Resubmissions

26/02/2025, 16:56

250226-vf3t1awqz3 10

23/02/2025, 02:33

250223-c18xmsvket 10

23/02/2025, 02:32

250223-c1kj2svqgl 10

Analysis

  • max time kernel
    150s
  • max time network
    95s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250217-en
  • resource tags

    arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    23/02/2025, 02:32

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>Wow+3E/EITDdykQY3fy9RCRsyUlOLYoa9LRfo0AN/mSE4nmwk5MlY5K+57KDB1txdfQujR8Ftjsk4HohE5ueoaguBDEXAho83Thj1qRnCOdpSUIG4pzu3dfPdzUnE1h5ZTUh6nlIkhH/FGF67ZwLOSmecvJspc5Wy9+EvQ53NYbmL1mXBo1Y+oC2kW6H6ds0TYwaO8ifWGsHYtHR7K105VbrXhx28toQqDitkn07QfUyPytsjilhA0U/MC0N/dd+POj5/6Jm1epQLsqH8kFOJKcgx5R97p3qkoszCn4D1bs1yj3SUaxkenDDmCJZ1um9iSfEgu/HN4HkFOYtvmLffg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Fantom family
  • Renames multiple (1012) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:4408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    0a297a66169962f2cc204c19d8912ae0

    SHA1

    e87a9f560abb4286dae16ae3ba63f4695b54132b

    SHA256

    7b4673c15eb245406ea0a4b7019d269d08118a0c6e6ff5ec3dfff2fac217ccef

    SHA512

    f4d2352f3bbbb935adf21cfd740764fc262d45720e355f5c4bcd8c3928880bc680b6d7fe4f3edd755b8c43f0b7fef25c6895b2adf6d3d2044c2bbdf1999b8ee2

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    7a47e4bf63adb6e131d37669b562e9ae

    SHA1

    fae95a36e44f88372f5692066d2d6c4cc3b8e427

    SHA256

    7b030ed9c22f18ebfc22c112984f345839cd70d1928f2c2dfe9a47bb4495306c

    SHA512

    285003aa46be5ab056885250bb9b147a8d0de103d218566e9321a9fea5e198bdc494c8a9f38560130b26c3a516194a6045bd0625fc462de5f19216137f2489d7

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    1b92f87ac5a6910a3615860f5fe5611d

    SHA1

    d6efbbfc3ae36c645776c5e5cd61f3ed97582fed

    SHA256

    a04cb4f4114be2e97713f41f2eb4447bb7d53d28d1a6e80aa7e9a934ca7bf633

    SHA512

    d93d36ff56457e068712bf57a42acb9d07d1e97ff9985cf56a261598462bf1f1c20bcb4dc727efe44d26c29b4df138623e004566a40b4d019f53448a3c0d2ca5

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    a8e8b4a1aa99e68d193af953a646b053

    SHA1

    76823460f674037a2dd97acdc8ae1cc6ae61d448

    SHA256

    e158c3d29955fc0bf727436687d206d66fadc57a3a6bfd8947c805824de5b50d

    SHA512

    d10c5e3978d194141e8cc385f0ff239fff521d86fad4c879df774e2d709aa6898980450e72b41eda5b250e3c27a1ed639ab574714be1a093019e11f24712aeda

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    ae64700f4674f588ec4e80d1ed0425c1

    SHA1

    d6ffd6cc7b9d5ac9cf2d9f7a6a6ef53fa4f4a3b9

    SHA256

    6494a83e6bb545856afc5b7780382e82d052df675b1e05b2c973f15b0d59759c

    SHA512

    26e91e0e22c3d7efabd5ef181c66987b653e134551bc6cf5961b036098a9464e86c146c59dbcb4e1501c1647b3017cb2d5fe3d981045a4bb1dac038f1ec21c23

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    2cfd17a27b3f3e592d47b58689b3152d

    SHA1

    bfc151aab17f58028b4e9f9dd760427e168aecfa

    SHA256

    c9c8968e7df03e5a70ac3a7ca1d700f0bd4fd650ffc1beb1c207e80778f6a9c6

    SHA512

    7c005f05fa5372383599d07da6acafa76a04c5d66845b0dfa382347381d4fc5480707feda9b1838d726b060be2a3c9ed02d6fdb8cbb6fb97b9e4993c67e6aa9c

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    34babab0ae85301e9cb3b0317248d0b6

    SHA1

    9a882fa65a3910df484605dd142660801a26dd66

    SHA256

    4d83c95b70d547e644e192077067d646d2d0163f5a5fa2cb03aa770b6b162a9f

    SHA512

    69c695955430db16447ea5eed5ad9f1f7c109d28441354f7f1e7e8211c1592c6e4750cf52fac20ce82e41b139aed70fe658ad885a4bb074a46959442cd97e572

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    6f6987ea57d3040c4b59f7a7986d7e24

    SHA1

    788eadd070892efcd109fafb4a71dae268f1387a

    SHA256

    300eb2183f700391ef115867293c43e3970778b34d7f51bc6e5746e639c5d0e7

    SHA512

    57b8d62b30e7ae89c5ac1847c781462c40f76de1001ce4f82f000b8df26e71b5e43f957951e4f26addc08fb9b9a10e010e0a33f77c3decaa7113cc02816e3a2f

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

    Filesize

    2KB

    MD5

    71b5eacba2b641c5d4a8a90fcdff4300

    SHA1

    7e5e535869daa72c1977f46391cb0d8c3da4c186

    SHA256

    9f3a0ede27fb1dc92e54c6ec4d7221ce43109ef5d7cd6748e0c027348f978df4

    SHA512

    36335e8a0a3a228976589653d93fe31a234a5357ca51702baed240077d85f4e17ad6d848eb7bae6df34d74ce15be499f6194958c83dcb65a15c59eb4a05c2f5f

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    e27bd948ef606237ee427e292b0c43c0

    SHA1

    921307314e1aa1e061b4025f190a56065cc0c4de

    SHA256

    91eadf1fe059fdb7f055f5414d3312ecfc7723e8a10289717893860af909ef7d

    SHA512

    a42b05b59b58c32662e9a14620befcb4eb94ac70d79785ab507aff8c828b74f65520c1b5c6c7206483b904cf8ac68c32e2d0abe3ad72dfc96057184684f8d610

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    abd3d9e3a60bcc80510ae211b417e2a6

    SHA1

    c4053c92348e6b29e079430bfbf21830796229f5

    SHA256

    b95556b6afe7a82361b54138e881e9eafd65ba50cc8a82c926764a0df2204df1

    SHA512

    867f41de4bc5f4926ca4a0a02029d1a7d9c9f15b317b331f3683376026f2d3ce9fffdaacd772a9bb8e9d58741b4db44269244f8b1fbad240abfc06ed89f2d3b6

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    55da2bb78b5828e4eb511e2ff4366c27

    SHA1

    179c82738440f6400c52d1276ce46daa3da748e4

    SHA256

    f13e21b49a64811b3c8acfd602f32e5863aaf50e6b6b317a6b901ac9068e0bab

    SHA512

    2b5f38930230b983012a81e91bc0b0f7ca39f668810e659f05534c0108ba572449b48a18a0de266f03c96f561c6e5a6a5aeab938c10abf96314eabcf0a2e4671

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    a3f8fd4a70de4d9e3d7f445bda819e0f

    SHA1

    1e72cb5926b7920f4eedd76961169cd0dee05e4d

    SHA256

    c7394b342dcf133c00404c27b98606e001d05bee06e64d442259a3bb75857d66

    SHA512

    8c9f349c8f1863a931bfb021f37227a790e6b6c5e6b7fc1b069a8b65746dd0d21cc47fc98ec32c71491d7b93807af18639e3de7ef4f7883b55924359291c30bd

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    d52624b2c74c3c8c19d3b09bd8f92e55

    SHA1

    59fc82feff1806eec9aecb03ab5056c03c5c50d5

    SHA256

    792afd800e8a6e7dea466bcc950ba9ba64a1d7922ac428561460e039e3e8bc52

    SHA512

    914d4e67cb8e937dc17cce4836c89cc75f9b49646ef02d094a27fd2b42185b5c70ad14b949b3b992c10ec6c8117aa5da85810fc3a3bf081306f7fcca19b41d1d

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    48b6d098add617ee3f334a651e33eaaf

    SHA1

    1e0d8eb43800a16c20e25bfe37dbf458c5fbf5d7

    SHA256

    343d0d7b4e96842f3b261351c37c439600eef5fa007a370af12a6666c00a123d

    SHA512

    51cc2bfcf4f8216615cc946d8b93edb93b724816fef2d99700d98a9b4fb077dcf4e6df83208a64f42b4e9a2adedf4f0fe643a7ee4e1cae8f209afc395a975bbc

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    a989384e6c2d55ab0d4f50648d8f9b02

    SHA1

    b5831820b564758a40ddf74befd287c74e6cb22f

    SHA256

    cc3ce8b7ffa516f7c04436a3fe7878c80c5741d4670a15040f654ca58a3fd9a4

    SHA512

    6c7f876ea024499c8b5db6b6c742e5a29320a430132c8971dc34f1ea035bfdd758d34d5b1b77e2c9af5cf73e80b6109c3a96eb51e93c7b61901be7d840b839d3

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    51d751408f0720ffd63b421c329f6ce6

    SHA1

    7954e13202828b55ea94a27e69f49a9fb857751a

    SHA256

    7ccf33074f3829c25fd6dff59289acaa8780490064e8b5e47834b9ca2876e45c

    SHA512

    5246b18cdc6e12ff7fc8b359e693cc232b5d116ce0e9f559c1beb84872c2f48a2429a9f33926ebc73e6d2cba8510e4e95cbe473d0b545acd700c6b1c353f5fb8

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    e1609b50b56133260657f057f871f297

    SHA1

    23eef6a2c07e60f0c80be42d332533df890c91b5

    SHA256

    81e36ccbe3fd9796641bfedc2c2bfa3ee1d79d68694d600e16afdf0d0a28f7aa

    SHA512

    93cce7243fc111fa1b563a104b1672b49465b89b36d98ee4fd8af0572a7e2eae01115bdbed180577fd536da9858c65fff8e91bd656c5c503a54b0aa67df49f75

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    ae67d9d465a71888748f225cba4d9351

    SHA1

    ca7cc45338a4cdc8a67e97bfeca2429f1151cf04

    SHA256

    af7a3cd536267c265b0342de5ef47648c48376406824242dad382307d2f2a410

    SHA512

    c857dae1404d33a102a2bc4fc9d5d690ea1947dadd3aff93a327b4efd5ddf4c23ae2392308b294455337fa542f80254d04f45599038b3af297267c7a1f1f0dfd

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    2189eda85bed5434cf538b7a7fa83c2f

    SHA1

    ea73dc9fd5544c29ce60dfb133fad20ddf894fdc

    SHA256

    7c89cde8a41afec37cdbfe71c9ff5e839fc025a32463e691e06a4b028ef83ab8

    SHA512

    294bc65d0e10e0678be2312b43c0d02b2c4c32cf5037961bb0afd4b8bc6e0a06f4cd06ca4b0a51f7f50d098867720a8eb677e6329a417089600cb226f8e336d7

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    c8d0f10de385b0af89c2d27ff4124417

    SHA1

    2060e2af27a1aa8f8d4124d7663efca6a37c9f9d

    SHA256

    a37f4ab84fd5386e95df0e90e7ec85b664913c641a9e017da6a42f80e04190c7

    SHA512

    daa909976085530a6cddb8453b20e74b86b760ab6ab3a861bc8b91e9e5ee8dc12d124628509a9181922a67ce56924162583659508fb0edfe7209282311228b7a

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    e8740377662849f60ac7a5bab12763b8

    SHA1

    b36b968ae5bf1cab396b41be21a406d2a9358b00

    SHA256

    591f2d16427dab1a5fcb022dbd8c122be0649c662c64e3a4affc5f5f7f364101

    SHA512

    5a1072994886a49f9aa28ddbd8ec24208de97eb24b3fdc34e51e9f54370c9718fd07a4cb6a64de9c14ea20c7dffc6ce981185ab67a10f54bedd9ed8b55057551

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    bcf0aa078f5c491e56c6f78411679afa

    SHA1

    03a5389a59e4eb0b8314504ded48350232a27f1e

    SHA256

    e6e34051d049bed223bc4915d9189ed27af4a3cc59057d359bef646657781e86

    SHA512

    08c296d2413808b12e9ba1b0d8ab48497b986956260915f738190a6a27c8b4f8c6ea7166ae1ffc20bb0db68d82af4f7602151e4bdff4b1260d903234ce590e8b

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    1bdc8e9e5d4d8c5857fb34d503e6d3dd

    SHA1

    74137c5594e30b5fcf61fefdab6e8ae4ef87d141

    SHA256

    e281fed965018220689ec51e605125248415c69a49d4007370b59690f191f671

    SHA512

    e5a08112a4cf5eac502358194716c4e65adee5489afe7bc572e7f1c248ab2c8d92738c606a06945bf0a0c0151641df7de8b4824707aab63ff640fa328f0d05db

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    9f78835b3620bd67e87950b769a7fb3e

    SHA1

    a86322832078cb92cd7ec0169378ea03abbe16e7

    SHA256

    6e1655c5391f2c757d1302d253264351388499369951273621a171878276b2f0

    SHA512

    3faabd8432e04ce6f5a5cb4a4e62f74f71ba4dfe510c014795c3cb6c8f7bf4a24d9a65833eebaa30a4eacc12c66eecd63c7db055166ab637abb1b7632cdb05f2

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    c62a7a282279a35d2b54b6e099f8eb82

    SHA1

    68082b33eac1ef0d733c72592502c6bca94d76e8

    SHA256

    547f05f6baca45e4ffd1901b74018584f9414d6f6b5004589468bae1232a1aa3

    SHA512

    1f5af3697092638ebffe2f8b1e88c70c51086a76514b54d78e56e9ad9745ece910197c3fdf6e9915aa47cc963d274b0ea9391d6a9196daa5366c872d782cf2e1

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.fantom

    Filesize

    1KB

    MD5

    c84c4d4bbaa3b662c990f60b98d4d62c

    SHA1

    b2a936e8b8891ee667060a4ce938ad6ea6554371

    SHA256

    523e230208ef5cdba104f788133349980b4d354d52448a5a4ecbf12cc06adde1

    SHA512

    ba1c84abbdbc50da82b79ff84eec6407bdf3d07cd6aeae294aa9dc2deb3213a7c9de77c1e7ee776d65d1b50cf221c252e8644eb68b89fc47b2ae303093bb93d8

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    3a7553ff014af716b8c98ca2ff76af4d

    SHA1

    addc96fb996502085ec6ecb316f80447dc3f2504

    SHA256

    840f362dca3bdc394e05ed51453fd604b3a62e3a33bf8ad8fb40701596f8da45

    SHA512

    0656b3f803324147b38dbd0d1757dedb25ad6a133acf71f931f723037acc8f641efd2874984bf8192cb395d2bd7adfff357f684796a71627fed0cb8b8dfe568c

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    8793716128f94967694719ae3b655cfa

    SHA1

    280b2932f2eaf9282457675519ca90414b372933

    SHA256

    aca9941f44e1c8af1cdf2fdb4c1146a54d492d83348881a8f29ebce1b9166bae

    SHA512

    bb6c1d2760919586350a454bee6de4d5fa82c07dfefca452df81340b5accd6ecc40c965ad8c364af24cff49f4803d5f10af7081278aead2b23f469d825531908

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    de69364d16af7afceaca33ae0d419d86

    SHA1

    f071d954c4ec5e1a05301be022e9c2e1e0135711

    SHA256

    b1f3798a57e82393f7583f851ce0e7132eff266fcb76429a8cfbc0934735c8b8

    SHA512

    21dbae20c8bdc7661d3b4dc9fb7a9c39ba4d4530c2b88da193c15b384b3ce3697e56fe44a3ec86a9545247779a2d7980f453ab439cca7c3404ab428d61ff51ae

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    cd6e58470aabc427e427c71714d093d0

    SHA1

    146ea37f57e96b074d14a41fe8aa309b5c8497ab

    SHA256

    9375f3a7018d36e12d0ea99c5a3f55783e30fc8c0f41ddad9eada6cc50c1fdf9

    SHA512

    92bbbe069a7722a0fa53632149ca5facf2acac2f3a81b1f8e98c5471ee8d9424e3e966ae2fb8c4058d051cec23ca22747ef43b37655bc4ae22b961ae9a613d0a

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    aedc56c3b8e75528b8a30a8b2e222f44

    SHA1

    15d377bee98fb1b8bf635c73248ccd1857eecfce

    SHA256

    7e307c4d76551677241e2c824abb6f8eb935346cfe11edf740d2c29188b2d1ea

    SHA512

    0df8af12987e57673a7809b7866542df7ed2dacba954bf29ccb6217e382dd4b992d31eb2672e3acb692a0224150bb26d6099bd0bb71981bfb1431df1ee78d2d5

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    37e5943bbba8b83e2509489d6cb21f21

    SHA1

    7b0b0c448a16de9c06f5fd3be1f7307f41409413

    SHA256

    6e1a48db6182609521c26d49f5e71910b46bd6373119417ae37043e3c4bc4fc1

    SHA512

    04fd74e8a43dfd796f7ae6bba202be0ec63ddec14f26417204793824af46f65fb92e3f7e9583dcca6e2e276ccc8478b2ed43f6f9242919f56b1bb12e7f73c364

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    967b379884a43a008b780d2bd20c08d4

    SHA1

    04fba5d437acf57e8a474cdb1e9d05f66b271c7f

    SHA256

    0a7b647cd5c45d2d5d66d97271483db3f2bff5b937d88a64674d77ecfc485982

    SHA512

    bf21fc714d8b8d48b8888d4354fd6c062fac76532d52fd402b20d3fea87c45969529574e5665ee41f8864272e927632ddd4fa7abbdcd5b318d51636753151674

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    2826ddc176e36c7254ea93395f6706ad

    SHA1

    5d8229e37c3602657a8f79f6a69db4f3a72a2a86

    SHA256

    f45b8deb00226b019537f0920a06773f470799c734c97b20bff3bd806277a66f

    SHA512

    ae3ab29b0bc155346ac6f046b590e187333c520638929ba709a99b9c39832cde5e5e618f724eb7135cd11a582b6a290c841fbbee40d9d7c2e600a3df12cb65ed

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    ed8260bb076aaa3700ff2ee9ef59c7b0

    SHA1

    af88418d6e57cba4c40632032637751fdd495c08

    SHA256

    c227f59e45782c27a5574b411d8f7552fedcb0aac4b9aa33299eabdf866d97e6

    SHA512

    3ba06faa38a94a4f8b3a71950633abc977c59fc7f9b3e0800666a54d94915d23f9d5ab4ca15a61fa4b7557b6153fee04a321196bd39a584d6889ef855026043f

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    7a6ddbd5969ae13e4cf046af3203136b

    SHA1

    1f65b5d2332a98708229ad5e297cec15db3b987c

    SHA256

    7bc9d558d2fff59f169aa5a23e64289d9200dc924ba95fb25a0eb1c284438944

    SHA512

    4d2f3ea35f746147ecc247d2ce3f1bc7509b7bac65b73af8288a4520958b1d564e1b7f067d0bbd92a2f3f4f83552461dd5d81e3bc1bbd619ea7aba62e28ae5c6

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    476e208ece76764c4b31053ff8c36b37

    SHA1

    00d7df52e5a5b716da2e252edf01c8dadeb7406d

    SHA256

    2e0bd3609995155939106eaecca2d73220bd97fbc2cec04a80d13fdb8f50f7dc

    SHA512

    e85dec2956c1a82fe2ddc706b717fa551e0d77bff55f8cc8ad586abddc7d00c8a042ee8e52b3bd279eac3723468ad04b529ecd52b796875284e7e035eb8dd8f7

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    2990d492d85bac4f8144449d197f06d6

    SHA1

    f75141c007e487f85986748d0087881f170d14be

    SHA256

    cdd9b1bd0e5dca1a85cddd62e02980ba56ca0098ea852c7f1f0569da6dcc3e05

    SHA512

    16141cb0cd01e7c135c0414c489d6edc182afcbd46273df0123fc0997468974e9119f7a2bea558b99d45394ea60b82cb64259e3cd5bd2a152314a518232bfdbe

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    aa52f2deacc3100c0c456a173eabb716

    SHA1

    010be6a0de175e57ce8091ae7df3f6327d8f8ddb

    SHA256

    74bee2041444e187e204aaeb22f3f604ea19f81e264a8f81e6ae5bcb6e57c073

    SHA512

    64a77859f72e257ee685b1b2bf1f049d61cb5727740f397de36e3a50ca68593e20b9d3fffca2aa0c2e0b21c1b0ae4010bedb3539803351b448096131dc9f5778

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    bf09d928fae344f2d6f36839a00bc77d

    SHA1

    98043614aaf4894bfc1fba2c8a24d9efd05aecea

    SHA256

    f5dc3c00a4b6e4c3f899b6fa2f26fd6704117dac8cecbea00bb6d266caa2faed

    SHA512

    3623f8bc18efc9193f77fc5a01054e0102fa1f34c9c92c9138b8084dbe4bdc56b78f2e59f9c3f538fa3a805cac8695a3684ec75e7c53620031be5045002a1363

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    1b830d04abec607ea31b301f8a8250de

    SHA1

    c37e5b524ac1b3c4039f35dae6669acbd756ef48

    SHA256

    1eb01f29e8bf622de70afe697d199388796989bc41135e6afd9c6012c7e44769

    SHA512

    3a998341998e55df21cf964095d9baab14c8f81e5306c63cc68bbfd5d0216e2cc2e8d282a08cf688644f82bd5e07235525bf311cbe4131d255b914a05b778b6f

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    4b5bf2326250c68d9adeebe2fea0a5a3

    SHA1

    379ff3b030e51b3fa29fa02fe6c604f4ba9b2907

    SHA256

    470a4c906deb3a7f5d72ba0647347a6ee9129d751ca06914b8162585592b4970

    SHA512

    d987cd99c45195f148de437909c2898c0baa1c01b6b0aacfde9c5af8a41881e161396f8e5632ee7a206863cddf0ee3b71e1d207ea27b280b15ed3eeacae2ff37

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    71ffcc689d07ef4bcc5c56f83d510912

    SHA1

    65111bee0c9c641583b5f735ce5f3cf28837f43a

    SHA256

    d4f2f02087e4b6c0491c1ad9ddba6aa3876f2016da3453d78d17513b26c04869

    SHA512

    8a2c7153e3c605bfafad73d3fef40d09cfa5d121e06ed21f93135f05a13a4d3c9a8f04b66a09e32e54a40d80d00d7c96f1a12718177128e77777342573f23262

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    d94980e008721edd36449776f0cd668a

    SHA1

    6c4e1926485acbe4aa886e05d0743b18a430d45e

    SHA256

    e7d2f8417346ed047b591cef0b80c627f6282f54e7b0494d68100c2e27c0358a

    SHA512

    6bf68c6188524151d51dbe782bbd0fc80be9f64bbd799c9fa7c58f0b3e4724139811693121681725e5d7b7e1d53e6d8b4a7656be4b92d3ee01285b8a5ae1b527

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    635b208fb4ee0533c017faf9bb8cbf41

    SHA1

    8b80fcd7679707c51d521325a2edf815ca587093

    SHA256

    1a11793b87f2274163e92bc59ae8b3384e7285c5208ac1bb8272ed8a1a903b0e

    SHA512

    69414f82b1497b0ffe418b20f19955caea63e6bc50c7976b1e437f9e9b400e75677ad6c61c117a3d4f8c2248f71d21eafcd231b9457cf0cf2dcb104c06b50a4e

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/2904-49-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-45-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-136-0x0000000074990000-0x0000000075141000-memory.dmp

    Filesize

    7.7MB

  • memory/2904-1-0x0000000004B60000-0x0000000004B92000-memory.dmp

    Filesize

    200KB

  • memory/2904-2-0x0000000004B90000-0x0000000004BC2000-memory.dmp

    Filesize

    200KB

  • memory/2904-3-0x0000000074990000-0x0000000075141000-memory.dmp

    Filesize

    7.7MB

  • memory/2904-135-0x000000007499E000-0x000000007499F000-memory.dmp

    Filesize

    4KB

  • memory/2904-59-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-37-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-134-0x0000000074990000-0x0000000075141000-memory.dmp

    Filesize

    7.7MB

  • memory/2904-133-0x0000000074990000-0x0000000075141000-memory.dmp

    Filesize

    7.7MB

  • memory/2904-4-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-10-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-12-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-15-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-17-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-19-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-22-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-25-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-27-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-30-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-31-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-34-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-35-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-39-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-41-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-43-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-137-0x0000000005630000-0x000000000563E000-memory.dmp

    Filesize

    56KB

  • memory/2904-47-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-0-0x000000007499E000-0x000000007499F000-memory.dmp

    Filesize

    4KB

  • memory/2904-51-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-53-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-55-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-57-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-132-0x0000000074990000-0x0000000075141000-memory.dmp

    Filesize

    7.7MB

  • memory/2904-61-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-63-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-65-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-67-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-131-0x0000000005430000-0x000000000543A000-memory.dmp

    Filesize

    40KB

  • memory/2904-69-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-129-0x0000000004CA0000-0x0000000005246000-memory.dmp

    Filesize

    5.6MB

  • memory/2904-130-0x0000000005250000-0x00000000052E2000-memory.dmp

    Filesize

    584KB

  • memory/2904-128-0x0000000074990000-0x0000000075141000-memory.dmp

    Filesize

    7.7MB

  • memory/2904-71-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-5-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-8-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-14-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/2904-23-0x0000000004B90000-0x0000000004BBB000-memory.dmp

    Filesize

    172KB

  • memory/4408-602-0x00007FFA67510000-0x00007FFA67FD2000-memory.dmp

    Filesize

    10.8MB

  • memory/4408-601-0x00007FFA67513000-0x00007FFA67515000-memory.dmp

    Filesize

    8KB

  • memory/4408-154-0x00007FFA67510000-0x00007FFA67FD2000-memory.dmp

    Filesize

    10.8MB

  • memory/4408-150-0x0000000000730000-0x000000000073C000-memory.dmp

    Filesize

    48KB

  • memory/4408-149-0x00007FFA67513000-0x00007FFA67515000-memory.dmp

    Filesize

    8KB