fantom | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/Fantom[.]exe

Analysis

max time kernel
135s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/Fantom.exe

Score

10^/10

fantom evasion ransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>CbWpBLhYKcwWF9aHiQdsnG63laK3zPwoC+5GyQQFnNOU+nAALKqZfRsynz8OJEH4bN9LNBljoTifqlMI+C8boYS0Y8BY3Qo2PBKgCVIUYWHXqE/QeDfqZrlgoJjqUvPnG9fG/vA4bg3aQBIRXuSDV6e5lUFoQDCAl78AaSxrTw6Zy6OwcpWuHS4um6a47isGHcw4dlkH97s2Gm3tkmkmulxhcBAE8tAE1i5lPAnfxySSfBaayWLKpWU3iL4zBHUXonGYh0upIh+qKIe4ATDPecE39JlYoHpOk/9QDJHQ4+OpO/GLxkwhPfniqa6aOvNyun7nVuR3af1iZ3xVIuQZ/Q==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-910440534-423636034-2318342392-1000\DECRYPT_YOUR_FILES.HTML

Ransom Note

Attention ! All your files have been encrypted. Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets. That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us. Getting a decryption of your files is - SIMPLY task. That all what you need: 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] 2. For test, decrypt 2 small files, to be sure that we can decrypt you files. 3. Pay our services. 4. GET software with passwords for decrypt you files. 5. Make measures to prevent this type situations again. IMPORTANT(1) Do not try restore files without our help, this is useless, and can destroy you data permanetly. IMPORTANT(2) We Cant hold you decryption passwords forever. ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. Your ID_KEY: O8cThQQrJH2dumg2Hhzo8/HICcjVPXctCh+FL2N4Bif18czbAtv6SEqJC/+OfY1qqSyaTY2Dk5Im+gocnsdu/oQYJpwJKfq2q8LOVjHQnF45AMJPrnBdU7OCuPXqLbKaHLmN47TdO81+mgysuameE6klhc6jj6+F1XRMspTKvInN/9u9tpbl7SocDaT5tX2f6vZ9I+AjSF3jjUhkqWWbqIyxfo+huWpo/D2WJdaz7iPRjDFLQQW6x9PpaYopQbrdUnD1O1c5Vhu5muMy7DGqtcj+lf7vwdAbrmuvPxQ3lzQrPp4IZjFhfEcq4z1V5wScadOta2NFGe8RssYs3F+A3g==ZW4tVVM=

Emails

[email protected]

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>BLcuvcIgS/WtY1LdTyMXCB5Yic0hTItMzOTiz3QSL5ZVFikKjNdNJic1fyO6povEXFJtQAw9pCMcUxUvLRfC6J1dWv+NDkSKlbCKHqZ/KF3zoGHLcDkO0cZmSgxjLn/KhgwCn0tWjpRNsgke5aGD1hc0Cj/+P+VK66gw83YyKFW24QKRSfu8QO1i9LeCFHt1aBLrPKl2a5HXb+DqCfCnWQ1sCFLspbUVzJD9Z3SjPb0kicWRwjhtBBDhaKs0W1qZL+gg8lKQUWBqwPcFA9zep/ZSRUI80zwj62SEDFawJPEqyBDueW+l0kHR1ucPfUNXIHMY3vc8YTND4tuKbAynNQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>ivINPN1/Sz9ZlaDN4i/ADe5XUcsE6bmsLskG0viSoUhx3EGtTdmXANvk8yaVA8iJ3GR28gdz70C4YzvjQ1Q02jxWbNBde0oU0xnQN7AUKp3jKooOCPbGABadNlsREkmBC28ayDDKdPN/6MJd+5HcFgoQ1ynXAM9dH9PIbEDVZ1glV6fwpuOkVe1Yjoc6SwMu7h9+E01lMDihqCR6tf0vu/wOVCl7C62yxHfWEIco5NR7sPi1LQbucxls/jS2VGHzSyR4dnxbf2mcdE3rZ9u+ipbwbLvYDhzf5mT9edCzmYw64TA10WVSKY6yV+ib4v2vVJYlNwy++uhwhNZeYoWSXQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Renames multiple (1016) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	Fantom.exe

Executes dropped EXE 5 IoCs

pid	Process
652	Fantom.exe
1112	Fantom.exe
4492	Fantom.exe
3904	Fantom.exe
2656	WindowsUpdate.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
51	raw.githubusercontent.com
52	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\it-IT\View3d\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-400.png	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\manifest.xml	Fantom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupLargeTile.scale-150.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\AppxManifest.xml	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare150x150Logo.scale-125_contrast-black.png	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-unplated.png	Fantom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\TextConv\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimelessLetter.dotx	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Marble.jpg	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\ThirdPartyNotices.txt	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_scale-125.png	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\WideTile.scale-125.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-400.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\landing_page_start_a_coversation_v3.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-100_contrast-black.png	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-100.png	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\MedTile.scale-125.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Retail\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jscripts\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\SplashScreen\PaintSplashScreen.scale-200.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-200_contrast-black.png	Fantom.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	Fantom.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png	Fantom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-150_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-32.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-200.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\LargeTile.scale-100.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MediumTile.scale-125_contrast-white.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30_altform-unplated.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\6.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Content\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\contacts_variant1_v3.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7739_36x36x32.png	Fantom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 107899.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
5032	msedge.exe
5032	msedge.exe
5016	identity_helper.exe
5016	identity_helper.exe
3604	msedge.exe
3604	msedge.exe
652	Fantom.exe
1112	Fantom.exe
4492	Fantom.exe
3904	Fantom.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	652	Fantom.exe
Token: SeDebugPrivilege	1112	Fantom.exe
Token: SeDebugPrivilege	4492	Fantom.exe
Token: SeDebugPrivilege	3904	Fantom.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4608	5032	msedge.exe	85
PID 5032 wrote to memory of 4608	5032	msedge.exe	85
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 4984	5032	msedge.exe	88
PID 5032 wrote to memory of 1180	5032	msedge.exe	86
PID 5032 wrote to memory of 1180	5032	msedge.exe	86
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87
PID 5032 wrote to memory of 1396	5032	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/Fantom.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa867946f8,0x7ffa86794708,0x7ffa86794718
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,13810162247619629773,15384954937317536529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Users\Admin\Downloads\Fantom.exe
  "C:\Users\Admin\Downloads\Fantom.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:652
- - C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
    3⤵
    - Executes dropped EXE
    PID:2656
- C:\Users\Admin\Downloads\Fantom.exe
  "C:\Users\Admin\Downloads\Fantom.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4364

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3692

C:\Users\Admin\Downloads\Fantom.exe
"C:\Users\Admin\Downloads\Fantom.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Users\Admin\Downloads\Fantom.exe
"C:\Users\Admin\Downloads\Fantom.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-910440534-423636034-2318342392-1000\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
19660e2c1c53fe0a8eb23ff1b5b8425f

SHA1
abb2318bdef6051f308cd3893f75b4e54983c85f

SHA256
8e07cb2af8e5d934c954d8e478b846573d110b33a67e74abe73033d5c8dc9778

SHA512
bc3e860176125d531bcb579cbe33f5abd4981f7c226fb8d2c2cd2f6f67922bc8eb7b82eeea9daa690c5f013a79436decc1320b1adff184263d854e89f9444153

Download Submit
C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
4e2fec52fa34efc6ca72844493067b1b

SHA1
76e4f4419378eaf6572a2aa103dbe9d989ac3b8e

SHA256
33f3fc19f4ab892cb7d74f2fd592f5e6da5a248002b765224c74bff1ce741f66

SHA512
8da5ebfee06bd7d9bb07edf4a2e2a4b94b0679a6065720c933539b7483367bf2973377830d9df32a3f0bd919a15d6199c75c74f8f239ea1dff8afade9d9e39e4

Download Submit
C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
8d504c70cb7c8f83744088d716ad202d

SHA1
2630e3b163553003481f8c1678e8abe46dd42cb9

SHA256
3d2a66673c06fb387406ccfb90bc89c8ffb3f64596ae94b6db15de028567effa

SHA512
267fa7f35c771dc5d4ceee8db30dd1e6b32e6aea64aac7f9e68ce24039dfb4e2bc8bc77163e4e1cac18c3651819ceeb6fc9a2962ce873d2623d5c6ebf9416a73

Download Submit
C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
12da56c0a86c5aa1bfe0e18e83979305

SHA1
4dd9187b8c427bcf6e7168ee2eb02ff9dfe0c446

SHA256
f9831909d26495e0ecce46f06a32a6560062c3ecff3b6d4b62e0f18db8fb4108

SHA512
8bac06e433b8eae0aa634ab71392e72788a0c0f7de4c6a043a93477369c1e27d82e27869ffc5564997ee975d0206bb4324fcd030e8b6234a6e33a0dd455636ca

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
f770befcdac04b7e74565cbf5a053af2

SHA1
2629ef45a58c7c2b508572e827eeff9243f69daa

SHA256
15ef30d22f46d4637c9ad332d0f48fbccee5985e858085bc9c0bc4f87b73e8ef

SHA512
e68b5489012895a40765641fd6e47f6b38405aa472ac20d77a109849b1f100bbba1c2ae6cb15774df19cd3813e5d82ac05fc1bf522831454ef616fb112ac3999

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
e24cf845f270fe9735bf3494ec93de9d

SHA1
0711dfb04ccb2069f896b5a8ef5dc52b8ae507dd

SHA256
3d9f2f63ae5d133f98db33a597c85672df16f21f79e21edad78b82a1dd8ab631

SHA512
2ca9ba726f9df60e0798e5eac7f4c64884b3ed645a30ce6ca1ac3dd538d74a7a558adeb33176c06b0078c5f3eb94c059b1629bed250653f67812f62b543d6eef

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
176B

MD5
ac6e9242e46388b56970c494427a0c19

SHA1
3484ca9a1e9e9c9ff5add3d10659e076f3a54d53

SHA256
de56aa8fabab7586db1c804cf967b51a1f4e45f5ea8034394194884603209d00

SHA512
351599165c1d3d68dbfd900564503f344c53c1a2e2d377a439a6c96bc83d69cfad96ce01539050e45a2dc64a2c09465053eb8c27796b8e92b75cfa1747d92bdc

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
192B

MD5
8d16f6f899aad798e3cdd9055a3a90d3

SHA1
cec1e59e69574b3b609e4353d88148dc79f8a52f

SHA256
17fe8c1a7ca4ea0c4f0f6335f5eb12250bce10bcb4460cde92d65541068f72aa

SHA512
cdda4c6dab90913875b0031a3019abf3195f79688e8b8d56777913aca0fbb61004cf7062cc51a1eda3286e9e1fd6b9321d7febe71d076d600aa5a638ea583368

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
192B

MD5
a8457d173dc8f3cd82124ab108a18955

SHA1
ab9d5789383ac9d6f96f542fa11140cac08ee91d

SHA256
9ad4a09929345b664b2d7e4532c9e3833b1ef2ce101ce6ca44b9e488c23ff53f

SHA512
6b50ad0dac2b64b1e451c2cd0d1d649dfedc0abc7d6c3ea6246e111899a751704bd5c33f012e15ede90482293f43685191b725fb2d82e03ef4834b21f4aae6ba

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
192B

MD5
e07076aa42100fb6e6416cc56818ff0f

SHA1
6633f839b76a5ab4f6d53e13c6bf08e821aa02c1

SHA256
6631b8928f158e2f7f69e9fecd19f02d84c783b9b1fde7292d45caae505a44ff

SHA512
b3191fb504b4ef352efb14ccf4b19f1a00afa2effb636d8285af7010ef8367e33a68a321232f4c990475c11bb1888943319e13bbcac0ce6964918f9954326374

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
194ed0f279a97d2538479635d7a969ba

SHA1
086c988512fc3c04ab36bb147dc0787124ffa3a5

SHA256
7bb05a3009d75ac18ce814efe70132af3963079306a0376e8cc585f3012a1413

SHA512
6c8d792b4671a2df1f22ad49a983234c52443e8f1b5dda1ae9339bffcea1cea303d024c0e0fd06c5e25e2b5b11bd7f66c7daf0f4798e38e0fb51726d03db40d7

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
21af4a9c5d9ced142c6c7ca557c3f4d4

SHA1
4bfbf8e4f75c20d73496433fd7fd411a3df0cfae

SHA256
1be6b9c19744553e6ff12e94ad27514a3aae718c28ed885a7a09aced3bf0745e

SHA512
005c7364f743dbaad0a8698bf026af0f362ead96131c53047dd18cc1284f6368daf0182b1882ebe7bd74a16acfb770e68ac51ad3dccd810f11fe47a186738651

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
76aee1719b37fa0fb49d98f2aba7c02a

SHA1
1da4a19cd1374acca8035497cf0e477bc12fad4d

SHA256
e6672c61a03b3a47f652245bbd8f1c5fad5eab98dfe2fa7b5c6bf6dc7278a190

SHA512
bc94640b50eb80685ad1533b8610702c77db268ff81064a0ab4959fff24a69e64fb4519ae456051d3f1577c46bcd39ba2c9971c0a94be6830974250c9858142b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
c1aac7d5321245a18e5fdb4f0e3a249f

SHA1
5308b2e45f185c651a8c9f30c30309c33f4c1136

SHA256
6c26073c7cc4ef9e7e0a9dbf08e1160209cc81bc1a4b4bf568490bca208652ea

SHA512
b966be6d782e780a73621adc571254f448b3c23f9ba26d6078cb429dcd72a7c4431ed1cb16452c50b209ab71e26efc3c0a253306f7cb2e4db67e24131b188c55

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
bb9048db8bd396bf706b87fc69f3810d

SHA1
9ed8cb402582a021af05b4e2a079b1163f2e6dab

SHA256
20b41eeb522035b9ac2f7de20f27f234729b547ca1145df1fe2161451189eb73

SHA512
40d1ec8e6b119e5ce66e930fc462fca6f8d2fb4ea01621360e6812e0595a801caf9852481b668058c56f384703a605d20ce950aa3b75f2e8c1490dd1d2a4a877

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
c347a5e81d30f21c1b3ad3db0c274e62

SHA1
1cb19c85e683313c951175fc657021db5b230d78

SHA256
6ca4c23579a6d6d96addd29b33c6a3537749c9f512ced0932485b46cadae0623

SHA512
7e6393263532394698aa566eb0b2217076907b0714445fdf45fec3b207ada13407fa8bdbb11854441f8f22e0877839ce9fcfbd58bc87c2bfb87770d87d139bc7

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
b805c1d5cd43333b9f92ff4b7bce5d06

SHA1
94c880fb9a8200e0465625aa2622c11fd6cfa3ce

SHA256
ac01fb01c75228ae321fc2581c7edde86f0058e1e7541a23811054330aa3d22a

SHA512
de10921c68205848a129d3f8dd1d64cb36a4752041d011749c286efb3455f8b3b2dfc3bac9fd6765e18db713d19f769601bf093c13bbd91baaf643a469d9d2f7

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
f66be0ef67032a1931e4351d4680a64f

SHA1
04680c3f1032a33442a84bcc42f20cdad6302be9

SHA256
1ff3b96c688d28d57938450ea6c44fbd2dcdddce73ba7a5e33627ae827a4a3de

SHA512
0b6fc8008c8222b51b3eb82e06e7f3242e672f7029c4cd0cad86b0f726b2116810b7d2a92c51da3aece2fcf106f8195c6ae2c287eab0e047222e94f533de7a02

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
256KB

MD5
9b1159e6769f738f82333ba8a1f323e3

SHA1
3100f165ce8b40d38d0da6bb95db831ef2f3e93a

SHA256
3c4e5d79bd45e1c8f9097dc6da05c99446074a16c192c54b5905c3f4ce8375b6

SHA512
f242238f6ca3c07ff292161da541dc3fbff8fe67303c5a89ef94e050e63ef5e50767166f9e6de79ac2fe65c742a2eb14a5866dd7e572555a9c2b8d3c365bbe8a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
efea41c5b553d9719ce67baec8483af0

SHA1
d8b2a1de81ea5af3cf26a4954cdf5887dab4bf01

SHA256
006317cd9aa2545b115575db9f918c9b07789b3b615fd096bd7524eb438aeab2

SHA512
ebd082c03ed9c1f91f26651b2e3b35ec6b6e6d59f56eb033728309ff1090f275bccef8d19b7bf1d104dae3d44cdaa8a56ba6795b6b669cb24cd1459d88fbc801

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
e7ba6ef9a421d87ebddf9229a5d48b54

SHA1
36a1463d100c62282d75437187e392ae674c1f01

SHA256
cde9cda6c63fd40d65f72511582f3849634b3fe12588f470e022bb578ed3b9cd

SHA512
612a6ed812971f89cc810c14d2f9fa8a2f30fe663a1bad6ede05932f4e05bbac702805ea3dabf63a96e594175a70589dfb62a381e07da005aa74105f55f03537

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
41d59bb56e32fe41771707c213b9eeaf

SHA1
eac03a3926e85875dcdf8403ef252920020d8548

SHA256
5af3f15d6fbb3843f6876d0246b450a40d4a3e147b8869c56f087e3e8a3e4913

SHA512
fd94aa7875422877576db1ddf49cd60d890324211e3f736c4e5c2c024c1f632e26bd488db505684a05711c1ee123913e9b263123e6e69bd0792db04e7b5f6678

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
98478d5220618cd21b9c9aba67f81625

SHA1
945aebff178db4a212bc9c3a393f987416d26a9d

SHA256
25c4e74eab0e276db76a63c01920df7480fb004396373ea4df8ca79476b87f3c

SHA512
5f642b901640f8d2df2fbed643d782250fc45ce115d435196d672d6ee6f640f317de71712eaff4c5ea5340ed17c5bf29961ab9aa9cc5369a28344eee9420708b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
76437f0ea073ee53712abbc951329a55

SHA1
21aa9704348ef62082f78c1c1a3027bf6d1cf6c0

SHA256
c341e53760396960fe08df2998302c1ca61825e25ceea9fa233a6000d751784b

SHA512
282d74077854fc0ac75dde45228ba4e9558c62b112da2550470de58267f6962b96d73d1b364749b5ae8d471978e7629ba069b0926afe7a1927dbd19ad5404632

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
176B

MD5
708c57971da1fc534cd9f9f198bbdc34

SHA1
76cf5d532e9e70b9b5d7ddf17b61ccde86095293

SHA256
aacf12e148fb9bd4ab86de1c40ecb61c460c0bd2cb87f3b294ff4d3b4bb4e838

SHA512
2466b79fbe7d85fa387557be066aa306f85d0d45b8ec473690f7682534e938e45dc19ee7850dd4c1ac5970c639387ca79f091620dbe2ea18bed9de863e8dd13b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
31b72d25c07ba85954f10e3268df068a

SHA1
f00a4929418589558af093be366dbf2d260f4320

SHA256
5ae40de62be7f6834fad6cb7120ca71a575534f79441857d48cfc2dbf6d6febd

SHA512
47a8b46a852d99a24faa4997303bb59d05ac591bd8e0f96021673cfeb6b176d6473f70260b685e6c0e6935927cb11bf740870705b8d52f0c37a3f6308f3df911

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
163ab26781572d090813d381804b24a6

SHA1
49bdf6c7608281605129fd4ed487caadfd06a456

SHA256
e3c5c2223ee00c60be518892c5f8f1783554a230b9cb7ead5c13d8954e46c9ea

SHA512
00b74bb1aa94e9e9754675f910a361f3406cf6888aed0dbc311ef770c236e508cf27c74f772002ea4a7c3fc47ff50120d104f27a2587d3c0e5f8eaea685fdc27

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
93db9858f618d8e1c5c460957c0e1a3f

SHA1
1d4beff7305515dae08278f742d23203f9f0c9a1

SHA256
5f37c19629872dbba9265dede4f6fdb53507947cb16bc73795881ee392d13fad

SHA512
eb5686489867f680f0e67c1c48af345073685e05304a86d44393278ec3b12f9ba26700cd3147eda468017633faba37ed38a7100fcf7f6c183bcab61e5ba7096c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
498883748eab5861d323c76322e045b8

SHA1
152810406b6cf3e5d1e43c40201285d14815ec15

SHA256
2d45af2dd71b10ba042948ff1d8304e0de4622f0fb2b7bbfce12f995730ac624

SHA512
eadee8e92651b1c0feef4b9115b9d221d11add5e11a99df9e0aab3f1054ea33f372fc85c483af09d3f95c7be8df5c2b958034c1f643fe6ddbdba9d3b66dd9296

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
e5807c70d807bbb88cafa32bda93a83a

SHA1
dcc14e48542e1cb08e29d9b02f9f8934721f3e1e

SHA256
d6208045462ae39e9b8d063be07d7e59df04d2ffae139c164667a677cfabf60c

SHA512
6bf63f8c124df4ab5e352c10f54af5194558ea86c1c9cdbd607c98154e2b727d213ca621cf2b6733067542703b1cc2a06da9df25266e5108ecac18b4d0e9cc87

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
1e877cf6c60467b0f1cc50257438c44d

SHA1
be66f62f1fb9b464e1b40ede9427455d64913b38

SHA256
6a97baf8f795436f6ba0ba4deb2826b5b43fc9edc37d677a9f2856f6c64ac703

SHA512
340a3ce3224c54fb03ab6663dad2a0e3ff835a94f213b311154f148017cffdf90547c87cef9dd0d9a4c238310385d15e1a966c3ca82b2e27b74b92f402e4a43c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
c19cf2e3db4af082d0cd213c2f5a4d51

SHA1
a35271954c12c619ef3c8c0509bf9a054541e2d4

SHA256
ba60d007d2e40c949b7ce07d85ebbba5f0fa8c2507754ec02662546c790510e5

SHA512
1dc660dd756f34c7d58c1c0c12182fc1ad6068fabd658f93ac7c720d304f3e77ea73bb2c3dd35dfb18766855da237ed914f6a3841c45d12102db2973b4b53de9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
e2d9b2ee672b06bfb5a8b7b906468ae2

SHA1
2f2647333117119ba8c6bdd44b901da37a42cf96

SHA256
9956a953eb8bd3e327adea939f7ba4c53362dc77407e3fbabeb217b72f67b03d

SHA512
629da248f7356c0f544dcc563dbaba303d59d6293b4a46c485994087f6f15903a9fe04ed548939f705ea060a46bd2a4de035b84d68518fa06a12384c82f414a6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
9548693f8cc160c0ba438b9c4f0f5288

SHA1
bdbbc7dfa04b4b24341219afaac1b5d941222e54

SHA256
817f454a7d7c579ef4b19f554ef5dcd159742e239316f4ae25dcbf20184f9f4a

SHA512
a7a31f30822c3bcfd4f0b032ce1f1212cec1efcc8319eaa7b181fd0b5d8cc6299ed18abff40c2adffb0af1bcacf78ac5a6a3dc84765bdc330b43371feae9b6ff

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
4dcc00ac4f6f451199833d2fb7919f67

SHA1
4e24122d0c82fb984e50fc8422c447ab475ffa0d

SHA256
d8960300f44e6d1ecfa358760e2b14754515574f6502fec108dcd6e6a7b27492

SHA512
b88c91eab911b51b640664a4995bc2b16457fb607832149a7223703cb2bcf9cf248445f5641b11b180126b3861dd4aa181c6b6fa8ce946e8fb6111db6045a0cb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
a4031cfdb49cfee608075305b4eb5284

SHA1
5ed1b87c5e52d00c7355314df7503d2d4805a202

SHA256
09938d886a186760c367b3ed36d0ff38dfd81c2a82d4cec5ac7f137dbab4388a

SHA512
f520c4f1bd24161b321dd75b4ba1b299f76648cac287e59b9c63171f0b2c0ad5c406483efbd5ebb375e1aa56b7b3d5b12c6c362342e258ca673db0b6a0a80e44

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
f07eb5d6512c6f993315d33fd730308a

SHA1
6329deb5079cca2eced2e3a23d2719aed1d1f9a0

SHA256
433868f770dc8244f144fbb2cdd7dd020296abce14c82791e256b9dee82719d3

SHA512
964b5cd348a7e5eb1a1ea06e4c242e46011d13d67c512bfb0997f3c3f5c725fc512b68b9ff14ef013a1802e09f3e976a59240925b95ad57df3e55f054513cd79

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
eb64a9e6ee871626e0fee40521937b35

SHA1
f6c8a14d00235dd204de5aec6138fe3b1736503a

SHA256
5cbbe2d78acf85be1ddec8f459b1d51670cfe34e70d8f20c784419dcc2067980

SHA512
30de302f6f2461da3b5882cd579b64c4e348e7f3f69ccef0b7c839f0ac9a101f0d77046ac9683d4d128e061ce9d3841dd41d7048f9675a028e6c896f1192d953

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
4853a9f9f23eb2ce10a4fddcc570734d

SHA1
dd4758c47aa1dfeeb4751b64d1b6ad0b3ba01e37

SHA256
7e768a4ae9fe1b2427f45249a75209041843d47c0bb1a694728c830135e3e6ea

SHA512
8030d351c9367852a2e45e4e06db490b86f9bc215e5e1d11752c245acf5dc6c2ea2fb4e81ca0b89530b8819cfd5f5c96bce0e6a578682ef8583a3ca50c87ed7d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
afd079342f0453c287c0375518fdc1dc

SHA1
0a9416d61b5a346c1e263aa74f664256a37a24e3

SHA256
029d30a7bcb8afca5939c0cb1e288f5c2f4ccb72d3b1009d93d1e05bb0de2f1c

SHA512
f448e1d5420bfa67f3ad5c3afe4314420c3bea8912818b20207f9f1864007b5a129a08e11afd261617d79d7a92f85216e594709978aa593067bbc719abba556f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
eeec4896a91f50fa9b8d221fb7f82150

SHA1
39b1aec86f36944f5a00ad4291422d86374c8d49

SHA256
f4156769c3459348b32950c22e65be4b013ab034362c7951a059cbf41ede6f3d

SHA512
aaff3e24c0e4fa5c47285000eaa98f62db36499e827249160356f0be22ae940e8ac4444357b3635b51018b5a64e82b3c75022214658ef5e158b9a49b25ac2090

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
b8017c1d43358468ac2ef54f5f93e725

SHA1
2c498e0fd6bfb0ec5245e5e61cb4670da1839945

SHA256
b0ae4bb015181d4f784194a38a184a1b6e3b817d904a9a55013d863f537d5a39

SHA512
837ec681d22e94c0b4ed0e5a91d6a6a210d4cdd6f805ed8d8183b32a8fb460997e343798447156c2efa08d6b5ca62e62166124b4fcb0cae1108837704a468af1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
5c8c591f5b6bd9cd5b29d5401bd2cd7b

SHA1
da89202241225e55bc19f34ed2f2f5f2d0855f83

SHA256
3a1432d9d8bb4d70fe81252d4c98b2b0a80da12a58c82be7abd5cc8e1f19f311

SHA512
fe48fac0805776857359a76a535f86582d9c2c6cb6e3b11d47b3831dacaf06907bd987131e7e3f3cc63410e94c45336c802a0abe21002ee517d3babc76e766b6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
064d1ee83656566c7a7e2f0aadda4b25

SHA1
58407d01d4b5aee2e4c894e91e00210b4d01b502

SHA256
69b2dea7447f679c335a62cc690c60f886224de137a77998c1535d377077051d

SHA512
39c2bb1f28036d24fa2e979eb4f8aa04ccb379e7f1b41a766f4cbba3d5b567dd57cc4650ebab8670a633a4f3931e05973b17322a7da077b93d06c44ae4240e6c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
bf17a7082487bc98f88b7517f239378f

SHA1
1f11ef58dead3e3a0276b9698d05164988cf6a93

SHA256
32662c9e37b9504848b40f09b4a1773843f0a75426120401d60a175a00833f04

SHA512
76dd2c421521bc6373e67b84e36a4adbfd53b32d989366c057dc2f129ffc5b40ce6e31a4d5a567f600faf08cf62e78fb2c8eb6533b41b12da996f547de1c89fa

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
bf3b0331bd3aa3913a39e4832343d809

SHA1
b739af7a1d5be596f67b31a97a97c9e5e02a3d9d

SHA256
ed332979609e1d725b2af9a15c2b77c616e344f8dacbc47a05f1c8571f2cfcc5

SHA512
5522fc3a2a3a3c142e6e20d3ca8a9d42436511b6bcb01fb7a6905b4a59b7aa01a70ba4f855391c28572eeeb8aba847838b97174e9db2b1453c3780de48c0708a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
38765e170b4350367f7205b0e24a13fa

SHA1
875f24fd243116db543c4694e478d67ae7fef09c

SHA256
9cbd1a15fce5aeee3f2d91d62f71831efef7b3f56e5cc02df96f5767ae032a04

SHA512
bf27f053ffd03d9d9b63f36dfadf2d3af0f5dab23efee187c6aefe093b81bd2c081d5526d44f59d4b1f150449290781de7f5e62b10b5b03c4f1b4650db816589

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
f6f9237e81f2ff1dd5fabf2e4511305f

SHA1
46b9ce61d30bb8d20ed3233ae0ffff3f6a4de49f

SHA256
6c55bf11de9501ed5b33c2dcd8956ed50ae168ba3a249f30ba74038316e973f5

SHA512
64a36dba89cc52916cc81e8a001d2a922844040112beab2e8f2b0feb1783f98da7e6ee40385882e00e929627f91bcf00a44261d1454f3d4190556aede438b472

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
8bbe6d434071cdd82c4a284d13c77770

SHA1
c5f67be4cffec2164f6903c08f41bd17245a9d2a

SHA256
4986c3fcc14d2fb369b41ef414a0d54e48feeeb50e11886e176354924c8c68de

SHA512
abfd24afb31ad9c2bfd9dc8455fdfd3aa9038a8068ff8d47035beefc78cbd8a7e1d0b0525d30ca0adca85c7f9b72608d183a80053944fcc7e5df014e0ebe91b0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
e397c7a43134582f5d3e13e8fd04c717

SHA1
a53879d5e47d2b4d10495b18f1e206b670aaeedc

SHA256
f8560644ad8ce68b613d11ea8aa56e9008c520b6edf3e0648ca10ad8e1805873

SHA512
eadfb93abcedb5816b4eb02c8de968a5f10b25460c6ca835c4ddecae0c2c7cd67b9d113d94daaffc62e6603e7ba5425face4d9e31e9489a40277e8808df4dbdc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
ea9388800c25e976da163f00d3fcf0f9

SHA1
22710484d60330b725c48942d27187ad95ea13ae

SHA256
1dce40c08393ffd16bb9c939a8d266da7530bdb770e341251312a816e67e2b37

SHA512
9e455c8567b2dcfb0a59ea1f5401755dfd87cd7b13791444db642a1e3bbfbfb00b64c6e6936bb764f378928c6e87bf79468730d0fc39928d10f10c45052b097b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
ba552187ee00fd47b65ed7dc23aec808

SHA1
79355e7e9e1cc43c9d7591d3452c1797c69260cc

SHA256
e6b80b1206a11fbcc02b30e72355a612dc26b80d2a6ebf4daa2de6c538df81b5

SHA512
91b77381e1f44e400343047f1f718cf0444444162acb3cbcbca7df52a47fa4d9adcaae5a43a2a833d1027a5d90f1ee9233f75632cb93b4682e2345364ce432b5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
e5911d9afd10a5d4ed75ce505dbc9120

SHA1
e8b0359f0a332fcfdf5c91bf4bd61e9e73cecbc0

SHA256
ca224a169ed2c1de48b29675663420c2a8e11537c7a661bae2e443592e4fc80c

SHA512
196404f4b589ef5ca4e4a6c2fd9428ba5f433cc50ad7647cc70692e41f1e2c949f43e25607fca6b80ee31377a415d8335a12cafa5cc9cc4516d2bab9006e8e92

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
76590dfad557e8e4009329731d955f06

SHA1
7135380edeac66ecbfde9e27ff1b29790b04f591

SHA256
4ab50eb474e74e7722275f21bdcd308c543fc7e23422aa9b694b4ba7d1e3f9bb

SHA512
5b92b4f4bdaeb3cd23424660f85c71cf3046908b58be5d367c0e0d705a4648f05fce472208068d2d552fdeea66c249df83671fb03fa0879440aa2836a986e7ee

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
11287db2f389a51200b5aea7f9cadc51

SHA1
550cfff745fc320c212ef220756ef0a34a2c2cf8

SHA256
c3fcfb7ae2eccf063f6314f40f20dc2f524d9383d8dc510033859038be586847

SHA512
63eea7ed471e6fd027a4b36a2bae88a8fb049b7305880937511877d44a9b0d281861979e2f00fedaeb7b72de215dbde0f01e0236b39a24666fed6345d90d68c1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
5aa77ecc769352f1c4566da82d1f77ab

SHA1
023bd5acfb729413c3f95fb8aaa499fbc305098a

SHA256
24cc9844f3f31b50b2f1370616a35a8f8e2a39aafb0751b10eaf3accfcfdc391

SHA512
b5b4972d2ce71c8a6293f35cb8951650136cad3865737efb6403156e9d0631e16dbb301f6cb94df2d835b6f100ee6ad869a9cd71f6fd66abe05771b9a7271196

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
066e5761e85047d35764230b049617a3

SHA1
0c3500bd78fc5be26a23f2d13f6bc53eb5497a61

SHA256
70098576706f19e2a55c8adefb900127badc558fac2b6422d3f116a2669631e1

SHA512
53844e410e6677ef35719eeefcfc344f8ae0c1b200305403187b3e7619d93689d3a1d78ab0a9f5b2368b81f4fe3c317d0f9fc9ccc4d1fee14ceae4900f7aa166

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
ccea864edce5d337c32dcbc188e0d7b1

SHA1
1d486ab89d39ec8b1c200b5f1c8094813cbfb2f6

SHA256
4fd23b6b287b31ce6b79dc95e0a92e7345b5fa09c93a4aaea590c5a370e2675e

SHA512
618ab97688f9f6e79b2ae8281f28e6b86f100f7dec0f8a1f7bc7212bac9d39dba83131766668ebdd9e5e01fea8a2592c5737129e774f225ae78342f6181914f2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
6eabe45135ee091dd3d34f174e1d843a

SHA1
6e6a90db23863d08d7c7ac485d20712dacba28cc

SHA256
fbf8738ec9046ee7908922cfb223f9b9b0dfec0a32bd086e37419832cbb56563

SHA512
288adb678ca3dbae87a1ed2dffb93ebfcfd1180cfb11eb9fb8725a8b1cedbd47450e9afcc43b33a26b366e1c8a5e7e6e6985f5f6c45c9569c77a5d2b0a015e4d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
f74d8adeee9e43fe0851b5c92d78d98a

SHA1
7ee15af31282f782be3ea287139565b665650d4b

SHA256
ca27c1251ccfde6e03fd6dff4ac75dc6eaace3d6b21ae38b3ff48f45f25f74cc

SHA512
76a68db5dd4546a3c59eb922b7dbf29e0350509f402293582d9f44d163b522c711b7a8506a099789d0f84d6e1332177e196e00cce07a67f5cde96c8b7bfebb1e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
2f5fa7c7a57b273eaaf8de9d5d9a8ccc

SHA1
64ac1c8b55027820f9a96d6bd67bde4eb587fe6a

SHA256
077dc7b3926a0b6bc8694c01b84f1a5a1a94fb7b3ae09375834ac8bedfca3d44

SHA512
f2f0589710a255ea6f133bc7a3119eba8ad19681529e3d43a5ceb7be2a61338970a0e0c73cc37adee7ec3b0a21ba4284dc2b554b4929dbe1f2476e89e752068c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
2ce120cce3aa4d736d01343fe52037fc

SHA1
be139834873c751bc41909085337e2c35a78009b

SHA256
8898488a2a6753ce6a1e585d96b24fda8819ba61aeb81a9929ae45c293720ee5

SHA512
ca96c47ad637e0d7228a431bda2de91bd1015aa55e2a696eec44e4655fa5a7370ea26cbe18270aeff68f1c4b0385e3a142c258a9f2d3dbceb2803df59166a8cf

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
28f2fa7b65e8f9395b8c95928147d23c

SHA1
c60fab988ab1f61dfbb0e2c01b73604209fd75bf

SHA256
095fe70ddec98a70b3874d47d5aa39bdb80b97b55408b9a0b45c9ec6c0e34de4

SHA512
1e15c769c2fceb44c101ad95fe11df9c9e8d72ee671b6f20d285a2dea907e5ff39ab0f2304924eaaf0d4e84a10887a564aac9450af68f8971d13285b6922aae3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
a8eb1da647007f05387d343b6c8e912e

SHA1
282dd349b819c64cf03d9d618f6571e30e25b5b2

SHA256
fae4dde944b61f1841c61a4410e68aec2e7f19825c9b0233fcab18484bbda295

SHA512
3a54a554c44e53f2e39d908fde7773497897a4e8f7dea91eed52a6ed596c6ec0f7c8ba88e003bd49585f95aa7d19038f78f7985362d921db8a5cfa9bc5a3b8ae

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
6ba9d096071671c20e79fc73e68f0a1b

SHA1
bede32968872ab4d19ef33914438a84e968a3379

SHA256
732a07ff38ff2a5978d3cafcea5847622f455392997452566272f06c27376348

SHA512
c445cc48502dd37b86d34ecdd4362576192ca9ac747b8f1b29ec373e10df0b1b9be0e45943913220f8857c49b2cb01705c8c92bf4534da02aca587478da073a4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
99518e6577328e41e1122c602f38148c

SHA1
f4e353f3fdb948159d5fe9e43696bc1db130581e

SHA256
92ad76a8aadeab120e9cc6750886469f30b2bf979c56c0ae474a4cecbae0ac77

SHA512
6e9d539b7c09e62a5dfefa113ee957dd9c31ae86b1e599122822045b603f6b410e1e4dfa6f561c2177fe6376036c295776ffd6ce16213d4c7f5c7649d25408e3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
425d7b8c3f2334647ae78fc9f3b63479

SHA1
df557af72708a20437f5c8507db9265b5d7e1a1f

SHA256
14432751e9afc632434ad2b5203767a99182dd61a03a32bcf809e079744b0602

SHA512
ea4a08965541ec24d98e53940edd9c9f747a679b41c50bd26fe147f67eab8c9c0fbaebb04cec68066c0000e10165914601087bebff000b9d51219464da526e1a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
68afaee608100c527b9e604ecef7fc26

SHA1
51a5741168eddc51593567fc4f3006740dc0c6eb

SHA256
cae3d4b2ac7cace98c016815e91c85f173c0e7bec008ec90060e8dff37b511cb

SHA512
726c3302b9c19ca019818b063cff7eb255c3c1d6b6824d2828e99106dbed4a7be1d2e0f11bf903168a566111e34844bfe326e49baf9048a56d3d12fb7b43b52d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
fbac43671e7006d942ac37d65b2dc5f5

SHA1
89483d92744d6cb5b4803224c79ad2650ef2b3f4

SHA256
dbfb2db28b31bf4480510fd371ae0d039c2b9d9741cbd2ef2391203871c15593

SHA512
6bec93de17495f1a5113c281caad116e6729263e1f3b5dc6707c5274a0c3cdbafa0cbc065900c07f231b93aabafc46c8eb034cadd54ce23b4ae10ef544db9e08

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1024B

MD5
a0b00240c79c10a5deb9322a073cb14e

SHA1
560b973e5e49fb0f832e3624f190b73133dcaf90

SHA256
3e9e6f1bc7ffe972b83a7e914c75a877aa1d35ef000caa9ec483cebacd221480

SHA512
71d0ab6273ddb8467da57fda1fac70729250378ef000358cd08584bf83c873511cf21d2d27ae8cb68850ea01b30949b3c2fd84485356afa950efe62e2411b8ec

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1024B

MD5
464fc60605b6cccc2a6f159a93de162b

SHA1
4d0981726acdfd049531fa8f461d0548af1ba5f2

SHA256
a319596fddce2cd199c3689e4873e7e40750e91ddc79264fc4c1f0bde181b003

SHA512
07ca6ceaad821871d2441737b704d269debb185e2b4b142f070c751d83d1a3dfd2a4f1f3bd94bf82eb9b95919d2878fbe0f807662f81be8cab017b318ec89389

Download Submit
C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
176B

MD5
b3617b227bfc386c058dcb1b6d9b558c

SHA1
36dc5096fcb505378285d186f359da8d2a513e96

SHA256
867c26c8bde1b334cc2f98e61a6f8818402b67ecf23de503dcb1a290b4c3113a

SHA512
54b2b831decc36a91b2248bc7b83424c0d18991973c3bf51294212d289eff72e6ea5c4323eaad7d9dac6cf996250e97ea7885d5127edcbda53b0c7cb0d1ab5ec

Download Submit
C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
192B

MD5
9d2243f3dff9d628c5d7fa50dbbd639b

SHA1
6710e27ba9f99950c99b509bfd5bbcd23f9278a3

SHA256
685d40e2895cb5dc11d536c3891ac594b3ddc9e768cdb046d6672683692c67af

SHA512
5f86ff1f187efd8956db07e426fc331e08a3fab6e13ecb259d0a7583527eb829c57d0ba347551809fdcdb080414560dfd58349d4bcc16aa1c4d147f66f84a759

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
48B

MD5
de897eed980379ccd3ca2326abe2002f

SHA1
f7f3ca020815387b8da8fa8996cb0de3dc57c0d3

SHA256
e77dcb25cd6fa871622c9b4b8900af494aff67d47d7a84d5e1f5a1c9898f52c5

SHA512
cc56bcd103b330e16565148b111b2f27ecc984a4e3f63b134e245f6b5602c805ab5f5723919289d840fd1ec4d0a78805af1ade96a01e21ea08ca06a92b74158f

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
48B

MD5
4a6404c7fbf4d2c7a3875b6e0d458d89

SHA1
e7d7033262a7ed447edc4da0bbab2b520cf3dcde

SHA256
9fec1361dda17533c718e972dc290d4c59f665447f2e431ab4ab9acbee16519d

SHA512
6cb413cc3a4954834109c20b5f8cbf651dcdc6d095baf9392c45a458f24d42770242ee96a8185bb2abe39bee686c49fd24e71241d04620af91efe3708baf402d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4e5590fc-1d82-42d0-9911-2e4a8cb33304.tmp

Filesize
12KB

MD5
c3375bad0f3615ebfcb7ed1093c6b60b

SHA1
7444d02372f0d2f77cbe9ae7598ecbcf7cbe57c8

SHA256
84143813ab495ef455d87a98e8d54a43fecd4ed2a16768ccdb33224c2bbac912

SHA512
ea8f75e66552cc363eca153b083b9c07b2b99048dd980481a598d361a4b06ee3be8d48b2a73c303e6daab252e03b7403021822cd51be94f86f6e6761acb163a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a65ab4f620efd5ba6c5e3cba8713e711

SHA1
f79ff4397a980106300bb447ab9cd764af47db08

SHA256
3964e81a3b4b582e570836837b90a0539e820886a35281b416e428e9bf25fd76

SHA512
90330661b0f38ca44d6bd13a7ea2ab08a4065ec4801695e5e7e0dea154b13ac8d9b2737e36ebe9a314d2501b5ef498d03c5617c87e36986e294c701182db41b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
854f73d7b3f85bf181d2f2002afd17db

SHA1
53e5e04c78d1b81b5e6c400ce226e6be25e0dea8

SHA256
54c176976e1c56f13af90be9b8b678f17f36a943210a30274be6a777cf9a8dc4

SHA512
de14899cfaad4c312804a7fe4dcb3e9221f430088cb8bf5a9b941ac392a0bbad4e6ca974e258e34617bbffff3bf6490fa90d8c6921616f44186e267ddaa02971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ab36f7c07b18db3e3732deab77eb769b

SHA1
01aa15218c9deab97f353b9c1a1be44a5913b3e8

SHA256
6ee0298f783b3603eba0f51715003b44a2b5ace21d4ad5407226a3fac7988fee

SHA512
7f016c1605d669121306a7525aa4d694efc5137086803339027aed571b66526db49718c4ceb3a2a16951c4c498322e36356e4b215e4718c31c64b87ca9121efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
46fa4f5f7344089589d117bd7599b3a9

SHA1
b6cc1fe19e527d4a372c97e4d195ed94eee40030

SHA256
223280d95a13f1af6af06459bbf230874500c212a2e16f63914eff3f22e8b57a

SHA512
6b680aedde7e806802652aab9ab31cb21438bc8756b063955e6f03bbbdf1273f7d47c40ec1a19fe27537afeb8d6cc219a246d31f7c6822b481649fe296e2a45c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7380de2ab316db750e1775735b682dbc

SHA1
c46d46533366ad987b075906225a2a4540a20f97

SHA256
389bdabc3dcb87050fcd4a07413618c2282f6188baa91c8c212db4f8c4a5cf63

SHA512
634724dc2e7e8b0671860aa701a5d99617e2c1d291959ad77073897c582d700db55c827485eee90f514cbb7b24807c65e830326f28175b57b0a4bcfa50596250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
35b210bb408042c9670248018d281d1f

SHA1
bba9cbe6f6950cf95426c2ce07d0f8fc40008b08

SHA256
782f2ec36de66b4d301d262f8d812cd7649b081393ee159f06603fa8c28f4b34

SHA512
a07b7e393aca9a69e80899fe2f55e180e7d811a177d34f4abaeefcff344682b314fce1fb6698b2989e135c2e3e2e37ffaf058d3842097cb4256f2615a9e1d4cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9cf92a1f7b3fb3826ef1b58c0b919569

SHA1
5af29205ad4f2c5c0f8ce4849749a5717c44b5f2

SHA256
17a7ae55eacb94c9d7ad288236032935dd074052a81feffa17be6ad720c46ef3

SHA512
9f778576e7cb26d9c4c71f2638217f366570e017634eadfe3755ced840a3f9ba7e8277f1601bf554ab7e4f491fed824b6504aaaf48f75cb882ec8d648424a2d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eb6fd9c4949d7479272c4f6f2d5ef70d

SHA1
be56ea5bc3bfe9c421a4706af0d9a3d814b5a3e8

SHA256
a06505bf56f5419e577843684f738c356adc0c3ad9946598f78a4fe920f5dbe7

SHA512
cab485ae502293038e23130be361dc0c2f4b5e399b3792b8619c615d12e17a7597145d8be3ae0fda89e020235124c55fede6c4fec8d26ebb4dc0a9efb49d10ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
316cac07e2645bcf795942f852f5425b

SHA1
053e3fda400d986acb4aae1be06e489fd5029df1

SHA256
f8c84a761dde4736cfaa1fdf138f11498a0f31b3571ec55ad9d2d43275323f83

SHA512
054080744cba76fcf3f49968612b5d408f30f17d5123b5f7edab57518c870e7485a18a754d08714937335e0622eb70e5f29069c75c9abbfa1eed959d91d8f1e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7248cc302ee3d7bc7d651b59c6c254d7

SHA1
733387c592a8519d2b847f887c64a3c4b57016bf

SHA256
90ea9fd94d43bca72c4972d9b0b55e82c60076af27c4a9fa4e3f150e19f15151

SHA512
a1f4275ebce0c63a435c7649f9285a7ceffce0dbef30202cad77bf99fcbcec23c40d7a145c3074754c5505ecddc2a557881032ac280567e65de71c07ee49b18c

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 107899.crdownload

Filesize
261KB

MD5
7d80230df68ccba871815d68f016c282

SHA1
e10874c6108a26ceedfc84f50881824462b5b6b6

SHA256
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

SHA512
64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

Download Submit
memory/652-233-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-231-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-175-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/652-174-0x00000000025E0000-0x0000000002612000-memory.dmp

Filesize
200KB

Download
memory/652-176-0x0000000002370000-0x0000000002380000-memory.dmp

Filesize
64KB

Download
memory/652-177-0x0000000002370000-0x0000000002380000-memory.dmp

Filesize
64KB

Download
memory/652-830-0x0000000005630000-0x000000000563E000-memory.dmp

Filesize
56KB

Download
memory/652-179-0x0000000002650000-0x0000000002682000-memory.dmp

Filesize
200KB

Download
memory/652-178-0x0000000002370000-0x0000000002380000-memory.dmp

Filesize
64KB

Download
memory/652-180-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-181-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-183-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-185-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-187-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-191-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-189-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-193-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-195-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-197-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-567-0x0000000002370000-0x0000000002380000-memory.dmp

Filesize
64KB

Download
memory/652-463-0x0000000002370000-0x0000000002380000-memory.dmp

Filesize
64KB

Download
memory/652-199-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-461-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/652-201-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-203-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-205-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-207-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-308-0x0000000005230000-0x000000000523A000-memory.dmp

Filesize
40KB

Download
memory/652-307-0x00000000026F0000-0x0000000002782000-memory.dmp

Filesize
584KB

Download
memory/652-306-0x0000000004AE0000-0x0000000005084000-memory.dmp

Filesize
5.6MB

Download
memory/652-305-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/652-304-0x0000000002370000-0x0000000002380000-memory.dmp

Filesize
64KB

Download
memory/652-243-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-241-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-239-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-235-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-237-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-209-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-229-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-227-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-223-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-225-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-221-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-211-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-213-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-215-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-217-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/652-219-0x0000000002650000-0x000000000267B000-memory.dmp

Filesize
172KB

Download
memory/1112-572-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/1112-336-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/1112-571-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/1112-570-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/1112-338-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/1112-462-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1112-334-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/1112-568-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/1112-569-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/1112-340-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/2656-844-0x000000001B460000-0x000000001B470000-memory.dmp

Filesize
64KB

Download
memory/2656-5809-0x00007FFA76E50000-0x00007FFA77911000-memory.dmp

Filesize
10.8MB

Download
memory/2656-5811-0x000000001B460000-0x000000001B470000-memory.dmp

Filesize
64KB

Download
memory/2656-843-0x00007FFA76E50000-0x00007FFA77911000-memory.dmp

Filesize
10.8MB

Download
memory/2656-842-0x00000000006A0000-0x00000000006AC000-memory.dmp

Filesize
48KB

Download
memory/3904-3310-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/3904-3314-0x0000000002420000-0x0000000002430000-memory.dmp

Filesize
64KB

Download
memory/3904-708-0x0000000002420000-0x0000000002430000-memory.dmp

Filesize
64KB

Download
memory/3904-829-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3904-703-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/3904-706-0x0000000002420000-0x0000000002430000-memory.dmp

Filesize
64KB

Download
memory/4492-2391-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/4492-700-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/4492-699-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/4492-575-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/4492-1804-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/4492-1795-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download