Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2025, 22:45

General

  • Target

    Fantom.exe

  • Size

    261KB

  • MD5

    7d80230df68ccba871815d68f016c282

  • SHA1

    e10874c6108a26ceedfc84f50881824462b5b6b6

  • SHA256

    f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

  • SHA512

    64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

  • SSDEEP

    3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>lEXmSIvweJqL9PKcT//Xu3oFRUB572xCK2zwOsox+9wtWXVD3PuiFvo3sxybGX1r2OEpaNHHhqNHajZHC7DE5WPnkhhqB7CftpdXakiQEVApFJ940SzmGRlWArAsR2vcvQN7pypG+ohTgsqbinmyuWdaX9u6zD/pUVKLwsc6664IQ6DQrgc8zYOVphPLZyELOpxnp7TbitlM0JSoWnVVLxRWa3q3ZZ0Q/PcOVz31kjowi5dYWnKDvgNcL7SRXQN920rAA9wZovyE8CPmMONTCGd4H5IaZbOcOFTVPwZ3JLwnRTYgXN2PWjU9/+oC2hWGzT/EpYMrx7tyKxT1b/n6+Q==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Fantom family
  • Renames multiple (1231) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:464
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak

    Filesize

    16B

    MD5

    e4fefd1ee7baa8b001eee778b6e5d2e4

    SHA1

    6d45eefa35b9c4b3d7923e442d166c9a4a4a5966

    SHA256

    551403bccb5c7b3fcac1e7439c58dd8a05645fff67a155e204f1ccf0590eeee1

    SHA512

    1f95f8c2b16bcf3244a7b9f82b2a7d13fe60d77f6349a92a602cdd50d5d126132aa35057b38e7932141c91f0d1380193d528d81a5eb04a41ab4fc221ccbdd67a

  • C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

    Filesize

    1KB

    MD5

    64e15cbd6c48b7724fcc2d6a429399e6

    SHA1

    f0271c8ba24fc49b06685f3bb90391ef69a733a3

    SHA256

    13952847e49f2eba5229cc1c40bffaa72a9c80a5aafe90d61fc22a55005f9b7c

    SHA512

    ce761d9623220cc2ba03eb48235c233560aed213c49a58eab3daff829db8543d2c298bb36f01118129d79fde739f713da8bd468bd5fd50843e366f0361c51d27

  • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    160B

    MD5

    01719aaaf708e127bfbe9141a3c9fd26

    SHA1

    8cade1b18dadf6748cd516c9d1d7d79c87af2148

    SHA256

    af64c45c2b1dc89497cf51fd6eb82052a3137a48b1412bdeb2b2001f76ad051b

    SHA512

    f16465b5b1997612e397a73cfdcdf91d27ee2650f8e9af8d286dea3ec889359ec96f6f614e33b2af1e03e05a45e785937916492190ce65143554ea5239e35bc4

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    192B

    MD5

    52f0dc26e62697657b6a7594207b9647

    SHA1

    e96ae93282a3a6995a918f091498d424beaf13ba

    SHA256

    9fe2ecf6d0e4d34cfe012df06a9339be1832344336999a2246d9f013cc147a07

    SHA512

    09886637b731c9940487283139297d7f8abb1a53d7dd05d489d87875b5d4519492c14b3c11c0d5d7dc48994fb4a3f3c36b037c9a976dd351952ced0473fdb30e

  • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

    Filesize

    192B

    MD5

    c559005129baa108948ef7112081b1ea

    SHA1

    067c51ef52cdcf3c5ea0250a2e7c2458a4409ed5

    SHA256

    433ca3ccf071bce39b0d92f98271018794e5d7638697559243dace1aa80de713

    SHA512

    52625e4c882f59f0a7f6611419e77e1f53c5212bf2d768ae7b068fd2ca1915286b10256100e3d0082d62d6875b2e404d78176b5d896c5902acfa7c48516722c0

  • C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

    Filesize

    1KB

    MD5

    ea200fe6bac7787a3322cd89bfbe5028

    SHA1

    50dba177bdfc389b0df4d105a746c81cf4b38b85

    SHA256

    3899ed426daa25b197d6c6efabc4462391f0c94a561d2333f3d79271482423d5

    SHA512

    ea831a4ba6b47f93dcfad19b5f77aad8ce0e5a9f810fb92e6fa8474fba6f38067df5767631b43df305bce51ce78d7a64786217637fac0a79fa98d91b3094058e

  • C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

    Filesize

    31KB

    MD5

    cf67789380e254eaeee26c95b46cef7e

    SHA1

    d80ee8de15c9f6e29796c08f2592b3fd498c4bdf

    SHA256

    fc5e4981ee0d9b7b6ff364b5d73b933e4a9937a70a2dca2f055238e49c3a3a72

    SHA512

    2705403b76a7f20536b4a9b89af85aede062956bf5fd02375bfe80f9127eb1a4790b8a302415e283aafd43b41996b1432b2941d490f07b6fea1258dbe7202fcd

  • C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

    Filesize

    34KB

    MD5

    3bc3d43273a9b75e82de3835b9989bb3

    SHA1

    3363b1566cb3aee2604ba47e77db1fc03b22fdf0

    SHA256

    0a032341b444634bd1cbe5f0ed3b6421af0671b8bc5659de250bfb9c01dd77b3

    SHA512

    d147ac847cdb10131148fd351b8a086f63890d9cf4315675bb40f375687b0e984ee428d9555b9f9778c1bc2b5847d2b9dd8521c954236f26ebae1d0e39703f88

  • C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

    Filesize

    23KB

    MD5

    537cfe5c703d0a400eee9001d6762fba

    SHA1

    6d63e091457b4f36de36a67a248dce42f8d48403

    SHA256

    ab3be23fb939db7355ff870fea9123861d1c4e8ea8895570c7a81bd745ba5a79

    SHA512

    8322bfd975bc233a91547c0f63d753e521a5600aaad3e8332e776d26dbfaf2c6d995e86ec705bc83b3405973d2a93e7bc770f7dfe194583c75a604bcc6968f45

  • C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.fantom

    Filesize

    2KB

    MD5

    8442d1411220d155f5335e3abf8c4f78

    SHA1

    dff9a186e865627c6b3eb2f97df5962c7c1849ee

    SHA256

    d3b7621fb4519ec4158cc0322789e4d240916a8b6cb18ea5ba8506d2f6f365fb

    SHA512

    f085a67f6393927dabf2f5bef6357f6096501d38fd9e1de1ca12fcf961941265b3276197a2d45cff07d6c1cc00661f3947630cecc506a14af4bd602035c6489a

  • C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

    Filesize

    1KB

    MD5

    0be0d307454f0a017e13cdc52d33c0fb

    SHA1

    cfd103d472aa560eb56f67c1ac9378dc8ac953ca

    SHA256

    ee97a99fcd69364a36e8fa2795cb95ee01cff77ce78f79f4e8a7ce5ae0d94eb2

    SHA512

    b16b57005ba9d89fa9f0d4281e8fd12202043c2e3aabbaa144430d71060ec820f21748e795ce6cf488a2a8541a12fc395f98d0fb1f1dbd21133786f9a7b10bf1

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

    Filesize

    3KB

    MD5

    da7ef0dda0959905c3b14b405efb0994

    SHA1

    4facf8c0c881dbabd06eb57f912a3fc58cb076e5

    SHA256

    4f5ab64b2b0339f03ff254a36c0271105736d870fce0d87e5fff3065e81246ca

    SHA512

    664dc4a331ed77c8f4a04a10e6e5734417e3627a673a4f1a628610ea892ad1877c1ffcef0adf6794e73caca30f8fe39a6260055efe1b0c8d1c0867473a2e1e52

  • C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

    Filesize

    2KB

    MD5

    1e411ff869b47182c791d57ee239bf86

    SHA1

    f4174891137df1a29c3176c20ded6b9c2b563e7d

    SHA256

    4919cd638f14efb927236e561fb0e60f147b4448810de7969294e9c86be13d99

    SHA512

    00e43ac8f21d1aac913b1fc6f67f34ba344750053376421b08afccedbe09e10a16e2485efb00cc87ac5b66ddfed291dfa5c411f335af52aa47c3ef3825bc564c

  • C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

    Filesize

    5KB

    MD5

    fcb21e0d06606a7ea9a52621822d4d2d

    SHA1

    22484305930d013b22a906ab062b1872be6f26f6

    SHA256

    fda44ef943ca3468f2448b3a3993ce94b5519f6728ae39a7617f33ba17046230

    SHA512

    71f1f95c95166a10d14754baf845bd6f893bc8841a587f63a36d2333fa316041f64a7b0194ac050306e9bd9d4a80c38677b0f9dd3d4a1fa4b31aa0ba7dfd6647

  • C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

    Filesize

    17KB

    MD5

    89ac2f6a3eaad24aed2384888923f99f

    SHA1

    0ccf08d1eb4e5c5845102b7c22852cc64d0ff5c2

    SHA256

    5ad341e1ea2f5270e550f56698b9cb5d994cd9a00ee185ffa6507d1d92bce6fb

    SHA512

    61fcf745cd0c1968f22e91a4b58c797ec47a2e96960668967e40e81014a2bc5aa1e3afd8aa90d77d382449bc6305fc2bab89853f3ceebf01ca3c1c59f3c9ffc6

  • C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

    Filesize

    320KB

    MD5

    b17505282591cfc67a77e6b8b78179c4

    SHA1

    e60d91e062c586767456de025cad623e613f0fd7

    SHA256

    34ebd6786d38d57263746c9c24d7f7e90f30a8fd4c5003c544bc62296a5d3ea7

    SHA512

    b557294258114180796800517488ca3f3b1a83b241596f503f6d7dc8d1d88bbbe9b6a09e3e038fd64b3af1b55a86a58d7db8b1068ddf8fe3d962e5596dd71f8f

  • C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

    Filesize

    1KB

    MD5

    ac5ffbdf8db702c0dcb589049961bc8d

    SHA1

    189f137c3b7793eb9b09f7cb28ea147edbea36e5

    SHA256

    7646597bf89114aa2a361c042b071e5e9b065b80b769c5d8ba89821d0ca8b5cb

    SHA512

    055f1622d1f5ed55c13631e662d237c0be5448303f3b33f1822d8d6fe2a0fc4c445e54a2973b7dd7ea663badd74e5af3fbdb6e1c775530147ce886c599777381

  • C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

    Filesize

    10KB

    MD5

    92ec7b415bda9a6967bf6458ab67fcca

    SHA1

    fd6031cd059e443f77abaa0e54d69b1db2ed8f12

    SHA256

    258e9b062072d467e4cca4edbdd05d85cf8c5fa895a050d087216f21db151bdb

    SHA512

    55dbd6505689c31d1bf5ee4bb9b78966b42b754e145ee0b13bc1e9f80f568c7c0f077e8bd54589b3831ae921726853255ef53cdea08ffef4935febd2ea79773b

  • C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

    Filesize

    3KB

    MD5

    83755dfe479d898f5353d3dcf35a231d

    SHA1

    8fdbba92ccbdd5bce6a43536303176ced2796d34

    SHA256

    035b8c4422331fd2de560870b5fd172102467bcc51852e5ba3a6c099c907dc13

    SHA512

    c791e611c8c3f30d845fedb726f6122a9f5ee0b96b15f2a6a2f78e439017938fa60a3dd3937fcc998cd6175a2cc428591cc5b45042da010a30a7fe562523abe2

  • C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

    Filesize

    176B

    MD5

    e8be73232f6d21b0309e333742493b3e

    SHA1

    39cabfc57079e128f751501689f8886063f51ce5

    SHA256

    842c9986e7e22f4c7dc22bad8660ffe00bc23b8648c448945ee82aa5895ad5c2

    SHA512

    e495fdda955650a6d5c6698e84cd1a4c7512080ed4463324d467b07d87b9f09c0a16921ea42be0b768c4607b7b0300eb8e3c764abad058939df891f1cbfa4825

  • C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

    Filesize

    1KB

    MD5

    d4a7c4c55601ebae7603696606dd0a1e

    SHA1

    1f13eee02f419db2d1e6f99f721aa57d412ad80f

    SHA256

    d6b774aa877199d8c9a4d6274a2ecae437b62e6ce65a63b01a7b85946fdfbad8

    SHA512

    96ddcea85316a65d0b09438e3fd47a189c4e47b1e1db825b231f3f00e99750d8abef1b7a9d62fe523a8fcd700bd1d6f4d7695dbadf268f655250063495574a5e

  • C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

    Filesize

    3KB

    MD5

    febd7b5a06a67861d736a3d59ef66567

    SHA1

    0a400858b903875db257486db4aad5744dc90183

    SHA256

    6ec187314a7fae41bd89c38f33ff5e457e6ec8e967a3b1168bcf3d30b7041601

    SHA512

    31403d19df52482b4ee34f6a6651629c7a50b8ee0a72e43eb276051fdb229bf874e000ffe2722e6b500cf57d22c3e53b3619ad8ee6b1341b773b2935176487ab

  • C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

    Filesize

    1KB

    MD5

    b64fd9ac755220096c2af799a95ff70f

    SHA1

    a5b1dd7416d6ea259c8d6ccc6f3f6fc8fe7ab72b

    SHA256

    cdadca586ee17570ecae48b6c28c544111726f947c1128d5e4b5845bd356897c

    SHA512

    6216ab8c4fb23b015f2e5a78dcc76ef199ca7424d520d62faffb033b1fcca1e1a1d52c6763d29f355cbbc3899d4378459ec7448141bfcd2f2d0f802e4daa2e8a

  • C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

    Filesize

    28KB

    MD5

    00eac648af247e66599e9e782fe71e65

    SHA1

    be9e7e0d7d599788650bb28c68b5f4e7d9539711

    SHA256

    fb18c1aacee27401e479423174b8f9ed8058152e356e321eac8c119d7d9fabb2

    SHA512

    1f637cc9e99cc61aa006cd1ad3809035a3781b4127f96eb06d6f8dc093f8ad9d112fb7f60e90fc5d88bf26c25ca230fcddfcc61076888cdd637d98eafccba810

  • C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

    Filesize

    2KB

    MD5

    025eb893e55083fa8aaaba6466f836d8

    SHA1

    ccec26581811d7bcf3bee279f60ec841f59ee73f

    SHA256

    baf48a91b3b652d10d41086e0e891a1d73bc895b787f80cb02274489d135adfa

    SHA512

    cc31f0bb124bc019cced19e34ea50d34f435542420627b6d63c4891cc39ef6071c9d5b253a4b7cb650cf399f4030c519ebd8f3755cb437efa1a8ecced47d6f67

  • C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

    Filesize

    1KB

    MD5

    e8f455e9f0a27d31a95e605149642134

    SHA1

    3cb578722a80a62a501b3a46bbd82e34f91b67d3

    SHA256

    747ff9766f55c9d48d96ade9f4cf5bba48ab794994d5f6499a399656bd8c44ed

    SHA512

    60633f363b5450a0950b62975e6f5987203bf89285c394c95e5e801548620fded5c1755d074fe23a12401bf7879cc33805300717c16fa757fc4bd88bd830ea20

  • C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

    Filesize

    2KB

    MD5

    f266155eecb7fbfa6851ebb71a5c1bfe

    SHA1

    93fcf488283881bfc0f86ffbb327b2c1d9b6865d

    SHA256

    d843c6d90a48bff12944379d912adf0c0ca810ef5103beb698119549953a1225

    SHA512

    05f281b639a5784a629ac0eb5c0e4f1ae848aedb66db43413bf7d9699da359b145df47f1035525bdf11146426ad53c1d70bbaa4e17a1ae66e3f419760eaca0d5

  • C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

    Filesize

    1KB

    MD5

    6761c6d62a74072d4839388f88ddda4a

    SHA1

    f0064fd9064255d7c303960ce55891b5157afb41

    SHA256

    1951d8fb1080c9b439d657d7d0176e053a5aa90bc1c2090f357e691486319efb

    SHA512

    bf646b356c5bf30ccd84f903dbc8688357380455d5f3a37936b9bbcab3c6a7b6a788dd88bbdef14350c5bc65f370fafb3cfb4f6f4b7420f3e77877c6dd17225a

  • C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

    Filesize

    1KB

    MD5

    b17f6ad963e794a011604869234d89de

    SHA1

    b26fe4fcca5e4c1cd5b488906b35bea9a7592f49

    SHA256

    7da6c79fa12c19dade51a86f035285b01c589a59097926ec63b54a2c1fd6dea9

    SHA512

    6b7ccd52dd313066a40b750497aa5fba2b6bf7b03d95682784f317107d0c746c47f377fff4e317f7eba11b9659e728581bb7dcf953fdda8c6728e41ba91b04b8

  • C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

    Filesize

    1KB

    MD5

    35c6a700411f5c055b17ab9f69371431

    SHA1

    34446388d200cc1dc4571c133ba4237483ea11b0

    SHA256

    ef62d7ef17da6d8322e0293651fff8e48d63a01bf0d8ebef6bd462a465dedcec

    SHA512

    461b4f0c936a1e7fe24836115cbd914d6b65fd71003476b6340d5636dd1572b5b87df69c9c8b673ce9f5609f601fe67d235b0951833770caeafefa757a421d0c

  • C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

    Filesize

    3KB

    MD5

    bd37e1bdc03008bd79452a0e2a070fd6

    SHA1

    e20c82a0ee4556fa86fb1efabf3edb04fad95d3f

    SHA256

    6c760fc19d93c941db4d01bb561020bc65d738db9ec6ff9bd7928104cf31ce62

    SHA512

    88e248f981ce665d5767542367516db2498ca622c9fb6f5ed46e23ae49476c79bcee9b1cd3f2f73eadf042267bda25499a2aaae76e3ef4a16244692e0f2bac7f

  • C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

    Filesize

    2KB

    MD5

    17bf7d6bf2c56eda2d08de50073ff2c1

    SHA1

    23febe604bf30603af81b233479f1b312171f8f4

    SHA256

    44207aabcc50e935ada1310844e51fe6fbca0907454ee1f1046213d696624f1d

    SHA512

    eb0e5b13b4a4151147f89935ad6745c2c771f44690706c44aab88ba4778e30dbcd1659ab182c3de9667646af4c3b6b35d443245e26bac2df57ce6dc9fcc4505f

  • C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

    Filesize

    6KB

    MD5

    a37f060c4b813f4c1da1a4ea6f0d288d

    SHA1

    4609e285bec31e1469474274ff3741a23349cfca

    SHA256

    af9906fe40547f3b9564dc59b8bf9bb7a3da923c02980cbb7469abf2ebaf3597

    SHA512

    0c506ab08eee6d053c8134fb48d56ecf1a614ca67131a5007cd6f2cebc6f2641d34fd8b77ec013a531de453c2ce4c08c5fef2144f5b76d3280319477753aa8cf

  • C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

    Filesize

    5KB

    MD5

    03655cbb52db1af06b0c112326665ea0

    SHA1

    5816a72b34ab134faa206264b9b0430848c92562

    SHA256

    6a7f3565b48c29be32811ce950151f05177cf1c979cd5708abba2636a844ab5d

    SHA512

    df6956aa5035476a5595984b6296d484f3970a891c9b4c0183689c575d4f6cc9e0bac9e275ef857257503b7ea77effb86cf36df590bf99c34294f10397817b90

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

    Filesize

    3KB

    MD5

    23c2e3dc1d71d231dbb96296ef3f8dcb

    SHA1

    4cbbf1c4ef536127b7145503cfda658e8ae038c2

    SHA256

    2d5b30bd938bc6bc3cb60cfaabdc601ffda7ff78503d1262d7db0b840ba76d6a

    SHA512

    e929df14df9de4a8c9da2f20f6cec3be79709b0a3bccf458d0d6c14853a8b8501b5f27249ccdbbe7974e7ff619a0a2374ec40c80aeef8f6302211bb0e567a269

  • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

    Filesize

    2KB

    MD5

    12de56ec362881382ac7096b645e34e0

    SHA1

    0f88f1f5bdff4de6cec33ba78868c2862884e435

    SHA256

    91373560159b5af1094f2f613de6cad3cdd0509f0b2c9cbe62fb0f66df531e46

    SHA512

    93d9a277158d258e443d1e7702b69a92e319313cf1c42e0678130c5130dfacfc7d458bae45052eb027604d3bc2fb456bab2baaafa4b087d04054bc179fee5b3e

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

    Filesize

    2KB

    MD5

    fbfe26f9fd15ab49c00923eb39c10f4d

    SHA1

    cf46d0bb9dcb10c88e29b6c7a8e06f74785e65e4

    SHA256

    08687568edbdfd1889eeafc0868e89bc68b56fdb35105b511df08884164e9a9b

    SHA512

    a18735c3e272e47a72e3fbfb2de9596adba3b73c488622d83a099e79d80fa6bc74e8e123028b132626e03cae385011c12c62db9e47f38d984cc1f272079cde07

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

    Filesize

    1KB

    MD5

    c0e9026731afe730c207c3d1572f768a

    SHA1

    8ecf309c2f82c6edd9f1028ea08ae421db0b29da

    SHA256

    ea0f5eddc1bc7c7402dcfbbeeb501a8223bcde2c6fc62bf0ba20bcaf0f8cc49c

    SHA512

    647649e1560464940cb7d62c933703335a49420d2e185789b418eaf5247bd1f607c720551b380f9096e0a6d69e6eacccb9fa563d66af8fc3dbf2b34fc857b597

  • C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

    Filesize

    1KB

    MD5

    0aab55ccefb600dcab1c8e39554bf479

    SHA1

    57206a9829f9bdf1233b5179a518e8a40b3c8572

    SHA256

    eb906c74590fa8a493462766b0d8b52b501ef7f0d04632aaa853b7c691a5823b

    SHA512

    8bff1322f0b20a480339deaa0924a2cd869e2a0ee5ac814c74e455efacc8c677bf50b992d05b4b3d407b0d73b025d802b35a3fec5b4e58bcdfc96e31fef519c2

  • C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

    Filesize

    11KB

    MD5

    f5e50769b3fc70d2200d1743ffadd6f2

    SHA1

    036efb7ec2a6a3240480cdacadf264048197ec19

    SHA256

    45e86691e98dde5d7a673e35ad46a19bf9244bceb2b444f5e34e1fb5cac5ac82

    SHA512

    f6679fd833d9d00ff9bb2826d6c368fbfd33964d1097ae083718bee4cdb841bd7f26cf0d5c6b956abdbc1d026392bd49d1fd4d28cfca632976bf49ac1ad69130

  • C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

    Filesize

    1KB

    MD5

    3fe24ceba34e92d1d632f90d69350941

    SHA1

    4c86f753b16c92c8840c3a5e7b9a316b106de38b

    SHA256

    167400af6350ecd06bd1306784cf8d3343da4396e65777e294f3056f254fad97

    SHA512

    876f18a839ee72461f2b107ebdb64184e287955f8015fdf4af11d90c52934e281fe911f26bdcda8ae95bf52bc6fc00af40d97804578915292e3e973398a92f1f

  • C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

    Filesize

    2KB

    MD5

    8061d4dca151f83f51dc4bbf66d65cb5

    SHA1

    2a3712e7a04fc342914b77a5a1e1f58baa2c39b8

    SHA256

    cbbe80c6163eac35d24cff522eaac80b16b75fcb6f2f72358e9a8bb1aeca20f8

    SHA512

    fc7fe059c091feaa9777df239889b9fffac811ede0f0696b06ac2a96076be421f74d80f829513a35d36ded5c167c69f1a45a1bff751eac940de7e25706fbfd67

  • C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

    Filesize

    11KB

    MD5

    c967905e288063e2688527b4d9e0044f

    SHA1

    28181b320564e4bb3af7d6976c7267868a58bbc7

    SHA256

    0e61d25c5b47dd0463e9b7a1659846c74bd6ec7b9b866306842d161441328338

    SHA512

    721ea4404c2abaef780181ee72f36291d852f691974363fce16e4924885a9dc5cef1bc92f69b7f1911f857a9e98ad23ef60493476b84bcfe6744241c965d2d8b

  • C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

    Filesize

    11KB

    MD5

    871ef33131f5bafc8c289677a3e75e67

    SHA1

    403b68ed60bb34e1faeaf7586fd5a7951c218d82

    SHA256

    e413377d86c645a2865b394fb87a727b887c123149d562f1abd03fdbb4987416

    SHA512

    abdaf59210b12b733fb919695af6724303a269a758df720640227b8419aba25929e3e2a35551f57dd04f1846c2f9344a0da59ace41e929d27942c250615fa2d9

  • C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

    Filesize

    11KB

    MD5

    08dfe5262dc6817a8b166a5ae295ff0b

    SHA1

    3e87a89c385d7debfb5a807e8f782b96a5fbe34e

    SHA256

    9efb4463e32648440cacdd7432963ad8800146726a57e96e74bccfebfd7d34a1

    SHA512

    9b6ec80d508c0e2fce07bc703561b937e7f0e8923eca6b67e457584cbac55441430ea815d35d3ecea161563a0d982746cc042f3067847e6707c1cdf70998dffa

  • C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

    Filesize

    1024B

    MD5

    1b917bd3f9a7d7b55f51fc20e7623ddd

    SHA1

    adc4f7b13bf305a470dea6ff61e67f35166ef2d4

    SHA256

    69a116c595bd84b020fcaf6d6c5f28993bbf3ab788fb77dd8c891fa9d5f00baa

    SHA512

    6b4d258f4036bd391cb17b699c6a8ed7fbd98c7ca5fe8be64ecaa550c1b15f73624c697bd1009d62eaa153fbc1694276bb5e78bae42f40775040ae2432d7fb12

  • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

    Filesize

    48B

    MD5

    8884a15aa440163d71f04ab053778264

    SHA1

    03d6119ae672c54176912f49663d31e65bfb914a

    SHA256

    00fecffb5ad10aac15f1df33270261b22a2c3d27edb794336edf4b8972b045ef

    SHA512

    fe12b70e8e742b425b81f0dfa69a18947c9e92c18bc8a44a09ce69007c5e54b51b4614185b664151a398840619747ad94f3a8989b09b548ce69787a6a0cb990b

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

    Filesize

    21KB

    MD5

    fec89e9d2784b4c015fed6f5ae558e08

    SHA1

    581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

    SHA256

    489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

    SHA512

    e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

  • memory/464-39-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-34-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-1-0x0000000002230000-0x0000000002262000-memory.dmp

    Filesize

    200KB

  • memory/464-2-0x00000000024B0000-0x00000000024E2000-memory.dmp

    Filesize

    200KB

  • memory/464-3-0x0000000074580000-0x0000000074D30000-memory.dmp

    Filesize

    7.7MB

  • memory/464-4-0x0000000074580000-0x0000000074D30000-memory.dmp

    Filesize

    7.7MB

  • memory/464-137-0x00000000060A0000-0x00000000060AE000-memory.dmp

    Filesize

    56KB

  • memory/464-136-0x0000000074580000-0x0000000074D30000-memory.dmp

    Filesize

    7.7MB

  • memory/464-135-0x000000007458E000-0x000000007458F000-memory.dmp

    Filesize

    4KB

  • memory/464-5-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-129-0x0000000074580000-0x0000000074D30000-memory.dmp

    Filesize

    7.7MB

  • memory/464-6-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-8-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-10-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-12-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-14-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-16-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-18-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-20-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-22-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-24-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-26-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-28-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-30-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-33-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-62-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-36-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-0-0x000000007458E000-0x000000007458F000-memory.dmp

    Filesize

    4KB

  • memory/464-40-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-43-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-44-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-46-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-48-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-50-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-52-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-54-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-56-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-58-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-60-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-64-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-130-0x0000000074580000-0x0000000074D30000-memory.dmp

    Filesize

    7.7MB

  • memory/464-134-0x0000000005370000-0x000000000537A000-memory.dmp

    Filesize

    40KB

  • memory/464-131-0x0000000004BE0000-0x0000000005184000-memory.dmp

    Filesize

    5.6MB

  • memory/464-133-0x0000000074580000-0x0000000074D30000-memory.dmp

    Filesize

    7.7MB

  • memory/464-132-0x0000000005190000-0x0000000005222000-memory.dmp

    Filesize

    584KB

  • memory/464-66-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/464-68-0x00000000024B0000-0x00000000024DB000-memory.dmp

    Filesize

    172KB

  • memory/2656-150-0x0000000000130000-0x000000000013C000-memory.dmp

    Filesize

    48KB

  • memory/2656-594-0x00007FF8D5A50000-0x00007FF8D6511000-memory.dmp

    Filesize

    10.8MB

  • memory/2656-593-0x00007FF8D5A53000-0x00007FF8D5A55000-memory.dmp

    Filesize

    8KB

  • memory/2656-149-0x00007FF8D5A53000-0x00007FF8D5A55000-memory.dmp

    Filesize

    8KB

  • memory/2656-154-0x00007FF8D5A50000-0x00007FF8D6511000-memory.dmp

    Filesize

    10.8MB