Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/05/2026, 22:52

General

  • Target
    Ransomware/Fantom.exe
  • Size 261KB
  • Sample260511-2tm42abt9v
  • SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Path
  • C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note
  • <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>pRy2seHua/BqOBOxMhQOX6fuS/WSqJEoTrSz0OeCrcE8cXLuUm/QCqZxNhTStPaGs09fcyWgUmdTbpXjJRzrXfYhyikjwzAHnviT1U7hdUiuCMUstpBM5nTYYYxg4avoGhAFHYGjMpbVrUUwp8JACQxb42W7EE2EoXYwsqFI6GQDhZuNrq5qNMLaJuCC8iTImb+JkQepzxnFhN1CxAA4+mgdVR2ulSzJohIV3/J6cWalbALt6L7pU/ELailhH30CnfVYOJ52l1a6s2tsQYatV1hugpSbomwvcW1IbtN+zujWORIpDqlFArnknS6VwOV0uQFTgq9sGkkP1981dWOvlw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Family: Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (1745) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\Fantom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3512

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cef_200_percent.pak

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak
        • Size 16B
        • SHA256 f5235b2b429b1bf772d6b71ee3b6bc5e47e758146b90d7000094dbd3e92d793d
        • MD5 SHA1 SHA512

        aic_file_icons.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
        • Size 50KB
        • SHA256 b5d129d35cfcc01369d4b6c8eb3c2a381223ab8db7e1b1d44e3ecea1aa9278f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        selection-actions.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png
        • Size 1KB
        • SHA256 9dea17e5d8aa3f49dba0325566a4fd82b0b262b0293ceffe44fe367ca8c14b22
        • MD5 SHA1 SHA512 TLSH

        selection-actions2x.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png
        • Size 3KB
        • SHA256 907e99883d43ec5d939498c55131aa3f050b173087ca4cfe0306e8f799729da2
        • MD5 SHA1 SHA512 TLSH

        s_remove_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg
        • Size 720B
        • SHA256 5f799c4c35a6642b24f7e4ecb7a89c9141e48934f98a90f8d5d51aee632eee82
        • MD5 SHA1 SHA512 TLSH

        duplicate.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg
        • Size 1KB
        • SHA256 7d43eb15855bfdc63ef1782a2168fa83f8dc7adbb173e07ada58c3c0b5b6b4b5
        • MD5 SHA1 SHA512 TLSH

        remove.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg
        • Size 1KB
        • SHA256 1c253b43c39bd558d920d2105149ba8e3ea09aae1e51e44f8d05530d3bcc41f7
        • MD5 SHA1 SHA512 TLSH

        s_backarrow_default.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg
        • Size 896B
        • SHA256 489f0ab2ab55ab1805358ff2b84e374d4cc64849c43f71ab58aa4d75ad27cd79
        • MD5 SHA1 SHA512 TLSH

        s_comment_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_comment_18.svg
        • Size 1KB
        • SHA256 ca96017709215f4788a92dc06d05ca49e1a77f2fac21cb6e3a0b44bf891e5451
        • MD5 SHA1 SHA512 TLSH

        s_editpdf_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg
        • Size 1KB
        • SHA256 eef6a71858ab8cd479d1adf41720db8c6b3f7bec34bd96e6a705ba831c374378
        • MD5 SHA1 SHA512 TLSH

        s_export_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg
        • Size 7KB
        • SHA256 ca60451681b6f78d6a8cd1270e41c2e73ed53dc9729a512012f831b77c8782fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        s_fillandsign_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg
        • Size 2KB
        • SHA256 b872a99522cd1b7d9fb0c316350875fba5003e580ad942e60e2d1df8995784ad
        • MD5 SHA1 SHA512 TLSH

        s_folder-default_32.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg
        • Size 560B
        • SHA256 903ea91b5becb8268880bb102aa6dda9f5506371fae5610ca81b4266e7746b42
        • MD5 SHA1 SHA512 TLSH

        s_move_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg
        • Size 1KB
        • SHA256 f9ac4eced075cb9c7bf9a0c2c8976c02fd578b4dcac416d4d5f2c069575768c8
        • MD5 SHA1 SHA512 TLSH

        s_nextarrow_default.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nextarrow_default.svg
        • Size 880B
        • SHA256 e9c788bf458ea1a18de7092b176886199d305a4518ac384058bb291e05f9c764
        • MD5 SHA1 SHA512 TLSH

        s_organize_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_organize_18.svg
        • Size 1KB
        • SHA256 f76f2815a581753decb79dafa1168c2cca90e4269e2872a25784f52b95e77fce
        • MD5 SHA1 SHA512 TLSH

        s_rename_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg
        • Size 1KB
        • SHA256 c02bb935bf633d83b22561a1eec0c28a6011f13c1f983675c586e3d976615bb7
        • MD5 SHA1 SHA512 TLSH

        s_sendforsignature_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg
        • Size 2KB
        • SHA256 9363009a3c5ad0b33b8ebf71882dea51e3d00039390574dfed612d37d058356b
        • MD5 SHA1 SHA512 TLSH

        s_share_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg
        • Size 1KB
        • SHA256 3070791c17c0469a7c64c2911cc6cac8ad17261194d5928f55e9e17263724d6a
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js
        • Size 3KB
        • SHA256 3040df41467e0852fd0bc7900271486c4a4fb0bee7781267de3eed4a6434974f
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js
        • Size 28KB
        • SHA256 e0903c40dd4805cb0598de74b5e394574aa389f967e82494607c9e6ec5678261
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DECRYPT_YOUR_FILES.HTML

        • Path C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML
        • Size 1KB
        • SHA256 acea9bb7666d564bbd7a91c36a757940a47483db3a3845a2cc8eb867be731138
        • MD5 SHA1 SHA512 TLSH

        af_NEUTER.pak

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\af_NEUTER.pak
        • Size 32B
        • SHA256 d3cd25b6ee36b14a17a31855ac620153a1593597bfcdcb607f73392dbdbb3ee2
        • MD5 SHA1 SHA512

        win32_LinkNoDrop32x32.gif

        • Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
        • Size 160B
        • SHA256 bcd72c2f899d030dd7ec0a36dec43cabf344f985d6b6d2e6cc20815d81a7c656
        • MD5 SHA1 SHA512 TLSH

        THIRDPARTYLICENSEREADME-JAVAFX.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
        • Size 192B
        • SHA256 6b6cda8a4e9ece9d417b03a8abb1c4f4a39d5cb36b1bb862747c8b537eba4c0e
        • MD5 SHA1 SHA512 TLSH

        THIRDPARTYLICENSEREADME.txt

        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
        • Size 192B
        • SHA256 629bc2a5a4b688f7d90e7b1c090326c0aacc9a95389bfb3b65dc5b47744dc182
        • MD5 SHA1 SHA512 TLSH

        directshow.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
        • Size 1KB
        • SHA256 ca7162bb72e8c8d73b932e90e5667e65e2ca7b65ef7083addd74003b21fd1714
        • MD5 SHA1 SHA512 TLSH

        glib.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
        • Size 31KB
        • SHA256 5e1415262bba2229398d0b5346649cd5e0fb134bb6cbf1d62cd4a5a803b9d151
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gstreamer.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
        • Size 34KB
        • SHA256 42491642abedf106e648409316ad4aca55b787f899c0b7cc7ef4b838159fa08f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icu_web.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
        • Size 23KB
        • SHA256 8058ae2fcb2664a1c2ca71192a00876ab717c64d2e59a964d7622945ed4b86c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jpeg_fx.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
        • Size 2KB
        • SHA256 f390268b489ecdd27991f09f883f8082475ac3c5e885ceb526657f58c2c3a0ec
        • MD5 SHA1 SHA512 TLSH

        libffi.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
        • Size 1KB
        • SHA256 b142b950e8cb680fbfdf5ce9d68d55f6e8f867266a3a521fce2d2dbac190293d
        • MD5 SHA1 SHA512 TLSH

        libxml2.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
        • Size 3KB
        • SHA256 5842ee8be7782c3ddc03667030d01305567f97e8d9efea9acd6750a0a0563f3a
        • MD5 SHA1 SHA512 TLSH

        libxslt.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
        • Size 2KB
        • SHA256 faeb0f26812efdd8cf989ae4d00933a48823785793a288d095c0c64b83355ea1
        • MD5 SHA1 SHA512 TLSH

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
        • Size 5KB
        • SHA256 5d6cf2df50ee7d8696ce14fbccddddc96db7c7df9ff2b77acdeba7aa56d1868a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        public_suffix.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
        • Size 17KB
        • SHA256 c20aaf67bd590546bf560089e91bf30d9f3bce114c1bd81574840831be2f7a71
        • MD5 SHA1 SHA512 SSDEEP TLSH

        webkit.md

        • Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
        • Size 320KB
        • SHA256 dcdb3989edac4da05cd27260d6b2d1d590045650b1b4a9f518192b6f26a68fbe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        asm.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
        • Size 1KB
        • SHA256 aa978ae34aaf6d8202a5f87ebfa549df930d66d93b614b95e7dbc60c64a2ff72
        • MD5 SHA1 SHA512 TLSH

        bcel.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
        • Size 10KB
        • SHA256 82227aad3b3344bdfdaedcd89b6d9aa99e0b15bcbcb49d34a7cd3f338dd68927
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cldr.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
        • Size 3KB
        • SHA256 9f4f12b43dc7197687fa47c91899e4e2bd0ae426146973fc12328fe3465ba3c8
        • MD5 SHA1 SHA512 TLSH

        colorimaging.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
        • Size 176B
        • SHA256 99398509803c26c17f14d8662e55d197db76a8b26a35fd12e189ffe6d1200e4a
        • MD5 SHA1 SHA512 TLSH

        cryptix.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
        • Size 1KB
        • SHA256 d830db86e4c4189df1f1eeb079eff08c4c542efacf836331ea045a284ff35567
        • MD5 SHA1 SHA512 TLSH

        dom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
        • Size 3KB
        • SHA256 e581279dc22025d9bd92feceb442ebaff1aa39abe0f0f85b9cdc9d93b3c1d57c
        • MD5 SHA1 SHA512 TLSH

        dynalink.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
        • Size 1KB
        • SHA256 42d28cab839714886dc0a08fc27b47c08f9152559bd40b75ffec468b410f39d1
        • MD5 SHA1 SHA512 TLSH

        ecc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
        • Size 28KB
        • SHA256 60026df9f39b0b8410471a536f774f7106d51802f86c3c164f23f963d619e2d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        freebxml.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
        • Size 2KB
        • SHA256 aacc27ae854298d90199ca8e0ec854a83f7568e3a15e046db4d8f4ef911479d5
        • MD5 SHA1 SHA512 TLSH

        giflib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
        • Size 1KB
        • SHA256 7088c1393d1e4da5ec1e4b8f9869b1d66cf0e82bda041e717ead4809bb899c5d
        • MD5 SHA1 SHA512 TLSH

        icu.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
        • Size 2KB
        • SHA256 717bc7da5997b1b01a5e418372baa30562ce7e64f9c90020488e7c0514ed25a4
        • MD5 SHA1 SHA512 TLSH

        jcup.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
        • Size 1KB
        • SHA256 906865dbd1386e1c5494831dadd393971dbe1a2232a7c75615624bc51b859910
        • MD5 SHA1 SHA512 TLSH

        joni.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
        • Size 1KB
        • SHA256 891b02ffbfc137a948c59289473eba08d96fdb1867e70db3afe1523bac7948dc
        • MD5 SHA1 SHA512 TLSH

        jopt-simple.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
        • Size 1KB
        • SHA256 aa4d388a20a1b6f07efb69192807d77a9e0d8017f1c4fe3ba7c857369fba2149
        • MD5 SHA1 SHA512 TLSH

        jpeg.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
        • Size 3KB
        • SHA256 f09b84b9df641476781a569694a1631f5bb15a2d856ad0ed6cea8d03c1a69b77
        • MD5 SHA1 SHA512 TLSH

        lcms.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
        • Size 2KB
        • SHA256 fac773a2e4ce1baed8d7eb7bcb1e760dae1c97274d373c5b372fc25103e23e49
        • MD5 SHA1 SHA512 TLSH

        libpng.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
        • Size 6KB
        • SHA256 01bef97f93fa9191c05aaadb8464865bdfd7da531159830fb9fb05aae31258aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mesa3d.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
        • Size 5KB
        • SHA256 8c0d089ba7474d2affce1628a0a18b01cf09fdd58a001505f30bda3d9bbb17a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkcs11cryptotoken.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
        • Size 3KB
        • SHA256 7fcb9df11e12e6aac079eabdede534671dfcb7a8ac60b6ecefd10481244f2fad
        • MD5 SHA1 SHA512 TLSH

        pkcs11wrapper.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
        • Size 2KB
        • SHA256 5d3efc55b00a0660cd9754ac5df595ff0d175a777bb8e96138295a04af85c3b7
        • MD5 SHA1 SHA512 TLSH

        relaxngcc.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
        • Size 2KB
        • SHA256 39237460b77c794da3a7120d9ec0c42ca97ccc613d833068f3eedc0573017e9e
        • MD5 SHA1 SHA512 TLSH

        relaxngdatatype.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
        • Size 1KB
        • SHA256 9db8e99a2d950ba6d76ca03c1d8b66782ae91fa1ef387fc10b72eac6e6da6ac5
        • MD5 SHA1 SHA512 TLSH

        relaxngom.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
        • Size 1KB
        • SHA256 ee0850647b1457fe2fc260a2d633fd19f0e39430c3a2269c0438535dc3db6bf3
        • MD5 SHA1 SHA512 TLSH

        santuario.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
        • Size 11KB
        • SHA256 90cad6bdefd90b44a92ceefd28d3dc187a11790dfdf6c0d7dcce93b42c8b4454
        • MD5 SHA1 SHA512 SSDEEP TLSH

        thaidict.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
        • Size 1KB
        • SHA256 2b5535d82ce2fced3409eeec1f27a0f7183d6a3ff51cc5b9b9c4e1d3e4d110dc
        • MD5 SHA1 SHA512 TLSH

        unicode.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
        • Size 2KB
        • SHA256 1188c74994d837d447c6766b078dc1d528818266b1e136285383032715c9b06f
        • MD5 SHA1 SHA512 TLSH

        xalan.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
        • Size 11KB
        • SHA256 26a981c39868d3c63566552bfc3a291947854240007b45b4fba8eac1aaf7acca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xerces.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
        • Size 11KB
        • SHA256 242a220b0609bb01622ae180535feeaadf3412668c09615e2fe10424d3932c02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xmlresolver.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
        • Size 11KB
        • SHA256 9ec8f8c97f016a2b114d604c97c76a1154385f4cdf0be0fb05d69d04df2d361c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zlib.md

        • Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
        • Size 1024B
        • SHA256 86e703308084979b481cfd8c23fa12dd7ed9ee706be61d2f3fd159b689d8fa54
        • MD5 SHA1 SHA512 TLSH

        ClientSub2019_eula.txt

        • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
        • Size 48B
        • SHA256 d5f5e15734170efdd0e1a272bb8182b40d04a6142822a6f642ad0f448f68756c
        • MD5 SHA1 SHA512

        WindowsUpdate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
        • Size 21KB
        • SHA256 489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2700-61-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-51-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-4-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-133-0x00000000026B0000-0x00000000026C0000-memory.dmp

        memory/2700-135-0x00000000026B0000-0x00000000026C0000-memory.dmp

        memory/2700-134-0x00000000026B0000-0x00000000026C0000-memory.dmp

        memory/2700-136-0x0000000005DA0000-0x0000000005DAE000-memory.dmp

        memory/2700-23-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-1-0x0000000002500000-0x0000000002532000-memory.dmp

        memory/2700-2-0x00000000026B0000-0x00000000026C0000-memory.dmp

        memory/2700-25-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-607-0x00000000069B0000-0x0000000006A13000-memory.dmp

        memory/2700-3-0x0000000002640000-0x0000000002672000-memory.dmp

        memory/2700-59-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-79-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-81-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-83-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-87-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-89-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-91-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-109-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-11-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-13-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-15-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-17-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-19-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-21-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-27-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-29-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-31-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-33-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-35-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-37-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-39-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-41-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-43-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-45-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-47-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-49-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-5-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-53-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-55-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-57-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-0-0x00000000026B0000-0x00000000026C0000-memory.dmp

        memory/2700-64-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-65-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-67-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-69-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-71-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-73-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-75-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-77-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-85-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-93-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-95-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-97-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-99-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-101-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-103-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-106-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-107-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-111-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-113-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-115-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-117-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-119-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-121-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-123-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-128-0x00000000026B0000-0x00000000026C0000-memory.dmp

        memory/2700-130-0x0000000004B30000-0x00000000050D4000-memory.dmp

        memory/2700-132-0x0000000005360000-0x000000000536A000-memory.dmp

        memory/2700-131-0x0000000005120000-0x00000000051B2000-memory.dmp

        memory/2700-129-0x0000000002690000-0x0000000002691000-memory.dmp

        memory/2700-125-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-127-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-7-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/2700-9-0x0000000002640000-0x000000000266B000-memory.dmp

        memory/3512-610-0x000000001B360000-0x000000001B370000-memory.dmp

        memory/3512-149-0x000000001B360000-0x000000001B370000-memory.dmp

        memory/3512-148-0x0000000000590000-0x000000000059C000-memory.dmp