29340d5c88b83c9ae63f85df70f3fe3fb6129a5ed538101e89b361f83284aa764abda47f42bf40f3c1cb289c4fb03452994e4c5408dbcd44745

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    dc2440fe3985c1b56a473fa1768ce32b

    SHA1

    8148cb8a9658e3287c114e20fa58500dfb743ae7

    SHA256

    3f7317fcdba6ba4489734aa2cec0abe4899c8a78b5046cb93cc997c70c8c7cce

    SHA512

    35064c3f1a1bc9ed02f5ae6c90e2e900832e801bd9e5fe1dcfe0157dd685c5aee894faf0ddefed190bd106bf64d95d14e53cfa810575e9ba168370a905709b52

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    fa919db88e3c3eb1108f7870a09b0f77

    SHA1

    983c31c4f99216b03699e35a6b8bf29605f1b86a

    SHA256

    7c054c6880117ad972e5276ddac65dbee2a095160b56dd82deb4487e2ad2207b

    SHA512

    7b90b18ea4467994669ea9bd749f5cede2480b00fef7317b7dea7f4e5a996ac80f5d086389d96e720196f75153e698442887705a8e7077536541338e567c324b

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    b5568f9721d9f1e5af7c0b39eff6e038

    SHA1

    d5829cab551ae1581064e6af8aac44bb28d56670

    SHA256

    5da757df22fe2d2d2ab7b58a6b8cb19feadc377e1375fa5adcc4d5e55dda58e9

    SHA512

    4102785b14b4c0f154340a4ba8782d85a7b529eccc9c64bc925e6ecac1cea24aab147df456e5efc9398dea1f3655ab03e7cf1d51f6d365f4a40032a84fffe5cd

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    31e7312e42f75bd72638c5fae59ae6c5

    SHA1

    71a8db078512f24ff18d0677411f7a75a0d78cfb

    SHA256

    9310c9d3a1feb6baaa180d5bab4cfb71ae82c3e5406789e3f92e8448128d0380

    SHA512

    3ab43de27943d77b0b9431778218660c882c028cf20a9f05e572a294b5f1d34ff239d4158d9405c15dc0cdeaa9dde357bb2387221c016bfef0c5b7e0db383dec

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    6b29257153a5a2ff28ffa551dce3987e

    SHA1

    d62d23a350e2137567d0af099122159159452323

    SHA256

    875341a7ebcc93764ca4dda4b7ea29d05e714dcd5fa1a740a1483e57349a3141

    SHA512

    dc7b102c174a9a1aa346440d4e20b06dd80f81de7b3da3f7e17451c383692f159f460127f831e2bd77ff9a9cd0128d5f4709d1ab54c2320c84a98f6da93facd2

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    544fc8b6c600ed6c34b6e767f80a1e97

    SHA1

    93c41b9d1882186dfc038e65b10ef5ddb1c8ca5b

    SHA256

    04ad5342d4b3b455039bde78431d24cc109ad738828dd9c8ab0ff8b5861b1302

    SHA512

    f2ee9f9f04f34b3a40c8395a8aa71f8db98ceb50336a1df2237e5dd61292888d91666bbe3b5ae0ae362ca1e9885e01d40f8e4d6214269dfb172dfc73eff98f8c

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    72ef6a9d1423abd89c9a103f67f40b26

    SHA1

    6c02c6720eac61ab64b083951f2ca7307baa00df

    SHA256

    1d4e455eee9c54de732921bf5fe7c49c3b2cfec7cd9da3f99791a8e8698dae7c

    SHA512

    ea4d560aea732858c01ed0e0d88ce348131fa182f04ab132c0ffc070fc4dad2486e47202918c769d2079cb7aba9f369e6687e6b2ebb9d0e38163e9789f980b70

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    10a9d401a355ca1686d984e5afaa34b6

    SHA1

    87861bea37a35ef6dce0a2ca7767d067d6e401e1

    SHA256

    8b061bd5e030542e0186e3bffd69dd0a5adf282f0584a99b6b659d8abf3c3339

    SHA512

    6f4373cd62ff653e04a6a21a3f665e47031c2977159f33bd8d8a194caa25dd3a00acb1f0dfa6cf04c8e83659f7f0aefef1a6ab1475b94d3c168b3cc14a799b9d

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    233395e144c24a38f83b1114ef4e08da

    SHA1

    d8de2fb54338684a12229297c9e49d3cc5d4a708

    SHA256

    d56d80e036e364e6f0065e5d60184ae67829e94c8e21ead1cfd940ee7b142d27

    SHA512

    f1a3d333ba19f1ca5f94c8ec836a8431ece7770f1de99155d14eadecae7b6b5bdeb3ab2aeae3faaaa0487d89433bae3d67986a4a8d1e0610dd1859734272a0b4

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    9c5d90c30202ab62baef53cc80fbe399

    SHA1

    a1010414d831f1a6e96ec429144d16570bfec445

    SHA256

    5a82f9cc6051ef83d55e9ac7a2178523faddaffbbff58a334577bbdad943ea78

    SHA512

    c268b6dc1efd4f845bfad9ec45bafd7e5d27f9500cdd82ddc05e073dc55768b4968b4990f2aac19569178e404f99522ae2e01c81f0f113175b0a4d308ec24222

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    ed9f2b04ec7f4881ee01d9d9d9b7b3bb

    SHA1

    355630fcce8a861156e6e642f897257e085b1b3c

    SHA256

    3ea76972b6a9747a62a763a0f5bd5f8646cf05869197d53394494622e9245063

    SHA512

    31609215ee5ca26dd3265313f5d65ff94d4b4004728af17a6728c37eb20bcec35dae251b5e0de45aa1c9c2d8c442b80429b7c87c669d22779cc87cf46cdd93c0

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    55efdefecb992741b01b2b84b96583ae

    SHA1

    1b6033a708dd60c6ff7eb0c1c492a2da3e6f31c7

    SHA256

    b1acb2fc5c0e96728caf761c020518c0899c86eae27774ab3a696a242a9bdd8e

    SHA512

    00a8b36819e3c072a132de4e95a8878f3e7bdcafc9e317a1de87b74af3257d566886a23c7c6bbb3fc8128edd7aa6f6bf1ee9b8b1e99772ea33120bbd580fa7e2

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    9f58fca3e2069f2011e3c69bfacccf0f

    SHA1

    a0fca05faf8712c1582e13a21e27619c5c629b8d

    SHA256

    8b2c7cbc82a8a075126faf52fcd67caeed4784f31006ce7667f70b2278ac7c18

    SHA512

    8cf1f0ccda64e024ae001b529d433c1d253cedc37ca170a20621786ebdb8f414e9feea146af9be6ef64756b4a55297bbb1b82273b4abae3deb6ada053697d6e0

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    d8bafee693cc2e421018b04224058a38

    SHA1

    8aaef51002a5b62a5cb62a71f881b1f60f0628fd

    SHA256

    abd58eeda200ae839ef26e16113304fe9440209992bdc8222b1c8b9a8bbce885

    SHA512

    4c587c4747ddadc50277943b7a0e7adea32cfb8295cc768e9e8eb7173e44039d0c8bcc6b71d9d3deecd2a3e61246f33b4a3d7fd24e50f7053269af47efebe62c

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    33438a2e4b1954ee841acb55edbf2972

    SHA1

    7a6eca1ed2305ac6230291f57923c8da6fcc5add

    SHA256

    969e45c5d435c882fb06321f0515f31ee1e68a482358b74aeae09d87d8ecbbbb

    SHA512

    e27939f6570d57602905995d4fe74ed29fe949e30647c149c06b966f125956b960799a526c31bbd0cbace3525843054d71fb9b3b8deac4cb12bb7c9b2b55c4cb

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    72667c053020ad6fe6e18447b3ecf5fd

    SHA1

    60838cf39e4bb364b9a7a4e11cf4d16b23a239eb

    SHA256

    c0c835fc0c2b88ac221e6f275b186902e29710109008483ed79cb7564a21ac1c

    SHA512

    4faa99b12dc6c5d13b30e93843d915c5c1ad533895c742789e276f3faeb7d00370048e7a59ecd1b5ab06a680fb98a440428f5f4cc38770ee93cc95aa856ab598

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    5a1a19a22dc80a5c05cc8bddeff4259c

    SHA1

    c1f5c5d03170d6e691f683ca2bf792cc57248d5a

    SHA256

    c7634ab95953c011427080bb397b7132c2bddab330553d4d62dfb2204ffc1636

    SHA512

    018e79246e7a90b593f707db6bec0ee34ba418a9b87fdabd667d9fd1e0a3e414ce5aa20e4d3f0c4bf360a3aa5273605d5bf9779d023e8c2c2f925d28edec9642

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    7993f424e988a3d04eaf44804a5e7d51

    SHA1

    7640bb65ccc9ccbcf451fc901a9d017f3b896f19

    SHA256

    5ff9ee3883a460faeb2f25dd5c9963e44e6eb8221b66b9b1d22b98006158bfce

    SHA512

    def3f3c98c25ead0b3a9abe99646ecdd43c71d1546f3100194682dace37b66ca5744951bc22ff576f6f630670c3ba39e3538c61f34772eaf7dd5c5c05355b4eb

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    56f9d10287937160155d1cecf1df9cac

    SHA1

    a67da9033e513bee9e38191705f235640885ef40

    SHA256

    154e20b0753477cae80b46009f95abcf24de9faaa5d6c0160fd6502aacdefb2b

    SHA512

    07c7e5aeb2f15aadbef6025569b60042a5410b832d44dc8288f935c471399537225c8b46d22c3ecf40a40d9684fb9d838b0ca2dc5fe4636a70b7d79510ff60ab

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    983b2878552364d5edf410de8525d420

    SHA1

    452831f6fb931253407e59ff4da746251f7e4ed1

    SHA256

    5c7d9966e11f34bfa63ccef4b20ee4706710be1ef56ff2df261c915be0baa55b

    SHA512

    6bcee5eefcaf1e98aa90c3667308d655f153724f00774c0a8d79947bf745596dcbb22236b73bb7597eff7bda08e59a69ffba8fcaead800216eb24819c72bd9c6

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    161183495520fcb383dfef465d5ab74c

    SHA1

    bebde5a3547abf2fa3b77372dac73660616b0b22

    SHA256

    16c0cefe5e5d5ab6133f4725ebc51b6274ed0b58950760a27ff795bcb3caf137

    SHA512

    37b0e638aec3cb61c89114faec864daed098a324b3fcb9b720894309f086c0c48e2959e50c26015535a407ac6c57f6b5e9f2030490281ba7c3126c01e4902797

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    6e4e176962def5dc53a2c800ed05531c

    SHA1

    9e2474cd67d9d8c6693be179f366a602736d1657

    SHA256

    31ada496f1496108b71d6f069206e6342ca767d184e28f2891c99dee1ff5ce86

    SHA512

    56492413acf84fbbbb845c85601c5ac06bbd0f66035f0ff57351e6bb3378ae0e0cadb89b2a9f8361f86a5b1ff053c8143b2d64616abc3a70210692798ba84ab9

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    a2d65fe51ef9ea7eca245c8ea485c6d1

    SHA1

    78eb772f0f2869c291c5421931919370a09b5074

    SHA256

    1e00cc1025073ed226dafddd6c3bd90212f3a816e80bf0de5e91cff7018a4597

    SHA512

    8ce8de48cd1860aee1f2072939d1d6378184d8f494f3d464f4749f8e5631b755f791df0aca74a9166776547ddfe608cd4b1166dca5de5b633e8813a14cdb3225

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    82ac5a8ab9afc22d29a878cec00aa3d5

    SHA1

    d05cab282d119858c112ae18e9f16d26cd336d4b

    SHA256

    467f369bb2d3fedf0e68a920bee47cd540bc74a3d0eb3e498f0b551b75419178

    SHA512

    23fd1d34c0b32d186e20eb70d92595d3961674cd2bfd31572db48dadf3901b30e29f57b94ba38a6c09f16662a97be07956a2230a7248bb8d1f0b07c4e080b31c

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    e992a83948038a7c1822ce8865c7ea6a

    SHA1

    7178145cd840839866064b3bc8aa38dc07ef4421

    SHA256

    d2c25d55b018855cf8366731b9a31d12945d399d901194e17d2c784740e70405

    SHA512

    a42354d09e04ee29d6fc2354c6fe37cec6a7b8022d43e381129ea9287ab21d096ff25a36b7e004cd7331fb0fc22997ccc4bff1b3497a6e4ce3cab46d32d6ced7

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    900005087b821c6af20fee52ac638ec8

    SHA1

    7219cf5193945607f027e0ef63fd0e8b2235c6a7

    SHA256

    98598d6801abbea4a7e8bd04ec66ea440f3ccfc69ed310e7cf253f9d2481aa6f

    SHA512

    e0b24bb242e79f0f006e23628d2a00f6de4f64bc8e9acc1c04001c8332c8e097b2266fa2f04cf2bdd545b3c114bb93b48d776b120e13768d26359e08fa357238

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    49b20a94642ca3919ff42c2d7f30dedb

    SHA1

    d717ed3d3abb6953a174de1413621911b6bc8b8a

    SHA256

    2f7b72776b289e874934a996fa72e790c14b37effaebc2e39dc503bd8edabdea

    SHA512

    5da131ff88c0cc1139f66b2b08bfc88978a35c3b6353110dc52c359f20404562559ac32f9c630e2da2b6aa4251abcd9e3a9f1dc7551c15890eb0682a23772fb0

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    c638e41d887cbb5dee9beaa5a112f227

    SHA1

    cda0bab751d5feacf2b362b0a9935e6f36b158de

    SHA256

    c528dee6b7c1bd1c447b0b4b4e05d26169d64eac119bd93ddcfbd0b002c9b1af

    SHA512

    aa06b3b2e3e0bdf9dc27b3c9845ccfd8ead2a2e22d443d0c92084b7f5e690e2ffc20a9d5845c434b1268fd13e57061cfc220085ac1d496daffd3fceeea6f7e4b

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    1df9f96e71c9619aa6a9efe3b4cba17c

    SHA1

    3654081f43332e3b8d9ec400775d0d588b8ef92e

    SHA256

    4c882cbe56759059b03a5c4ed323eb589291e1203f46f1fa6eec8d04c74deb90

    SHA512

    0a6e2dff791229d73759ae9e2ac4c232cb72718877e24682436a7152786ec47692098d775796128e76e72a5c54df19cee98adf43a49e18d143729292e04f270c

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    96f0dfdfca9239a923a242ffcbf8dfb3

    SHA1

    2d055706b31bfc551f713e345b8ced3e02ab0071

    SHA256

    36a512aeb433119add2e55ac18d9e2a786f2cf4b8e3972492789069eb20488fc

    SHA512

    13c9a94aeb97b0563599993193e68dd92cb95ba0552df32a66a6526cc207ea0bf746698de229a9c24a9a8a9ac855b6971bd787b580cad8292c140bf0cb5ff110

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    21b66a3e13269026e1dbd64c9fd3106d

    SHA1

    acc84e67e65689ed3e64469652b0b64dcff2123c

    SHA256

    2a89beae201aedeb28e1f8b09c023453b8dc1d2e55fa326616d474d46c9c9963

    SHA512

    b4b789c469c70b42512308402c9d0b4ee6b0bd4b0f03114dc7e8c629673e84f773f9fcad0bb3ac3287a3b36f73bfa37cc0f1a55be2a2876099a8aee17814f30c

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/3028-149-0x00007FFE1C583000-0x00007FFE1C585000-memory.dmp

    Filesize

    8KB

  • memory/3028-150-0x0000000000EB0000-0x0000000000EBC000-memory.dmp

    Filesize

    48KB

  • memory/3028-671-0x00007FFE1C580000-0x00007FFE1D042000-memory.dmp

    Filesize

    10.8MB

  • memory/3028-621-0x00007FFE1C583000-0x00007FFE1C585000-memory.dmp

    Filesize

    8KB

  • memory/3028-151-0x00007FFE1C580000-0x00007FFE1D042000-memory.dmp

    Filesize

    10.8MB

  • memory/3904-25-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-137-0x0000000006530000-0x000000000653E000-memory.dmp

    Filesize

    56KB

  • memory/3904-36-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-135-0x00000000742AE000-0x00000000742AF000-memory.dmp

    Filesize

    4KB

  • memory/3904-37-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-17-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-19-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-22-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-27-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-29-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-31-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-41-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-50-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-57-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-68-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-40-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-6-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-7-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-11-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-13-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-15-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-23-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-136-0x00000000742A0000-0x0000000074A51000-memory.dmp

    Filesize

    7.7MB

  • memory/3904-33-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-9-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-0-0x00000000742AE000-0x00000000742AF000-memory.dmp

    Filesize

    4KB

  • memory/3904-134-0x0000000004D70000-0x0000000004D7A000-memory.dmp

    Filesize

    40KB

  • memory/3904-43-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-45-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-48-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-51-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-53-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-55-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-63-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-65-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-69-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-133-0x00000000742A0000-0x0000000074A51000-memory.dmp

    Filesize

    7.7MB

  • memory/3904-71-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-130-0x0000000004DB0000-0x0000000005356000-memory.dmp

    Filesize

    5.6MB

  • memory/3904-131-0x00000000028E0000-0x0000000002972000-memory.dmp

    Filesize

    584KB

  • memory/3904-132-0x00000000742A0000-0x0000000074A51000-memory.dmp

    Filesize

    7.7MB

  • memory/3904-73-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-75-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-61-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-59-0x0000000002710000-0x000000000273B000-memory.dmp

    Filesize

    172KB

  • memory/3904-5-0x00000000742A0000-0x0000000074A51000-memory.dmp

    Filesize

    7.7MB

  • memory/3904-4-0x00000000742A0000-0x0000000074A51000-memory.dmp

    Filesize

    7.7MB

  • memory/3904-3-0x00000000742A0000-0x0000000074A51000-memory.dmp

    Filesize

    7.7MB

  • memory/3904-2-0x0000000002710000-0x0000000002742000-memory.dmp

    Filesize

    200KB

  • memory/3904-1-0x00000000023F0000-0x0000000002422000-memory.dmp

    Filesize

    200KB