Resubmissions

26/02/2025, 16:56

250226-vf3t1awqz3 10

23/02/2025, 02:33

250223-c18xmsvket 10

23/02/2025, 02:32

250223-c1kj2svqgl 10

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2025, 02:32

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>m7iZpbqfd7VABSXQFIwcuS2ujT7D/sc2urEPLpAgvBm0667zCVUm4d7BhvNJEZai2ijBeZ4PhP2o3XYiqo4BhxElZm1XBDfVouNVThDRAmKAWWoJip9XxI9CW/p+4d1/aDT5cIa//GDU61/qiZtbQxlvhEoLKrGKU3ux+DxGLdxux5B83dQVt2A0vlRO32KuWRsJVlUccCCaLZCidh3neer9I+wuL8/PL21fBtkqmWLAgyCXQSnKXuxjAsY7WYTRMFjYdDqa7xUoHIpMgG8/X8qxNnoe0oEh0osQfourfR3ugKMV6ktJG8WgEafx2Nq8/jFYG6NX9otRWsFm4RgzIg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Fantom family
  • Renames multiple (1234) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4196
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:4304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak

    Filesize

    16B

    MD5

    7d1248cd844d4214a8bb51cd2ece196b

    SHA1

    7107cb8f3ffde2f5078cf7c78f11331d65a0b305

    SHA256

    712a9dde40d6a1c032a7d0db5655acf9bcdde96ff5df39a6f33bfa923e3c3212

    SHA512

    1ca95799e0426e33fcb79c489af26de247cf9dceac26a6ba0cbf710bb021e67c0451e3e651c6731f8209b58510cdd80649df9cb4d3ca45a64758eb97fd118751

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    debe2e005d4a90d6986d1f476a909a06

    SHA1

    b933103c3463a35c2b13dabdb8a2105b0ee26e4b

    SHA256

    b3ac531c15e0a58eae9e6f615f27472bbd570e086dbc5e572b140890a5af7446

    SHA512

    3a060e442d56b2850ec1daf830a26869ba57ce3a871afc3c9f9fc8f8da2675680ff3a6e47a49fda1362667a36269a1aac74684108b92c5dcf99854b6c333eafc

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    b2a2a61ac923442aa3bccaa3479d96d4

    SHA1

    882ff67a913e3ec46410f9ff7f3a7dbede6cb495

    SHA256

    a945aa979eb3823e617cf5a5d895230437edaeb89c5f1913481d110f40fe722e

    SHA512

    87666381eddba7b3652551b8e9ea8cca3459d089c65c68e484bc456cd68c5c2e294d86cf13f941a6d04b80f717acd7bea895f63db66f12499f5678b3cccad15a

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    a3bb2d79e387e5a3c01f657ca090d28e

    SHA1

    40bef7a817467f13573a8ffec8dc4482314b1566

    SHA256

    cbebbbf0a895f64329bb3ddc792e332d6e14dbce649408ce83d1a6edebe7c794

    SHA512

    c3a92f048d04ef8c22628a1c21ad3527f5afdfe1ff2ea5aa7fd4b1fab079e5d3283b4dc668266c2187aa705b09899aa2fe96fcbb4588ac58e91522a3c134ff45

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    6ed0b7275cd1dbb2be2a887658de3d41

    SHA1

    fc0ea3ee057ab78adfa7b3d0376a100328534987

    SHA256

    10b23593b51309787e9d3c18b5c6c627cb65047f60f392bab262b54bd1f0e636

    SHA512

    22bd2d8bb7489256d0a3fdb28e8fcce1ac2ccf8d9c8aac5e76b481d45766a936d0a6e765e7a935210ed244cfc6d2e444fef6637f9e2579e9345e4731f3e9f086

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    b90659da4ab5839d7eb9113b1ec666f4

    SHA1

    cfa22d9916c37e5f92a7d33255b1a143034f89f6

    SHA256

    761791ca46a831f9a89efb5d6ee4999492f23752373c69dad5b8e9c89d5c28b2

    SHA512

    68eb47e2d7f9b2df1078c87f86412a909c7dc212f039674e4d544392fca45d495638da744612395e88289ac67ef380b288bec240dfe120e997fe70c85d07b46d

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    194c25695e23e55fb2afc63ed46d4531

    SHA1

    bbde6caac260902b05d71b24a25789f570ddf60b

    SHA256

    3fb3872faaa890a89ffea570e819509e555ba15b805cae621b5f33df7495aae5

    SHA512

    5d0103f1eef6cdce669751487c862c32cee6e0a6df8e74df5df70d663e4ee02a0b0d478a8eef54ba1191f8f578bd13b82721bf7e8b80f02e6dc867ccde0f52aa

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    7eb4d4fef466f983796fcb0fc99099c6

    SHA1

    8adfae26898ea7bc1d5ebfcf27e2d7e30c02c794

    SHA256

    ef1064164fc461113b8619848e6758f9546f1bd1332f874c06eecfda67edbd6d

    SHA512

    9730e4d2e5c21ed09adf7a5f95b83f0947e2a46a67c3640ac1e7197282041a4793d62e917ce602ee8c884313d1b6f2c1b15dedd7daf7f2219879c45c5887142b

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    99f41b86c7c99f2f723ee6301f8e817f

    SHA1

    16331cbdba31502c877aa9e0122eb64bc165c528

    SHA256

    66a2e38e2aee371010ecbb94124361b2f0b2274daf8bdbf0d39d907b0acd1457

    SHA512

    0596a8899012b0ae093a93f4b8f3a0b77d9b66696030608a5cb057989d1bd3480ed398773626888dee947f33174a43cc47a55a2698e02570d067f7772c3b7b1f

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    2a9d09795d37474859aa15e16ad933c7

    SHA1

    c894f7115bdd86bf579c56d46467a4b6b7d3cd30

    SHA256

    57bdeee96f0029f28832be90c9245a73aa13d10eb0e1de3f161cb3125169a126

    SHA512

    4a23e5ac1d28d8fdbeead3dff2144f5326e89466989dcd5f7b23ea8c927f677bc6ff26f76f3dda26e18a8fe4fa292da151af02b5d67046de2ddfff1243c1a128

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    66a972e94adc5301a03aee98012b24d7

    SHA1

    75324b7de043cc9715805de7dbdb0aa90fc8b6a1

    SHA256

    dca5c1440ce1004a8cface29f289b5c23a17461589fb90a56924bf61f194df61

    SHA512

    9404f796037cd8a4687771edb5bc561273f8bc746c358da6107f65571846c6762a99cfb94fb39010677edcae8e79762108ff382daa6f90d9245ed41fd7d6b812

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    a31cc3109b3ff3bcd2a47696e13f3af3

    SHA1

    17296c969563de645be013f54acbf9518ca85646

    SHA256

    aef46f0ad0c617cadf1421da2dc10dff481a5a090e71d94689fadc5e4a327de4

    SHA512

    841a100f7d3b506b169431f94f048b5e3f2c11ff2c8dece44b51531e524e922a11db9190e18d6f7f3eaa38ad139fa9ccda85ea4d09da05fd07993f44ae2a08ce

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    b68a951b4ac017f8983715a27fe42ad9

    SHA1

    765dc38791a7f0a44d7ac8d5913d1ef5bec9ea2c

    SHA256

    f2b747624cfbaa66373b6c5974579deb7dcb43253f407032073fff712c6c2e2e

    SHA512

    3f4785ae11d329386bd65fd38aff6c9cf7cd827fef8d2c514473946a2726d901f4620ccdb5456dc8e69286237de0dd1149ac4198e02eaa3b09ea62b703f63301

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    3c3e842d07966413543b4496ce44b41a

    SHA1

    f1558681f432248f070d413c0e3e4654f712a98e

    SHA256

    da28c0da6c54578ad4f1f535117f7abccc708a14d2da656030c688f37d743abb

    SHA512

    778522d12ab925a360146152ddcd303f4bd8c53e3ab0f696400ef5b71bcae22ecdf8a7ef717c294129ac67e88e7ece86fdc25d2ac48d55d88eec98b0c108d534

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    efeaa3344473e2da3a2b5267ab508106

    SHA1

    b117c8c9f9e287e1b99563e69ac33c0caf56fae1

    SHA256

    7777cfe42782e48d7368f6a6a2889c4977dd0450317539ccace4cf8350f759fd

    SHA512

    e22aa054bbac55194d3f5841f95e5f1358d44571ac0074a95a90748a0f50b1441d4e5aa23949525d6d6b770dc84174089eb49bf2b937edbf214334b41125dfa2

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    d7db5d52723f2bf9d7d0a91aef7bfd9e

    SHA1

    d5a75fc5931e61b3dc24e3af48900cef5ff8a0d4

    SHA256

    9c2ed737fb427070fa4bd8e3d57f39654c1c32725542d11c5dc44a50fc04c1f6

    SHA512

    ce553d401bf1207b79371a0888cc66cbae5c9fb08725c25c2a3959d6d61fec367fb5a811a0d9d5daeb49921f2484a4362e6b6020f174d9e05af1988d5f0cb807

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    1fb2afd138c09739aa675857206c420d

    SHA1

    da129a879f38a485c8d7e3bd589dde31fe252b6a

    SHA256

    a04fd193181e2d64b190205b7d792f0bf76f28b420571f43c0256616631b8614

    SHA512

    0666e478feb3d8e594a946ddb0617c5ca93a9b175193639c2d9111c0e009323a485ea288ff581bdba24525ac463c77a61ec771dffae6fcb6288017eb2cf152b4

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    0c899fdb68bf07704156a9921b463285

    SHA1

    4a51f6a8e71ed6035c8ce4cbb6af9dc354179f36

    SHA256

    57dff1cdcb158e24d22a887d2b1efd92012cbe8fa95526b8436c1626e9b11650

    SHA512

    c244eb1e267ea69db62ee25a03be6a51c4423a984f6dd7efe7601a8b66ed1f4db7fa25eca46236cb7b26d5cf40420fd4c548cfb9686804e8e26210235bd33d51

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    040d2866e2f8c4fb8394db343ed405d9

    SHA1

    e0137d5395e08d4ed9d756a3e50034a9ee55f1af

    SHA256

    883bcea39b568c3edaf1f48bd87830343ecf44f7a27cb8f68e88c59181b47b35

    SHA512

    1635a86de604cffb465d402838c49f3d128b351fb71bcc7fe02b968f8beb1b51315e16014d023dace0cfd9072ef41e8f61d3e0803de76cf4ef51db7d3a516299

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    acd13e910d89b45fc5ce9f35fa760586

    SHA1

    34aec73bfe444bb50ebafdbc675978bf0868b768

    SHA256

    11e5148856677cfca9f0d64606e839ac535cfade4aa12978a1c96c0e6221162a

    SHA512

    35900ad17916e7d16f0e9f868b3746acd1414519d24c7c1371bab64ded61862045e084759a20989ebf39d0ec43451c06cd26f466bc1855e613cd369caa63fdb2

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    45d9f0fc4554d203a3f96e22ee1a2c93

    SHA1

    201a197e67e48077c14ef8535da5e59d3048aaef

    SHA256

    a9f9e4a520f71455d3052f3d387057f6a7ada12b9960ecba5eefec3900d23e2e

    SHA512

    52592f36e30d177308c367209f523ad9b48475f74724b620be7b641f4a1db37a8957770a2d8af1a376f5fb4e8be0782d6007277b6d79bd922aa27faac09a1ea0

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    494d0ee269820df58de53843bac037e3

    SHA1

    f4c2d14738f00e14e4e7d5272552ae3b2b4a6571

    SHA256

    c343494ec371f6a74ed913031d53bc0b7aea75cbccd75f5dec1b85e95b1490cd

    SHA512

    a01d96fee87b7978f8563ee2381ebfb2f96518ed1455210a11f376be2ec0ceed70de140e28ac57c9e24bc1118de3d68d0c9fdb58e17837f17e2ad6af66b6a166

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    a189e159e43f5cc9a87eb568f22e334a

    SHA1

    ca6fe6850e24ffa3573a3f2e043763cb49f88199

    SHA256

    179b9bdf186866cbe81cb633c84c26f10e2e7d19ac9b58a77bff184096394019

    SHA512

    b861aed2ddfbdd1203eb2b9d54ba9e7462bb69de9697f711ae7294491fb086145b8870a91ff09d86e95aeb96f59dbb714909d986f2cf9cbad29bc64bb8f8b510

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    a6a842b7eaead733a2de7d3c6c1db966

    SHA1

    38be6489aa1f4daebc1b2ab8bc3073d08845e9ff

    SHA256

    c7933aac8d723b92a27459aa61eef16d87062101381b8d95abb5a73ee841d808

    SHA512

    5a1cba6804c2a11a57317a2b121f6f20d4e98585a67418526a5a02b866e91c0acdbeeea5aabb2df15291c37b59dbdeed59425bacc2cc1ab31928e6330be1b353

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    e511e6cfd0603f348b8cf407e8c9d9ad

    SHA1

    ca362d802d8a2cac728a3b7169f5dd23750e320b

    SHA256

    3be075bc9e4c869266e1631fb2d1b9407692c09278c896acbd1f8d22af72ca6d

    SHA512

    a1be3dde3b7f6d8605d6881ea4a49b488ee93ec369c5fc3df0633722da048b3326c5c1303b41e3bdc6e6e905cf8e818234b729e668009b9247e3cf141c1d723f

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    6df2dcabbf0b8a6760f27049584ee8e0

    SHA1

    e16143e1103b757573c067c06bedcc90ea20ffe1

    SHA256

    09614613f96996e83f8c918e16a061dec72ff1a4fc01cf3793165450f13af646

    SHA512

    c7a36bff2da793286d602bb21272335e49f09744e9e2d86e748cfa217704dbf8eef820a8574799f72adf1ca35ad3b8035e69d406be451d001118e5baeb98c5a6

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    8d743b4d3c79ab5e06602e07f6b83e5f

    SHA1

    2cf0ef6f109b741383c34ece85560b3539314ba1

    SHA256

    1ad6e828eeddcbecd83f00b047ecc04668c897646d859b929f321b293d8f6672

    SHA512

    f2d7021e8a8a4a467048137661fac3fd33d69e22dd86fbdcac39a3024c158c6c51415e79622fab015a8d8749e5a530eb720c47544516730981653e39cf26cc0f

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    ddf8e9fbfc92c9352beb1b3ade051740

    SHA1

    79ff9e62af726fffbe45e375c8d26c378b4c90a9

    SHA256

    4467ea7aa7c57d25c5e5441b49ad65cc7653e94fa6b6f500c6fe49113479bd96

    SHA512

    98b908bb039ad7cca4b562a454776a864580ca60ec9d1a74c46a0062ea112f4188c5e44478fb7adaea86cb3fa72ebefba2d6039b6ffe9461dd5a0877c4d266ca

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    413e689c9545540927354499724a64e5

    SHA1

    efe9ead1d34b4347e6d47076c73881fd3fefca27

    SHA256

    d3ff8ce7336a61061475dd1153309f9d20dbf72b4fe71f8c3002a85242b4461b

    SHA512

    da3759e1f20ebce071e4adc738a42d6f1aa2290c262fb38f8553a1d4ffe39aebe2cab25449e189cadd658662c6adc079029d1a417d6ed9298ffb4ebb5dee7e7f

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    3c9e870a981d25daf3d7940a95b7dd5c

    SHA1

    a0540d21ec389f0f6ea7364c66a59431bec5308e

    SHA256

    4a06b4cdd72a872a9b55d5a0a086e9196611943e4350498c9726d308484cde27

    SHA512

    9ff14a84e33e3a64491513392f56ff6dc0f8c0acadbf653d81fe1c2d3915c2d3d4c868bdd27f9cf93c0bd2190c0398ac709d609f1c3ea582cbb92ceced746b73

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    94575d6563541c3570057aea611a8a4c

    SHA1

    efeb65b318f067eefd5cb9cebfd52937dcfac49d

    SHA256

    25346d8a659d663ce9d4fc551b10930effd008424c01d7e57d55477ed3f4f2b3

    SHA512

    64718b386f969ea4cc4a440a5f68186660944a36c045d629710218954a4c9406896ee0fb58194efea9650681f7b1469f6bfcc871ae856a6267b00c66283eff45

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    d4471411bca8fb5676c0d9b26b4134e9

    SHA1

    1a76fb39d25bd4aa17002ffef458dc9e5c24ed1a

    SHA256

    602e451b1c504eda2d19e0cf64f3ad95cc56507125d3ec690cd18ac2dde1ebbd

    SHA512

    26872b4429ac5a618a66aec443f0ce3b6974370994c2928ea9489709df44c7526ac9e43cf4d3b3a6d74e48a5f5d773ffda0ed633fef562872ccdda4b9a6d64ed

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    f414a3a44f6313e3bf2a10371795eeaa

    SHA1

    cfb18eb92c80d665c49970a586239ce9194b51cf

    SHA256

    6d7493b6bbddecc338f871023932e63454f2883aa559c40a37825da010d606ae

    SHA512

    27ee97e16dabf4471657dbbf3562dd4f79189a268f3d3f0e09cbcf298779baf303e3c8366fe503811ef77f4b7efb29ebf956bbbe93c89d41d27c92bbaeecc7ef

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    cb87540aa6be5dfd5bd8bdbaa2b6c5b0

    SHA1

    5b10ba3a0abba8327319daec47035d24c9bed6a3

    SHA256

    b359cf11e607c6134d65398b8053e0829777e0cdd60cc9b8bc7b9f575e32b491

    SHA512

    2c8e7586f0a77e7301fc26ad19074dd6ec64c451f33ff6376a9e86dd2c04e4c6a037c256a73246102d144167ce380114cc02bf5b0bf01b33683643aa181c1854

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    29c41c83a9cbdb878ea4408f1e07b519

    SHA1

    7edd0db9a72260313818a6486c36bd8138d69d5e

    SHA256

    bf0dd5ca9138c540405987d83f6de6821e5e287c05db8283e0ceadbea36ff956

    SHA512

    2fbaba12b347d8a17e909d7889bc4c861cddd403ddf7233b244597cbc5d613857cb6b2e33eb7156ae5cb4191e6d5a0bbff872c3176176b4d4f1fdeb4edcc5fe6

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    3b8a5f3b10e01cc48b4e9d549dca116b

    SHA1

    5aeb7ec9639d054b2deb848ddb6ab0ae1428fb09

    SHA256

    781999ab6a5959905a751e7acdac7d2d43d0759125c75dd82c0b370ce22b9839

    SHA512

    0858c8898f387bfbc814fb26f6b47b7507afe52db112a97b01755a5d0c21da439433bb1a11098c240f78b0a21dcd1e269c570ba9886dbe7a7704b6a491a8be0f

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    b8841588df5fe8462c6ad6fa9fc4bc8b

    SHA1

    0387cc51ba6a9248b4c413b4b7cc367189d2d431

    SHA256

    1240dd5386b2c9f0f5874fb928e037b9d813dbfe4f78607f972866c330666a4c

    SHA512

    143323d603c43076e5585c32e6cb8785ffc9b8090bef40499c1d98db8e51219eb0887ae2be304032f36a9614999401297b03828cbe9eee0a21b071ae886e5c8d

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    241417c6dd2729510ea70db8c08c505f

    SHA1

    1e7191d08d88b32bf7ddaf37be248f5d736cf283

    SHA256

    a5dbe71e01a0f7296bf9a713b59a0b119292e390efafd30152f7ffb4f9908957

    SHA512

    150dbfb499e8a0f42012aa2e8ee664a57ccbd2a083b8db723c7234ee63f7dfcaab1b3b45a6c3208d74b6829c2c6e40e5d2d7c14b698d1c273468c53f113d12b3

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    8a31007922b7f5146c90db33edffc514

    SHA1

    d3d554bbcedcb9f1f055c987de44e19de37c5f1f

    SHA256

    e43810fa358a376fe694376b009cb0864673e890385ef49fc4fc508036ffbc12

    SHA512

    8f389d4717c81bf571d355edcf9d3103feee402e638d92c0230b85a7d5f7d401013fd2b804dcc5607c6e78b6f84712d1250154809c58c47f8f29b1c83b215aa6

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    855e660f24d478210057de6923d036c0

    SHA1

    b65179c942b3146df27601277c8a04f0e6d34d42

    SHA256

    4983748d162c7d7af0ffa8cdc01d9250588f2c08fa6d316e6964e5c96635d183

    SHA512

    61548418a9539ec32dcdefacf94c6cefe20ca12e779ea9ad9ff696b363e431f7ef15068f57cc0fdba45b654766a31e3faa1330c678c1176342462c2b3676ae12

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    9224ab62993f59caf292bbddee9ef8a8

    SHA1

    34549730b5a8b441fe3c57e137aa39e9c9132bfe

    SHA256

    d8251a1d821520cc3afd534f8050adb0fb914a01d14a0ff0deed3beb5b648d88

    SHA512

    64de9b2d5e6e741b10be086ef6b45945d8208274bec3749edcedcf4b73ae9b056fe6e82616a77859d5a6495dfcffe94360517b15f24f021e2c8a7002fe3549d6

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    e549410306b6cca4f91e1240f2397682

    SHA1

    8e00f5b7aef50e2246be29a1aa5e4a71d72afd03

    SHA256

    2b590e80c5962d18de1e82724e49bd96e0c0a4aa2c8235cd47adc09784873bb8

    SHA512

    09b1a0ba1893a486c3b9de9c4443d0f1aa5ba4d01bfae2f16be2fb373adc3bcb88a8e5637e516e0873255b2531aaf3b9fc267687e69d0c27f6dbabf938dab5f8

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    9063486560f8137b2fe49f71fe0d5b13

    SHA1

    3d6c42666f8b840f25b1349b9e6df1e43de621ac

    SHA256

    55f40b5ac5662c953e53f33a673f3955a5fa31235237e77851b9dff6bbbb29f0

    SHA512

    8e2c2c47d023db774f27178234681965198281ede90a3cedd16b83b217a258921fe0dc05de9b6ff6ffb0ea2bff6a449d494aa9a548bf08f1984746e696981eb2

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    ebe4894353c05fdc130e246d0142fd2e

    SHA1

    5447630e8194ab895f428862f4d492d24792fc07

    SHA256

    931ef8a634c7cda99f2b3133d23d40dffc26399b9048ed451b7f6c603d1a6a5b

    SHA512

    5b09a53891aaa3429523ab7686ecd66e041e1bf1d52dc07f986b67fb3b1ff5f4705e89da57eb6e10abae331eb7679ebbea720ba1bf1f4ff61c3704ff3bdb9aa2

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    27da51bc6f6b4bfbacc1b4ffa2356afb

    SHA1

    8c367efb68c757f37ef05e60d7ef855a5d04a639

    SHA256

    12210146b2e6215ca08c90ad5cc316fdd179dc73524348b4ec58a2a5730421e0

    SHA512

    c87d5990987845b48b4c6993f21a3931dce09013c598af797b50dc593ee66a021536bf44d98badd72b394a295badd11cf3b7f7578209c9856cbd254fe5ee5dc4

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    f93895924934577cdfae961ec2ef1b04

    SHA1

    08d6184e3870a7b73761daa81c1b589aeb0b3ae1

    SHA256

    11c59d70b432de257624d2fbc0761470575083515541c355c6d21d7bc4bf8743

    SHA512

    477a8fa354cb4a753196186f26c4f5c12963159a44c9337476851e9cf5c7b3973d2323f0ce297c01675c45f222996ee00e6fdf049a88a23240a043623c6e8e6f

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    824c3119325b77afd486eaaed1ba28c5

    SHA1

    d56fb2dae9625636ae60a7dc6f34922ce32307b7

    SHA256

    33fc425d58e546666dadc592c19d7682258ac4795a143dd3e1adb3ade6010061

    SHA512

    130c3a96a6916d16574259dcfe8b78a6c816f60280d5f484b5ad150dd318223521625a20bfd95a85048068dbaf878dbe28aea618e06c052e9481f5d9bd86aa91

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/4196-41-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-37-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-1-0x0000000004A20000-0x0000000004A52000-memory.dmp

    Filesize

    200KB

  • memory/4196-2-0x0000000004A90000-0x0000000004AC2000-memory.dmp

    Filesize

    200KB

  • memory/4196-3-0x0000000074EF0000-0x00000000756A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4196-21-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-136-0x0000000005760000-0x000000000576E000-memory.dmp

    Filesize

    56KB

  • memory/4196-135-0x0000000074EF0000-0x00000000756A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4196-134-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

    Filesize

    4KB

  • memory/4196-4-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-5-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-9-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-7-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-11-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-13-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-15-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-17-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-19-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-23-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-25-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-27-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-29-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-31-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-33-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-35-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-128-0x0000000074EF0000-0x00000000756A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4196-39-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-0-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

    Filesize

    4KB

  • memory/4196-43-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-45-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-47-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-49-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-51-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-54-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-133-0x0000000074EF0000-0x00000000756A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4196-55-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-58-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-59-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-62-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-63-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-65-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4196-132-0x0000000005350000-0x000000000535A000-memory.dmp

    Filesize

    40KB

  • memory/4196-129-0x0000000074EF0000-0x00000000756A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4196-130-0x0000000004B30000-0x00000000050D4000-memory.dmp

    Filesize

    5.6MB

  • memory/4196-131-0x0000000005120000-0x00000000051B2000-memory.dmp

    Filesize

    584KB

  • memory/4196-67-0x0000000004A90000-0x0000000004ABB000-memory.dmp

    Filesize

    172KB

  • memory/4304-150-0x00007FFE09300000-0x00007FFE09DC1000-memory.dmp

    Filesize

    10.8MB

  • memory/4304-148-0x00007FFE09303000-0x00007FFE09305000-memory.dmp

    Filesize

    8KB

  • memory/4304-610-0x00007FFE09300000-0x00007FFE09DC1000-memory.dmp

    Filesize

    10.8MB

  • memory/4304-602-0x00007FFE09303000-0x00007FFE09305000-memory.dmp

    Filesize

    8KB

  • memory/4304-149-0x0000000000F40000-0x0000000000F4C000-memory.dmp

    Filesize

    48KB