Resubmissions

11/11/2026, 02:18

261111-crd1xadt6p10

11/11/2026, 02:14

261111-cn8q4set4x10

11/11/2026, 01:54

261111-cb2f9sts2r10

08/09/2026, 17:42

260908-v91lqsvzby10

08/09/2026, 14:47

260908-r5xshastaw

06/09/2026, 10:46

260906-mtz19shn5s10

02/09/2026, 16:53

260902-vefcbaxhjb10

02/09/2026, 16:53

260902-vd1xmaxgqd

26/04/2026, 11:25

260426-njgydaas6r10

24/04/2026, 20:04

260424-ys8gssbv3l10

Analysis

  • max time kernel
    58s
  • max time network
    63s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-es
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/11/2026, 01:54

General

  • Target
    Ransomware/Fantom.exe
  • Size 261KB
  • Sample261111-cb2f9sts2r
  • SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Path
  • C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note
  • <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>jNJdtloDfTDNlRxwwAaVAakN8VQ9SiBQMO1Wd5Y5zMvp42aAohWOqF34tg3CPG449QY+E2vLQkcwJ3tQfcz3naHMOZOS4AjsbJoU9Tud5qvn9pc23QgDI6N1/XT9OSPeb6mGZbGMiKcs1AnTKgfSTryIWLI4/KpynXODW0cCbnaKRnAUCrKyBBTBadNMWIdy+mt7TPQG/39klw8GgPzsf+P8zAG/H8fg3sE0FnYkNuS7PjsbwHdzxx3TC9LHjKzdCzsOfO+vHBCtZGxWyrwJD/a5AfwclA49F0FwWdeQi+AfhHcXefgN+a4uQKe+K4OatHKCsqNvlHviFsZrpCBHrQ==ZXMtRVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • Family: Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

  • Renames multiple (60) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 60 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\Fantom.exe"
    1⤵
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5956
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:2216
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2644

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          cef_100_percent.pak

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak
          • Size 16B
          • SHA256 2244c13b26cf743cb3f857e5af1c496895c7550d13846aac11d647706a666549
          • MD5 SHA1 SHA512

          Click on 'Change' to select default PDF handler.pdf

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf
          • Size 182KB
          • SHA256 21400b7a3da18151df60750bef0140dba9348b6721afc2a85d3b3b530f415418
          • MD5 SHA1 SHA512 SSDEEP TLSH

          DECRYPT_YOUR_FILES.HTML

          • Path C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML
          • Size 1KB
          • SHA256 dcc2311a972fdce471b774da05245b1d0be15bf90d33ceab0738a64d47446667
          • MD5 SHA1 SHA512 TLSH

          af_MASCULINE.pak

          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\af_MASCULINE.pak
          • Size 32B
          • SHA256 b1f64e1c61e1462cdb0c2dc5601a0984b03f409bb6ec3d414ebd886146b88827
          • MD5 SHA1 SHA512

          THIRDPARTYLICENSEREADME-JAVAFX.txt

          • Path C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt
          • Size 192B
          • SHA256 b7cb2c0881e69f50e04701a1c819794839f0410252db5101778737585a7be71c
          • MD5 SHA1 SHA512 TLSH

          THIRDPARTYLICENSEREADME.txt

          • Path C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt
          • Size 192B
          • SHA256 2c7da1604ce1eef32bda51e81dd53be764e6dbd5c8930d708701f8fb7a381fc6
          • MD5 SHA1 SHA512 TLSH

          win32_CopyNoDrop32x32.gif

          • Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif
          • Size 160B
          • SHA256 881a27d6722c184f3457b18d9ea563509666671b3bf0e7497a1e39e4fd7d156d
          • MD5 SHA1 SHA512 TLSH

          directshow.md

          • Path C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md
          • Size 1KB
          • SHA256 5949699a0fbe0428dc437d7b5374d3d9a2a85f04af86e40fc51443a73cc9f97a
          • MD5 SHA1 SHA512 TLSH

          glib.md

          • Path C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md
          • Size 31KB
          • SHA256 8250aa1a25ceb35a80b85f74f1f09e4ce88a499dbac22ea92a2a1bad30c205eb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gstreamer.md

          • Path C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md
          • Size 34KB
          • SHA256 eb4093da1cfd77c6be98ff06e6ffa015f8462bc55f74b0786e7272cb88c5492e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icu_web.md

          • Path C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md
          • Size 23KB
          • SHA256 2f3de94687300ae6d10c972f7ab7727598eb33e9427df357c7f1e3bec101318b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jpeg_fx.md

          • Path C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md
          • Size 2KB
          • SHA256 8ef6e117b6a4206a03d3a2408cfc474ca9aa0f8c53b769572cc2d63e359bd925
          • MD5 SHA1 SHA512 TLSH

          libffi.md

          • Path C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md
          • Size 1KB
          • SHA256 311329628b702b1604b0a317434a96f80170832eb764f7703ca8ea67f44954a0
          • MD5 SHA1 SHA512 TLSH

          libxml2.md

          • Path C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md
          • Size 3KB
          • SHA256 17708c57ca82286d7b05257fff78686fcfa158605687e98e7d46b823d4f70249
          • MD5 SHA1 SHA512 TLSH

          libxslt.md

          • Path C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md
          • Size 2KB
          • SHA256 d6648ca751c85a07fba5278f4486896f4484126b35d4e0708f5a5b054db7553b
          • MD5 SHA1 SHA512 TLSH

          mesa3d.md

          • Path C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md
          • Size 5KB
          • SHA256 6efaad5b92e394b5985ec1fd3c1a74695fd77d898a849ae38a9ff765e720048f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          public_suffix.md

          • Path C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md
          • Size 17KB
          • SHA256 11a0173c247388546ec4bfc98a6b8d5fda5a1b75828bdbc0c9fc5cf86af3e5b8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          webkit.md

          • Path C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md
          • Size 320KB
          • SHA256 ae83da1164f585246b1d2b41ac246b8bd2f952c226ff039bc0a81f80e579bd42
          • MD5 SHA1 SHA512 SSDEEP TLSH

          asm.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md
          • Size 1KB
          • SHA256 20e7def63641c24aff71eeff1bb3a5c4f58f2312d1c900191171b2f7f286e274
          • MD5 SHA1 SHA512 TLSH

          bcel.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md
          • Size 10KB
          • SHA256 88b556041c00f1249a49857652a9ecfd810ed9f3ef81996f6e50117b00f5005e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cldr.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md
          • Size 3KB
          • SHA256 5ec41bd87cee5e24fa53f8e1512b0f8c0afe0e7eb599234ae8e3f0effb24e9dc
          • MD5 SHA1 SHA512 TLSH

          colorimaging.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md
          • Size 176B
          • SHA256 56c1cb14bf73637e95154433816d6f3d9dd326d9fc98f4be3fa485f8050c2fd8
          • MD5 SHA1 SHA512 TLSH

          cryptix.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md
          • Size 1KB
          • SHA256 bb91bbc27a0a37ad4f6801cf3e810d15a03a2ca33ca5e8ce4d372741344bce00
          • MD5 SHA1 SHA512 TLSH

          dom.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md
          • Size 3KB
          • SHA256 4a572e88b667e7daf7e1379a8988b96377e9542a0f71f0de4df6a02ac7dc65e2
          • MD5 SHA1 SHA512 TLSH

          dynalink.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md
          • Size 1KB
          • SHA256 d32702fba25bc03ce32df1e6258bb1fb699141fd1ff5fc306c07489eb72cd866
          • MD5 SHA1 SHA512 TLSH

          ecc.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md
          • Size 28KB
          • SHA256 1665e5dd207636a47c3d60f535390abbe280c7351f617531ef1e5f6875be0504
          • MD5 SHA1 SHA512 SSDEEP TLSH

          freebxml.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md
          • Size 2KB
          • SHA256 96ee16e65b0cf67fd49b0a4af8a713b034d7f85a8ccad4339ec81eb51d7300f6
          • MD5 SHA1 SHA512 TLSH

          giflib.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md
          • Size 1KB
          • SHA256 d36ea02a1736b0c46a2a72be1ac147ea0124968f9c7bb05bc8e44a1618b72bad
          • MD5 SHA1 SHA512 TLSH

          icu.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md
          • Size 2KB
          • SHA256 03406903acd1fb1bd3f2c6d162e09ad28acbee4cb7d449d117b6fb3da97838a5
          • MD5 SHA1 SHA512 TLSH

          jcup.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md
          • Size 1KB
          • SHA256 1a2f98e4f2ad07c1959d6bd4478b3dd1a1bc2f1e68af72841f8fe683d9deb597
          • MD5 SHA1 SHA512 TLSH

          joni.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md
          • Size 1KB
          • SHA256 9f71fdfe08908ca6aee5aabb6299de0c51d66a12fd9238d17070dbced0f1f836
          • MD5 SHA1 SHA512 TLSH

          jopt-simple.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md
          • Size 1KB
          • SHA256 555e6dc84618445fcf689e85819688376b39da75ea44950ba74196636e435ad1
          • MD5 SHA1 SHA512 TLSH

          jpeg.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md
          • Size 3KB
          • SHA256 bf2eb7575a720d9d0fba029b3298609161d5345fa9971ff2a76cd583a9236e8f
          • MD5 SHA1 SHA512 TLSH

          lcms.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md
          • Size 2KB
          • SHA256 3fee840438580ba7feb77b7184164d0af8b671cb3d5b2e93af61315ad85cc241
          • MD5 SHA1 SHA512 TLSH

          libpng.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md
          • Size 6KB
          • SHA256 95d3cac3736c4220ba851e265aa590d32f124212399d020fa78ea5376e7efd01
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mesa3d.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md
          • Size 5KB
          • SHA256 c91f3839044348e6b390aca56b572b6581fc6bc83281174e8e1b25661a095fd9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pkcs11cryptotoken.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md
          • Size 3KB
          • SHA256 95b6fbed34671863acd3378d2f51fe2c08af2c865f5fde35408da2407d6fd696
          • MD5 SHA1 SHA512 TLSH

          pkcs11wrapper.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md
          • Size 2KB
          • SHA256 335b701a37bcabc121e77f1a33fb75deb62cc768af85da2aee0e599c40c7e330
          • MD5 SHA1 SHA512 TLSH

          relaxngcc.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md
          • Size 2KB
          • SHA256 4d9a1edc56f31698e5169e2adaf4c8d0354c7cabffd46ebf02fdfed940b2306f
          • MD5 SHA1 SHA512 TLSH

          relaxngdatatype.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md
          • Size 1KB
          • SHA256 0577db472406637b016824e6041f7ca2f37bb1be520fa97b4060443b40388f5d
          • MD5 SHA1 SHA512 TLSH

          relaxngom.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md
          • Size 1KB
          • SHA256 ea3597da1c89a216173e3cd1db34cb3285ce9da085c2c6f1c796b301a579cc0f
          • MD5 SHA1 SHA512 TLSH

          santuario.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md
          • Size 11KB
          • SHA256 3374006427f5f7031af3f1f2c254a8b85b8b1dc672acf597ad0e892fafa53df2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          thaidict.md.fantom

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.fantom
          • Size 1KB
          • SHA256 bd098005787c7be7c67c956c65d1462b1561f0023d75a280948e9ef1866ce67a
          • MD5 SHA1 SHA512 TLSH

          unicode.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md
          • Size 2KB
          • SHA256 935861a787f0419c4f05f8debf4da907c8870b4f0bbe9be814ca6903fdc757ce
          • MD5 SHA1 SHA512 TLSH

          xalan.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md
          • Size 11KB
          • SHA256 f84aa4b714783520e20a89447e316a2a20c0312dbf0b11a19cc7941a95651cb6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          xerces.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md
          • Size 11KB
          • SHA256 c9d8b440b44ace5e214e5420f9bb9bb5fc5b2f7a4bf38eeb112d87650b7686f2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          xmlresolver.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md
          • Size 11KB
          • SHA256 153c25b51f2929362ad54e0dd16dd234695e20729fd6fc5bb971017ff8e71fe2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zlib.md

          • Path C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md
          • Size 1024B
          • SHA256 87743610c946d1510a0d0326ecc4302f37c7af64044bf6650803bf2d55284664
          • MD5 SHA1 SHA512 TLSH

          README.txt

          • Path C:\Program Files\Java\jre-1.8\README.txt
          • Size 48B
          • SHA256 c70cf81a9898886975ac62152f9662e8c4e177f7b239083434533474f02a410c
          • MD5 SHA1 SHA512

          Welcome.html

          • Path C:\Program Files\Java\jre-1.8\Welcome.html
          • Size 960B
          • SHA256 e571e9498e1ec879becca60d377181c595b7576a857cdef59ce57049ea0c0338
          • MD5 SHA1 SHA512 TLSH

          Xusage.txt

          • Path C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt
          • Size 1KB
          • SHA256 a37a1b9104ff526ee1ae0d175eff8bb0b8c72382bdb35de45bfb072032c61c04
          • MD5 SHA1 SHA512 TLSH

          jvm.cfg

          • Path C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg
          • Size 640B
          • SHA256 9b24ddf2b1559874fd3ca891a06838c7228c82a51e01d5687d37ffd862c9607d
          • MD5 SHA1 SHA512 TLSH

          deploy.jar

          • Path C:\Program Files\Java\jre-1.8\lib\deploy.jar
          • Size 4.8MB
          • SHA256 fba234897953612c6d40529332bce28f834f4544e9f45d254d158c1d2c677cf6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ffjcext.zip

          • Path C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip
          • Size 13KB
          • SHA256 17c18b49b5f0434aaff68891d0b858d0d7b6de58949501f473308ad02304734d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          splash.gif

          • Path C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif
          • Size 8KB
          • SHA256 43177bbefe3de4cf0bba477d027af46b8be5bd7226db7e4f37bd6529b50e92a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          • Path C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]
          • Size 14KB
          • SHA256 32b1c0ca6d40251ee9af4414ceeaecdf752984693c8859258ed1b402d1c428c2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          splash_11-lic.gif

          • Path C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif
          • Size 7KB
          • SHA256 5f386212a97e49c5d857116fec2119f5ff25db05c644729859aafdaad58c391c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          • Path C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]
          • Size 11KB
          • SHA256 8ca050d1494282736f1313e818deac75382c2633cc063de5ed592107bbc43fe0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          access-bridge-64.jar

          • Path C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar
          • Size 192KB
          • SHA256 9a71d52d3164ddc2039586fd465c9404957936461f1c25ca9a8001e1a692d6a7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cldrdata.jar

          • Path C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar
          • Size 3.7MB
          • SHA256 ddc66217470cd82665155a25719f26f03d730e011e26a484b71afdbc996f1a7a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dnsns.jar

          • Path C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar
          • Size 8KB
          • SHA256 99fd1dbab4e005fac97d53cae2ac30b86bbea3f256f2be15842b86dd131e4bce
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jaccess.jar

          • Path C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar
          • Size 43KB
          • SHA256 911821876df78684642c131d718a8f6eb7e5dbe0f16e3f8b14c009d69863b5f3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jfxrt.jar

          • Path C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar
          • Size 17.4MB
          • SHA256 5eda0d0b0c6055f725956c0ae24732e04bbcedad261401f050858fd0269a0786
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nashorn.jar

          • Path C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar
          • Size 1.9MB
          • SHA256 d665f7b69dd1737eae95162b7acdeb9e2b80ea3007c16eb928ee96025ccd7240
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sunec.jar

          • Path C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar
          • Size 46KB
          • SHA256 5f09750c8e4545659d51e8621aa468a382fd2a2dbae2266b8e4ab8af4e279a5e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sunjce_provider.jar

          • Path C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar
          • Size 287KB
          • SHA256 89cb09679c7d99cad0ad97d2c55e49c53044efd29600fe89aa426e240a7eef38
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sunmscapi.jar

          • Path C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar
          • Size 48KB
          • SHA256 6573e19c7991396c981dd2f3d406eaa9ee08f6954dbd15adf7080995f2b94398
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sunpkcs11.jar

          • Path C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar
          • Size 287KB
          • SHA256 0f99115beee1c1452c036977712122cbb94da938fb12f295dfd1b949a7923702
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zipfs.jar

          • Path C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar
          • Size 68KB
          • SHA256 696e3752ca847df4d6ca9b784f6e15d54848c52be23ae9fc62a5e067f6c37bbc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          win32_CopyDrop32x32.gif

          • Path C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif
          • Size 176B
          • SHA256 7ab2894e6d0736b2a8395d906e449dda1e613e6a745551c7c83f00a963fb3519
          • MD5 SHA1 SHA512 TLSH

          win32_LinkDrop32x32.gif

          • Path C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif
          • Size 176B
          • SHA256 d2372fe7766d77467df3745cfc3ad6eb59f6570d6a95c4934f16f3cfaa940421
          • MD5 SHA1 SHA512 TLSH

          win32_MoveDrop32x32.gif

          • Path C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif
          • Size 160B
          • SHA256 b10b981f40f906ab61885553f0d828f51b20fffe0b3b369217c259f381268430
          • MD5 SHA1 SHA512 TLSH

          javaws.jar

          • Path C:\Program Files\Java\jre-1.8\lib\javaws.jar
          • Size 934KB
          • SHA256 b20fea45c0031e3a2966077eb4766124c7f3601084d9f0a974c589e77d7e1211
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jce.jar

          • Path C:\Program Files\Java\jre-1.8\lib\jce.jar
          • Size 119KB
          • SHA256 528a24997f62be2f7c721aa2ab0fcb60d6f4d253d0c32aa1c283609360651626
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jfr.jar

          • Path C:\Program Files\Java\jre-1.8\lib\jfr.jar
          • Size 560KB
          • SHA256 e08286bfe1a916f488c2fd764bdd26e29690c44f34fd68c43685ef39ce94bebf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jfxswt.jar

          • Path C:\Program Files\Java\jre-1.8\lib\jfxswt.jar
          • Size 33KB
          • SHA256 08b52c9102087e8467af24bc5c6aa3ae22e67e32450668b0ce557854b5cf4f08
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jvm.hprof.txt

          • Path C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt
          • Size 4KB
          • SHA256 96c16eb984ae4362328df0c8174f41edbccdfb673d3102a91837d3cc536a9e5c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          management-agent.jar

          • Path C:\Program Files\Java\jre-1.8\lib\management-agent.jar
          • Size 384B
          • SHA256 a31e1a588933aae3aa5b2cde90442531b5fb518512ede17fc51beda33b63c406
          • MD5 SHA1 SHA512 TLSH

          plugin.jar

          • Path C:\Program Files\Java\jre-1.8\lib\plugin.jar
          • Size 1.8MB
          • SHA256 869eb22d2ebd59d74c53802f61d93c72af768a8a1621599344d97fce1d05e8ad
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resources.jar

          • Path C:\Program Files\Java\jre-1.8\lib\resources.jar
          • Size 3.4MB
          • SHA256 7ba781ae0ed3ba22b63b62aaa24a840efa7e997dfdb7fe4dcf6a7d6e9a58ff56
          • MD5 SHA1 SHA512 SSDEEP TLSH

          US_export_policy.jar

          • Path C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar
          • Size 3KB
          • SHA256 247cc725eff1f4f4374cd7695f63ff8bdfb9778d18339a08945ce78f49c1cb04
          • MD5 SHA1 SHA512 TLSH

          local_policy.jar

          • Path C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar
          • Size 3KB
          • SHA256 53c958fe6b58b5780a3c5a956cadfb17447b8bf5878f1e00b6d08de31e2e5171
          • MD5 SHA1 SHA512 TLSH

          US_export_policy.jar

          • Path C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar
          • Size 3KB
          • SHA256 443388060973d49762452937ff5de2735e2ae1145ff01cf751c40e2b0cad484d
          • MD5 SHA1 SHA512 TLSH

          local_policy.jar.fantom

          • Path C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.fantom
          • Size 3KB
          • SHA256 ad628a60a1cce3efbf04feaeaf0ce40025ce26ac62a8dfa0be72c18a55c15999
          • MD5 SHA1 SHA512 TLSH

          ClientOSub2019_eula.txt

          • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt
          • Size 48B
          • SHA256 a758c534a87deb96989ea8a1036ba5d5f2b65041c9b86c92c3f5ebd9116cfde7
          • MD5 SHA1 SHA512

          word2013bw.dotx

          • Path C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx
          • Size 11KB
          • SHA256 1d581b432f035a8fec9ee45e66b7455e6be49924fef8fc032b6f7c067d9cefa0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          AppXManifestLoc.16.en-us.xml

          • Path C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml
          • Size 9KB
          • SHA256 e2b6fec14058d9a66d0f476c1582b3b2ae592e7f2a27f12b5f57b4aecb4fb1e4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          WindowsUpdate.exe

          • Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
          • Size 21KB
          • SHA256 489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065
          • MD5 SHA1 SHA512 SSDEEP TLSH

          memory/2216-448-0x00007FFD418D0000-0x00007FFD42274000-memory.dmp

          memory/2216-149-0x00007FFD418D0000-0x00007FFD42274000-memory.dmp

          memory/2216-779-0x00007FFD418D0000-0x00007FFD42274000-memory.dmp

          memory/2216-780-0x00007FFD418D0000-0x00007FFD42274000-memory.dmp

          memory/2216-781-0x00007FFD418D0000-0x00007FFD42274000-memory.dmp

          memory/2216-535-0x00007FFD418D0000-0x00007FFD42274000-memory.dmp

          memory/2216-147-0x00007FFD41A5F000-0x00007FFD41A60000-memory.dmp

          memory/2216-157-0x00007FFD418D0000-0x00007FFD42274000-memory.dmp

          memory/2216-156-0x00007FFD418D0000-0x00007FFD42274000-memory.dmp

          memory/2216-155-0x00007FFD418D0000-0x00007FFD42274000-memory.dmp

          memory/2216-152-0x00007FFD418D0000-0x00007FFD42274000-memory.dmp

          memory/2216-148-0x0000000000390000-0x000000000039C000-memory.dmp

          memory/2216-150-0x00007FFD418D0000-0x00007FFD42274000-memory.dmp

          memory/5956-45-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-63-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-158-0x00000000068A0000-0x00000000069A2000-memory.dmp

          memory/5956-136-0x0000000005350000-0x000000000535E000-memory.dmp

          memory/5956-135-0x0000000074600000-0x0000000074DBC000-memory.dmp

          memory/5956-134-0x0000000074612000-0x0000000074613000-memory.dmp

          memory/5956-4-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-7-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-11-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-19-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-21-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-25-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-39-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-55-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-61-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-73-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-97-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-107-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-5-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-9-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-13-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-16-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-17-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-23-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-27-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-29-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-31-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-33-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-35-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-37-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-41-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-43-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-0-0x0000000074612000-0x0000000074613000-memory.dmp

          memory/5956-47-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-49-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-51-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-53-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-57-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-59-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-151-0x00000000066D0000-0x0000000006710000-memory.dmp

          memory/5956-65-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-67-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-69-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-71-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-75-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-77-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-79-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-81-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-83-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-85-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-87-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-89-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-91-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-93-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-95-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-99-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-101-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-109-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-111-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-113-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-115-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-117-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-119-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-121-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-123-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-132-0x0000000074600000-0x0000000074DBC000-memory.dmp

          memory/5956-133-0x0000000074600000-0x0000000074DBC000-memory.dmp

          memory/5956-125-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-131-0x00000000028D0000-0x00000000028DA000-memory.dmp

          memory/5956-129-0x0000000004C50000-0x000000000520A000-memory.dmp

          memory/5956-130-0x0000000005210000-0x00000000052A2000-memory.dmp

          memory/5956-127-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-104-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-128-0x0000000074600000-0x0000000074DBC000-memory.dmp

          memory/5956-106-0x00000000025B0000-0x00000000025DB000-memory.dmp

          memory/5956-3-0x0000000074600000-0x0000000074DBC000-memory.dmp

          memory/5956-2-0x00000000025B0000-0x00000000025E2000-memory.dmp

          memory/5956-1-0x0000000002440000-0x0000000002472000-memory.dmp