fantom | hxxps://github[.]com/Endermanch/MalwareDatabase

Resubmissions

14/01/2025, 19:21

250114-x2ytaawqdy 10

14/01/2025, 19:15

250114-xybvcawpdy 10

14/01/2025, 19:09

250114-xtsx3aylfm 7

Analysis

max time kernel
244s
max time network
244s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
14/01/2025, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

10^/10

fantom discovery evasion ransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>NuntaGAisr3S5IBDpXQNsQ+j1XBN+/TJHCbU0r/c18UsBGvjEgiMlZZxBvV/ayqxAT6cF6oAI1qbro+m/Om69taNsiR90zmGU9d5jMuNykFsPT8Wr1+NpNUTmnY/p7g7Vyn1leBg5l2tIXkt8Y41S/EuWwXeyfAHAhsb/wDCTK82l7nw5U/DpT7CFi/Kml7mHtb1lzBf3MTuxrKLASppc5tRIPj7U/xlVCE0d0Opmhfp0sivady0VJgxCm3zHlktX1wBzTvaeu+o9JMINZQ4no5RsNS5s3HVf3QRHNgLs1OjYI/aZC75I+503siseEJfb+47zrkHJArMEPuLMyVJ3Q==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Fantom family
fantom
Renames multiple (1358) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
2704	WindowsUpdate.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
38	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.29231.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-200.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadSmallTile.scale-200.png	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.VisualElementsManifest.xml	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpLargeTile.scale-200_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-200.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-125_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\AppxManifest.xml	Fantom.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\keyboard.js	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Illustration_Seasons_Winter_Center_Dark.svg	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200.png	Fantom.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\dist\css\fabric.css	Fantom.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\keyboard.js	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-100_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-256.png	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-150.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2021.2012.41.0_neutral_~_8wekyb3d8bbwe\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-20_altform-unplated.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Wide310x150Logo.scale-125_contrast-white.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsBadgeLogo.scale-100_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\appendFunction.js	Fantom.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreMedTile.scale-200.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-200.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.9.2002.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateAppIcon.scale-400.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsSmallTile.scale-200_contrast-white.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\Classic\Pyramid.Medium.png	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-200.png	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\WorkingElsewhere_Dark.scale-150.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubAppList.targetsize-32_altform-unplated.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.scale-100_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreStoreLogo.scale-200.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Xbox_LargeTile.scale-100_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-125_contrast-white.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-white\MicrosoftSolitaireAppList.targetsize-80_altform-unplated_contrast-white.png	Fantom.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.scale-100_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubAppList.targetsize-36.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\NotepadWideTile.scale-100.png	Fantom.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\ComboBox\ComboBox.classNames.js	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\stop_collection_data.gif	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintLargeTile.scale-150.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PeopleSmallTile.scale-100.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\eu-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\sv-SE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-200_contrast-white.png	Fantom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Fantom.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
3464	msedge.exe
3464	msedge.exe
3724	msedge.exe
3724	msedge.exe
4840	identity_helper.exe
4840	identity_helper.exe
1548	msedge.exe
1548	msedge.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
428	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
2580	Fantom.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
852	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	Fantom.exe
Token: SeDebugPrivilege	428	taskmgr.exe
Token: SeSystemProfilePrivilege	428	taskmgr.exe
Token: SeCreateGlobalPrivilege	428	taskmgr.exe
Token: SeDebugPrivilege	1160	Fantom.exe
Token: 33	428	taskmgr.exe
Token: SeIncBasePriorityPrivilege	428	taskmgr.exe
Token: SeDebugPrivilege	852	taskmgr.exe
Token: SeSystemProfilePrivilege	852	taskmgr.exe
Token: SeCreateGlobalPrivilege	852	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 4544	3464	msedge.exe	77
PID 3464 wrote to memory of 4544	3464	msedge.exe	77
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 3460	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	79
PID 3464 wrote to memory of 2740	3464	msedge.exe	79
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80
PID 3464 wrote to memory of 1592	3464	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff895623cb8,0x7ff895623cc8,0x7ff895623cd8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1744,12626705925606939804,4717780736579611044,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2540 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3956

C:\Users\Admin\Downloads\Fantom\Fantom.exe
"C:\Users\Admin\Downloads\Fantom\Fantom.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2580
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:2704

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:428

C:\Users\Admin\Downloads\Fantom\Fantom.exe
"C:\Users\Admin\Downloads\Fantom\Fantom.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak

Filesize
16B

MD5
3e4f17077bf68ce69f47a844960c1143

SHA1
5eec971c09530ce2ba6660a990def731c28adef9

SHA256
30e64e052f3e087fbe2d40290565b10fd5451aa806a97bcdd3fd66d2e8cc3c0f

SHA512
6ca6a881211ade410ef616a202c71a3e877e5e8fb44b44d72a191de929b5024f338e8d08b82624169432c893f8a363ff735d251a18a7abd8d7a0a0a944b1637f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
9b7222ce650f201d33cdb5168b0434c6

SHA1
0b2640f6f79d703eb7b2e96eafbcf816bb05e4d1

SHA256
aa4f190e2eaf69a7dd041faf6111afe985b8f70aa7010c979321854c55576ba9

SHA512
64ae277ed127d64ceafb9c82aae64a64708b03080e9be16c33fbc0bc17a9e0abb8ba0901b70954f17d0e97d6d74ce5e5d45e60460880dcda35c4369c1ed5c819

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png

Filesize
1KB

MD5
ea7cd172a7f4b2a946787de200b08d2b

SHA1
324b8da74dff99a9027d1fd4b28c1068bf0ff697

SHA256
9aeb90632edc40025e38be0ccf16a441116b64a7a3988485d7fe0d5cf77b24ca

SHA512
9133fd5e7c5aa1a88cff9816236e5b930ab58f56608727483a3bacc2c4409f0db7f541c641f6a7b130004cf7800880f8b43f43555c335abeb340484ce6e9f78e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png

Filesize
3KB

MD5
37d95de79ab112a9e4b1f192d8400dcd

SHA1
f848cc23617937f513023586139b7a734171ad99

SHA256
b5fc8fa29b931a1f74b884b3535db4001d2415ab8a9ae1f3617153a0a6e95c29

SHA512
8739c7b8d2d186572f1d2ba2bfb7e86079405ef7e986c6e7a104bace02a76ae38f1fe0353fe01f8f117797594637ecae1162f75a4f868d0b7ae55917545a5f9e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg

Filesize
720B

MD5
f55681a033ba2f507bd113857789f162

SHA1
59f210cf4565557424e6029925da51ca62463f80

SHA256
814aaee9ba5c91c844d5b4b232e145b6ddfa8f71d18149ea377da6f82a5bceae

SHA512
410a936f99b5960f047e7f329262b4b2c53e0bf375b340f7ca31449901c04b9f074fbdf540b1e0b3a30764e6773879123064f657522e2d227845f905f7b6ba7a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg

Filesize
1KB

MD5
d197506ddb9ccc8ea9d6e764589b56f4

SHA1
5c140bca72f09224e4f26f3d44c7b93eb2f87535

SHA256
d5d1a43d1a6c75552acbefbbfc9ae3b6feeaea69a07a92f4a84322098dbe7a4a

SHA512
2d78671de0a15676fa8babbf0c34b2a92577f2e65f3584119ea0342dfc4c1dd6ab1fe7bf829c71571dc0ca2286e1471948671d0c62ca4aa2890a624b0497a6b5

Download Submit
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
fe8d34863ddb586a5825daa08db11d2a

SHA1
a6153b90f0520e6fc27233eae0847a626a9e02f8

SHA256
6d9223c368a76eb12c1726d497168a5e226d2d99b99a814c24d072b7c88c1c54

SHA512
d8eaf3a0f69acd68d411876350d1347f2a2432869c9a120d2c4781a86ed482c45e110264ca3cf6c6ae399e65153ebffec330b372bacd3eba735569285081c2d8

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
f3a0df86a304032783a19d4e6fd20e7e

SHA1
d83bdc0d9500656ebb7b36bbd4b4a528fb55cbf1

SHA256
6109c5733ed389dbe747caf0ad019e81e12c5463acb46565066cb8c4b5720ae3

SHA512
74fd41c3cdb66fb5770a80ef216a937914c484d5bb80a0e93b9ee9b7fdbfd89e3ba24f6e3ff3218fa2cb25e81c2bd0e26303ed43a78232ed97f1329f074dc2f6

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
192B

MD5
bb7adfb7bde2f056bc86f22be86a1295

SHA1
4c1a5848d1771432b954914a37c93b338ba48e77

SHA256
f0edda4c08fd58b872eb6911bf399586c61ddf3bf687317b93e144ad7007db80

SHA512
a092c187f217000a6daf8cf252eace47b32259d1f438e67f0d580a5bc9f76704f224eedd40e3ad61753ea4c6c7ccab7426465fd764dce0495c84311a94dff79e

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
192B

MD5
bef25e63a0ae7fa012c9743d3b246fe9

SHA1
348988cba065571d5ed2249e55e28b684e39994f

SHA256
911773308cf37894f7a064f56847718c9dcc064b900f2e9870d77e6b39f70423

SHA512
7b51ab324991f6093cd141a5824845d4815832d4fe62ae6a553cb4e02ef9fe06919006c003d63ec6804b49b237e97ebc315a261ead8859c2ade92c81405988e9

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
e8ce094bf121a67658c8110fb59cbc85

SHA1
bd602e0d55ec6ab8dccb53fe98452ea025a56edd

SHA256
a56eff1a27379d24dcff911e1cc1435515d5c939c717a30c052c589b7a7fa761

SHA512
6a60b67c2a5ce76a7193de403f66a95db24cfda9fec56f2ee8f140af50d228102152df9ab85955da75d8b1e1c7c0c097b43a40fbfe9c8ca77107f0b1eb840e08

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
efd3ae5dacf073b44f54d0b6148ad1eb

SHA1
717413e461c63f2395cbf52bc8c8f5a5cf6d0ce2

SHA256
eae295f3e0829ec4a00ab0856f3ca09e964d838b7e5430c1cc312da6a3ff7f18

SHA512
61fbb8023f98518c87f5c86f054094715d7902942378c3505abcf7edc0abda2dafa56cf2cd15449e7a71360469d1ba6d1d269ef6dc6ee9981e588a2fa15ae5cc

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
76ee6123ad698be3d844b502c3109388

SHA1
f471521fc73c46f7bbdd1663926ea4907b73cf7e

SHA256
c55bdc1bdd60f691cdc3bf1ae824e207444e036e93d17926b48b2ad5d39bcfbc

SHA512
a9b744d93e83ac30a4d9b8066ce26236decdf9a3c60ded7d25c0ff01a51b40fd0bb94d958e8a52313e233b827b4d1bb15b6052024b066c64e34371426e15e08d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
101b13eb4cacd02467533ec61f5343c2

SHA1
2b8f62452ace3c0b7663853d35dfdfb189624f6d

SHA256
630219d711fa26f02970aae38f1afbb192a4836c56657cb3bbf91aec2c5d5658

SHA512
86527228c1e9f492e709390d796f568ca388e975bb33ad0a3d722358d0b7cc4cf4eaafe2c56128ddaf87590a27d32e9efe17dcd2601027ffc18ae6c0f7585a0e

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
2cae64102c3795901c9fa91d96f05933

SHA1
e638b447b02bd56e83ca797dae58126959f14a16

SHA256
055183aaf751098212b2b6e23a716066f63be6a45e1792c02d7112a18ec7d701

SHA512
6656bb5400525ac2bc059704436210d41f206d2e8a1ca8ad43f77582b8abf01dbd1920be79cea296a008379aa814bf5fb2edafc46415c5eb26517b664ede612c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
f88adfaeee67bf0e91c4a18be6265048

SHA1
fdcff48c4300250b0cde9e01099acbf99ca727f6

SHA256
b5424d36c1f09eb39273b50e96b0c6728d0fc2923d2ed02b3ff049db90259a7d

SHA512
32ac5ecb33ab22b1c093237bdc19d8584cf1ff8c1e22ff48084a37977c085022607898ea82bf06673f2fe4268bb7186acc398b939d8d32779b2cbc6a81a72992

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
d8449918c28a7038ee46cbc73f1b02ce

SHA1
b5c1772bf29ee092ac2b641a0dc0b686f0774bd8

SHA256
1ea1915fd6ae0b6682f55384775aa76e28baacf4fa11738650208b049c29e840

SHA512
832152df56f87b2708a21a4c252c9aa24d33c19f14905d50034e20b98e85f126add55857ae4d0e5760a7294a62cc276af43be996368c2eb1d85d5f309cf33a62

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
4c3aba1a8a024701bec2173fc9669d1b

SHA1
6c005d3610c8e05162f18c5ef664158f8cb90d68

SHA256
a1b419a5dfc78fd366b24b4a21c5a840aaf0079b855cc4772e5691267f336812

SHA512
ee4a177a35d95fbb87fb1a56fd08c0b8088c399bd08a3e75b338f06b9ac98792523eb6d8eb6db491fbbb724c42cde66cc8315c45f2a400cb33311bc672827068

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
12385ee849360fda649944729d4f10a8

SHA1
439d378081e2255a431872e659778bca103c043e

SHA256
663ed25b5e85311a511c9e5a098426acab38a3cb91b742901892f3d3d19380ac

SHA512
099f2fb925ee6743191b44fae0a1e92feaa5fd4ab2c1382420fca3c2b26516eaa0519ae6b7ff1673b8bb5ef6f3b503da470a474a7729f4898b05c9cb353660f8

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
59cfc77f4ad1cb25ae93d25fa7e6c567

SHA1
aca71b8a950e692ed0a16fa6cfa162a064b9ea3b

SHA256
b10dc9d7149f0bc528345fb2351e24871ca8270d45d4d0e0c643fe598542a30b

SHA512
92124ad144140590b012fd08b53369dbc6821b5d49fe6c466f6dc18f71925183ba4f3d018bd34508487415c229e675635e1193ba9571a3f5bc3bb5aaa0b35618

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
ee5c9119fea39a88cb14144f58e284b6

SHA1
37bb7d9d9e04a06bcfc9e2049b21f49c35b31e81

SHA256
cec595fb8151306eaef0613013693683c22cb3afd375a01bfc3f70fa4003b4d7

SHA512
8c33bfd4477c2110f007297c4c61cec098b91c30c82f6b1b6f5f2ef12a3bdb410e26e46b2bbe4b96292696445d0bf1139d1770ee2dfbc125f0748a46afc1362d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
0744e70b5629c18b2182ea8c0adae9b7

SHA1
ccefa1064b40f03f77c279eba563eb2e244b934b

SHA256
1809aa8f447d6de6c075f01fff66da5f8595d84ed7ae54545280687315927c66

SHA512
cdae8056a1f972518bd3e27d4b9eb395b789a26a9b3f6130202a9d78001a83d13cc1c2dab72c72a39dc1d23c2c07c965d336c0e213082f731918266f9f2da84e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
0383ef3f2fb02d5b33ff482aabc9a5ad

SHA1
efe35ba449c39be2f3158b3317e5869bc1bfbcb5

SHA256
7c616f2e15645e89ebd09202212da9bc179643c7cd1e2db30783007aa6a02017

SHA512
85ab1858f8c750c6f598e6400d9703e5a97f3884a067af3b232f2f87e0f1868fcdfb228e01244d977b1d241c8a17d76164f0deb1c5f9130daec35db8f08b62a7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
0b2731dcbf9bd412871d3f93b9c07476

SHA1
b1e179a4d9a77707ff96bdbe82d6c379eb1e4415

SHA256
182ca4b043060e8fae9d7bca6422a7952a8f4f1b75212a4170c7ef5207e1e8dd

SHA512
9745a7a200979a4628fc4ae19e386d4faa9708240c27d09db445ff1c39b9f7be0ea87521f4caec3e8803c3c60892e7b710a1ad21ce363154e9f13e2ec5bec122

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
176B

MD5
ca46ebc9efde6292aa1374d7670c19e1

SHA1
50eb1eb7fee96a540ccb4f675281bbe3d3593208

SHA256
d7ab1983a2c744054280385d0a4da4658c412100cb1411c44be830197da1a0d6

SHA512
1a5e02d484430309781a170616524fda5d8f3ee461c9f15aa5bee1b161b411e426dddf11eaaa6058da427d0919318ba83ed9f45d5d0c80ad9181267fe0495e43

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
275b822e23a8821879f4f16141c9220d

SHA1
92f047bd499e19473614788669945b3508afebd7

SHA256
fd4b43de8835a1fff7494b6e545e12e4e42e0906f37c6b31acae78f269323df4

SHA512
460ed241369c4a29b3cc7a4c405f0807357ba538e9c41fc24269d2ee2828a9f3a3ed7749e5283906111c122e4242a6349cb5f75f760df311f78afac16d244087

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
ac9b15947eb2504865c925d6a47d41e0

SHA1
36f1b631d6461cedf50978b118b67012f82a0877

SHA256
4f71100fc94ca3320fc2037a8e0a2cf6fd21dc7838c7c642c2837d5ffb405d3e

SHA512
b6c2174f36ca8bdb031d38879565b0ec08dbf010c8b85db43704e42828b8b2e11e901ec377b55b0b3e2712199e9480808ab6ffff0d423883ee4b595b86dcb317

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
f48d8d7a94a760b88fa4e567617f2e49

SHA1
f5bea4983c8c8d4e7bbec4feaa9d6695b8011827

SHA256
09628c55a74351b4c6534f1e941d01ea7dda49b7abd6bd822eaab92cb9528101

SHA512
32ce46fec63f2d8cdba3f2fdcf5c6db363f22e7f37e755261e527b5f6ef0245bafa9509496e1068478ee28be458f98235704daf624869c266cd3e2b97e1a4802

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
b9876aaa761a616abca0a7ea9cf03ee4

SHA1
b2b4707dc06d7959c042edcd6f3bb4a9dd13504f

SHA256
07b652d647f76ee4337121641ed1d642dc35511523ddb76253e182e4012ec0ac

SHA512
489de7f291ac00349c5a469939326c6be2745d25b3cdec04e2492fecbab10e4262f3ff5e58cf7feaa1ce0da640ca1be1aa05e0443b170dc2943bfd5c9e21bdae

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
5eff6f066a872ec0338b00554e2eebde

SHA1
3d65517b3ccebe812f1c4791c35f36758342993b

SHA256
49abec8d976d1d1c0de5d6d9430f13444a5628d75bab863b90a41a4639021fd4

SHA512
1dbc7a22c8c327e7279666b0433ffb8a53ec531126caee33cc729530a2f32bb788d83991ddadc9d63a042896d55cf0a3f6e8210bc19b2b4e15a97198f7d15e40

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
aecd6231ad0ebfe661df79aa21d531bc

SHA1
d89e449ac19af227bfd3f8a747e611b92e51fe7d

SHA256
4dd37edb89c7ae935098cefa2b5adb1b9f787c0c31c9f28c7aa5bc704c299b23

SHA512
af2f03fd88f33af7d3a40acb45d6294824e9ada1af4870d5a6f4ce434c3555205a84121b27d3eea93bdd21ba8ef7c703582366e9fccea2ed31e4a852bc6146e2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
b219f0372f9555a024a65b7456ca8d6e

SHA1
7ec2cd544cccbe1f1357430809447a5531f8ad6e

SHA256
ee31dafb6d3a24ab6fa4816a4f5bd015f79e2890b0d9c9ea38a6aeefc223dd9e

SHA512
dc600c710bfa3c37fc63facd5e13069583dc02b48987811c741a6cccf99f3cffdf3f753aab7be560facb19cd51874a3072edfeb9696e2f764cadbc60d1aac4f0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
76752c4208546e80b23111c9d51b7e5a

SHA1
98636da856448ceb88ae70bf0af0dff360c23c18

SHA256
ea382a6b5c92bc6db82c89c69797d2fd9b8c99bad3c9b9221441ff6d2733df90

SHA512
25ab14bd4ad00625cc1915178ead43d95534253ff1a145feb7e7e35f74a79b84ce2da57373a78055f1460ab333568650a690dcb721344ce198d8f080c01c02ab

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
770af4a87fc747f307d8351700c82345

SHA1
5150ec3d21ab58d2688391696b689b9f0cfdf213

SHA256
5dfe3f1a218af6f6886e0e186d707fbe1bdc14896b12b7b1be6fd52fc1bdfa96

SHA512
2f0262c649a5257ec0c3a80b782bbb5dd5a381982e64bb02fff4107336c9a24f23dddd80ae88420647e70c75f4ef80622d799feaea74736991766582b16085ce

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
76bf3899e578527788ac24a419378eba

SHA1
558191614d082ee3849869221671d40b66729f5a

SHA256
b45204d67f3b23c72c4a8b644d1f5e7542a04759b4e33cf914ef7304682e6392

SHA512
a482d9835ab08c6d0e43ccd7350a1381e8ea1457a2a808a1ea81fe922bb47d9e222daea9556c14e2f328c29e4571ad349e7deef0a5554e78203f36640ab4b780

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
3b42b7507513c4313e548c167531f5ac

SHA1
77453102e7e44c2885cbec6608d93101e2055355

SHA256
563dd8aaee6afe31f5aec4f0334d313affc0b14fb706f04bab9ad86247c4e7fa

SHA512
555df2de4377fd0dd39edeb33554c0831a5310fa6b46f23d3ba2dd6a0c036cec91919ce5d9f3290291c0bf5983e1112da325eaead4d10c91be147e97efbb5343

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
93edb36b9607db3e02a5f18f12a4ec2f

SHA1
55992c433d9181a6fe7f01daa7c6b9666986cd94

SHA256
f8c4cd6fa791fd8789af8ade3b04f3f0a7c11b25c47f6c66531b6ce7d6b58eed

SHA512
6f81bce45fc9d965a47affc4fb650bf5a306e64ba8bdc42431abb078cec1e629087a1d307729294b27ed9b7b61589d8889a40a7f92b86fff861b5132e56a708b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
c9f43e2380ff1a699f0abca6cb3caca2

SHA1
53712b3f87a6163978c368cb712f56216939f07a

SHA256
b8b0129a198e2d22d75ae60ec10bb904a5eb783fabdd7f7b26ccb5f60dfa65e2

SHA512
da2c825c900fceef8af9cda55e617f221ba62542e704638aa2c97bb9a9a12a3b00b689cf3734443c223ce8e1553033a81fcd6e0bd2af237f069f1f38c32bda72

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
5a33080b1421f035647bb2ee23ad1452

SHA1
6e28f0adf4aa2006028df85ae6466c3b2341f375

SHA256
36e7899ba5c623df8a60da9949699f66e12ed2fe5c4d6244011d9a3b8a2df84c

SHA512
113781ca88d7569162245938aecbf054662ae19ac2acc5752020b3a1a27a99ae1ba1205a7921022550f3d02479abdd5025dae7d6ba04795dbb4c611b63f9736c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
6cfd0706a840482e3abcbec3350756ef

SHA1
23565e6beb3392132eee549be3fe25079b022fa0

SHA256
f26a79a8b8a1c6e12777e6e9939cbd90eac150c94281c20cefd6ce68fbf93a50

SHA512
020e30b95ff06f81079f14597cf28a9ef1b59e45ebb61dbefe18c24572ac72ba40217606ee57af30ec3cfff0654bf05b40e841e7b36dacc3817583d129273763

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
f835dbf5e5dd74cc7235bb606bdb383d

SHA1
03b3b26a334496ffa2d2e6cbc245903ed11bd212

SHA256
d3a9d2312b8dc8570d5466dcbadd4cd67b6fba8e7e4b9714f3891b3f7671fe53

SHA512
a4274f79a131252f9366ae988990fad75b59d10653d59eeb3d021c4b560fab0fb1f5d4d5a4572c27ac8e9fd1c1febbde29e20edb1c305f0b02f4fc240eb1fe81

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
5082a49b5b0ea0b8f951e3c4b4174f91

SHA1
c11295952cc30b174cc0adcf7041f1a1d36290e0

SHA256
5c49a8c78d5c8df8d8ad1cb3b5be6bab3fc2f32f459595a37aa61da0a4c18ead

SHA512
7966de27fce3dc76f927e934440a78da27ed15035f4956ef25860c677a3a9773bad4fd75d71c214810204c1133696ef2eae6e6aa669102d5d994f8663ccae0f5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
7b4665865eaed6b08f058268ed420b2c

SHA1
6dd94964ce7b2062ce10bb54ff441f0cc0aa4aa8

SHA256
bb5f812fe8f58da8f524342955f8b1f4cbbcd26d4ddd96ffdcd96bea623e1f05

SHA512
52da694c199d197f40658c6a65ce8511a583f4048fd50b10fd7de7d0081e4cb688ed686cdde6c491d07237a339713550e8395c2e727d9228cc8b4071b0cec49f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
64db70017455955a0b51f522f6ff0549

SHA1
dfea93409c27b119e40aa02534084436f62b32c7

SHA256
ffcf866ab51d8f453922f164bf5cedf2e094a9ef991d5a6c7c67664938ca58e4

SHA512
e631c3ff97a70eb6e7db816a604b39cf28249f70fa20081800f4a666da7737d48332621c56f3b67dbc0b1d73361af9560497fa2fb5550fd0dd526b674244e852

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
b218ac2d9f70bcc1e3d24368e3d40e0a

SHA1
adb415d1170669840661989bec553e98c4415edc

SHA256
608a4cc09aa51e96e442829800d55b8e4c81332cb20be65649cc265499939046

SHA512
ef74d50fe4557b9b374ba97a253532e41479e9d00014ff4b7e4e9c652fcebf96353f417925f2db3b4132d015d9462548740d4b303c98dbe3d3696a87efdbf528

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
fea968f9c8bb2ae6d4f5ecb1ef9978e1

SHA1
967ba1aee10b976e4d38bddd626aead4501bdc88

SHA256
df64d9bfb310cd8b9b501827b776efa6da41f03b5a22d0596f4ffb730e2ade8c

SHA512
98d067f0ab87a543e8268998ff2ce49d0cd91ebb7150ec2a82f316371bb1759b9d2ce5ed4c112c8659e92b947135c1b2960ceeb0ca73d47deffcb8dfe0790ff1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
ce4c73830840c719cba835feb22bf533

SHA1
320a46b18a1b23b4699c9d16b333bc5f1c7f02f6

SHA256
fd639ab73bec2ababc983836d293351a2b3cd3d607d1c23d6bf56517832c1b91

SHA512
051091f8ec6e8e27ef3853ddfef5819c2b26251cdc2060c90df43dee515ebaf94cab6e0471ed425704728f17e6cad213db84c87824cebaaea9bc86d21f05fc24

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
9c02b739b4f693e4c17f21bb1895fba5

SHA1
fc63db6de3f8112c7b4f63d61d19b91355d04521

SHA256
c65dc0366837b2d20cd596eee61802985b6586765735b0c3947211e0b4a50e3b

SHA512
1083d70557bdb7868d3d648aa26e7c53325e1a8422ac95b7ea94f1727f2bceb0958cf2f6b2537087de4a1ecaa4cc07bad8b2367937da4c185c14090bdebba80e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
846c3d9d92532d4c1afe525d2513bf18

SHA1
f8a942f26749bcbfaa803e425f21ebfe2eacb333

SHA256
443642101ac6f96b67fbfa21b48a5fb2b8c9493098f57a3c94ad27cec21d903d

SHA512
faba27637628c2df05c1c16c2106a85ebee37f2baff9f6089ee52b4a551918123cbb696d46bf6dc7a37b1774b9874552a8f551815507fb5aa965faa70bbb40d3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
6c20c82b344540ddc982629ae9bc06f7

SHA1
25432df14e034ef2cfc2aba5100d6dd0d7a8e758

SHA256
b16708c57273b33d753e897251168e0b0844413289afe6f99c6d8dc1c8144a9e

SHA512
7ece3be9419e366d7e621a169bdb19b6a038b289bcfe1a84f474e7b7659d22e874a0991428471d653b8331c2391b2039d62f3dfea3599a3b09bba932ff6148f1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1024B

MD5
75136a041e7a670e3a3fb92d59be322a

SHA1
3eb1ba14b70052d8c08e56da9c3ea25a8e567514

SHA256
531233a3c6d43c69ce9b93bd819550f09cedb5142b4b56e5e844c8669b3567da

SHA512
293254e30cd9efe94e756eb24fb08b988dfec9f12252b30410024f7349f8f76ee7e4c3b70ee88c33f89a4d9d9cf0e129f494b343f1b38b862ae1becb3321f5fd

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
48B

MD5
0f92124462c05e120d6aa80f6f9e8342

SHA1
68f5998fa57c4dc0755a60b1038b569891a26512

SHA256
da4dd97b9b82d55f356fa33021917063ad66da3d35e913a1e949ea4a63ca0a5b

SHA512
15f0224a6e4e4ec70fc663cb897f52e97eb3037b61a37715b965df269f911cec5b334614eb633c7e7e91e8b7969871093f3a0cd6bc8f3d2a487e93766f1f0b62

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
9e466b4837d8431be725d6b9c1b4d9ef

SHA1
3f247b7c89985a41d839cad351cd0fc182fcb284

SHA256
2f9a5eeb5ac8cec52a3e73621e4d392f501f5d657dfec3215ccd40eec317208d

SHA512
01de0fda555d63b5c38339b0f6d38c28de2a882643439679e63cf5d75f13516b57dc90e8dfb8c638bda328fc12342e58d1e501acec8f85b92dbd5589dac06418

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
960B

MD5
16846df493521e84fe47cd6b6451ec8f

SHA1
6d99eb017c5aec08d3a7e908bbd4a051ce250c02

SHA256
69f19f2ab2f3625faca623477864766ab1ef3a21712bc892d7b2b0886585b3f9

SHA512
aefa5121601b8273cff6b79b7f76417c71e29e835b66faf3e1a67d0d38fb9ebe90320b75493fd5c4a2d9ea3e3c485d0a84bcdbfb78c26a8ecee3175cd8bd93cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d73b7fb86e64c49038c974481f7b6793

SHA1
7fe5a1a7bd92c7a0b118ebece8ef540b273926d0

SHA256
06628562d72c819c653c3c9043196fb22d89ff25e27e25c32e0ce61eeac302a5

SHA512
b7353f16e3cdaf1a5a21f880eb15d23dae634931e67bc0bcb1953399717da36cc007dc1a09fda25931fe436a9dac088e10c48be1dc679db4ab33917cddd711cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ae1aea47d91e5c815719bd397021e43c

SHA1
a29fde6d74cdbad5577a981c73df46c2fb586838

SHA256
2b08174ccff87b7cc9b7eea34ca09f1b0736d656b0da72b9a362d31abe719fc7

SHA512
bf9e3e0ec3b2b24d192a6267cfbe7ba2d0e0c8da09ad67d1455c3b32d7970bae78a3a4df65e9da9adf035d0b152eca64410c185fa138bfcd2cd5eca0a48a894d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
595B

MD5
69b97bf078e73b2ec2f29d4b17d926f2

SHA1
3ffd6be626477aa30aea6ab7163b01385d5942bb

SHA256
4de26e0730dbe943373d483d0bdde729f0a461b81b12b084dbf62687e08dd198

SHA512
a7df7c8b6a8cab18d6c702ac92e123014fbb57061ed806de9cfe05884028d543fed7a0459a61346b354e8231f8e990f76757014ed21441b4b3dbac527fac2894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
678B

MD5
aac7c354eaaf7729c023d3470f09dd56

SHA1
dcbb2397a8c4559f9e10f89317d86cd5c1f17e78

SHA256
2b465bfdca42354c1b22b5473e47c07650def7ffbdd4c1a463ed1b6d42d291dd

SHA512
cf3c691fe54030080445abd9a26f77a018a5de3f408ed89b998d0b171fdc801f52fabd8c4caa8be2f3b3cb97a7be50a992bf8ce9de26a59ff0530d0e32e58204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
24814d2c899cf18ec49ce7dea93159c2

SHA1
9612d046c85220c079d65d92c6b340d6cc5d4c75

SHA256
bc4783a1b9327494e5b72fb27de8b862e75fa1693b34e179ac7e7543777678e4

SHA512
5fa857efa175eea26f72cef21fb058686f4c71e69384affae2e849f22f4948755b31ec9c4cfcc283d8af1d4d43eb01ed3ee63bac8998c6d2e579cca08dc9926b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d63ac58df1bc5bca845a47dc76b562a2

SHA1
9a2c1080d3c77c094884e4a50d3ee1daaed34286

SHA256
9473f0e1c6c13fc1f4dde7866e0c28d0f21c8619674b42dab9a2c448d6ab5bc6

SHA512
e586172250c060df25bd1f372b1eceb2a87af1620072f02d2603fe0e21063a7c07d2079fe1ee418c997f3143e2f174105de5d207656fff6a63349441bfb48175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d52e01e58cdb8bf1d0fc4169a32d0929

SHA1
d019ec8015d2725bdfdff1a469d92fbf16139f2e

SHA256
0d7f89f7ccb5f190aed3b24b8022ed83a67637857fbe52b0d2ca14ff877c3930

SHA512
7053fd416a37a3189700ea7ae1edf80b9cd0eb067868c617f841e6ad55f34bb10fb13f180ac0327be5433cc5f2cbc2ed2aadee542144d52019b00f18e82c9153

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9ee26a54b9ddb2ddf01b73e44477a664

SHA1
2192539d446caa6f05483682b08077b15347cacf

SHA256
8e015c3036a8ce5eef4b755c5b8235fd39ea56a03d94317a73252cfc44010aa6

SHA512
b46b4864979ebd8be0c53f91700ce267b328618eeee9dd4dceed612e8632e0173850bf2184037c42994f03f5caacc089399cf1a21a7f2f4ab3b4ee2a4af958fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bf2eedc7431e090ba209300952ae4dac

SHA1
aec370e8d3ed653c8ca9ea059245e8555ba9e58f

SHA256
c368d4fd6525d4ec2a870e20b4225c803aecb32b8488998e5798380a0e7791cc

SHA512
f73cd1a4a2c97f27d739b034f6ac683c1767b9a407681237dcb5ec4bebde667f64bb0e124d77025c88a82bab3c82f42ce4f8a271d1d735f584cb9879ffb48387

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5876e1.TMP

Filesize
1KB

MD5
ff4cca655f1da06d1ff139bfdb32e2f6

SHA1
b41bff4e949e5306d5f66cf102361512fd12544d

SHA256
a449e355bff615192aa17f88aa5971cbd4b803879c668e7ae9181d3d93758c8c

SHA512
397b97264c74102fa3fb8cf86b011ba02e70b1970b6e29f9abdb5e0eb21c216ed5a12cd42b3f68ddb0868e6fec23e468062843110e6e0006c6f9c2baf9ef30ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d013e6ad71e9d14b477fb2db5c70e3cd

SHA1
fbef152a7aaa8b8ef44db7eb71a17de86c787680

SHA256
dd03a5810b29c0f758d0113aa545608aa431843aebc97442266dcda493ee2762

SHA512
ed147b4dcc3da24c51c02aef7dddafb2529acb369bcdd9f5583f9a3816cc7145f1c317bdbaf319aadddfc404174dbf2ee4f8ef03f51002a720900e08a4aef582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ca19d566fcbb95b86d69596b56c6183

SHA1
d75ea08d5f370beacabaa064f3da8531b33cad12

SHA256
ac93d426daf5d43c8befc6724c7507965135c94d7d7c22e482c98ae4e99c8d73

SHA512
aa3b8e5bcefcd4551f48ad7bb26318ca10721b4da69b3f2b3efdba1fd7755148abf7def3c3c8b564401eb4b3534ac65a11360af269b862e9b98fbad0f7220de9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c71631d5819b9e1522d3a2a8c2f3de88

SHA1
757c04b209bb835c2517c24668afecb98f36c99e

SHA256
12062749bddd0afb1cb9510db5bcc206d9c4ec61e238957a1359e96f838d3ddf

SHA512
30627aba24d6867f3a527027fdb8e2448d01605225b93ca62a66ae4d7d95c54b39a5a04c22c2c364d073bb3da653103d6171a90f42ccba883229eec8f097753c

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\Downloads\Fantom.zip

Filesize
198KB

MD5
3500896b86e96031cf27527cb2bbce40

SHA1
77ad023a9ea211fa01413ecd3033773698168a9c

SHA256
7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6

SHA512
3aaeeb40471a639619a6022d8cfc308ee5898e7ce0646b36dd21c3946feb3476b51ed8dfdf92e836d77c8e8f7214129c3283ad05c3d868e1027cb8ce8aa01884

Download Submit
C:\Users\Admin\Downloads\Fantom.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
memory/2580-365-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-339-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-337-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-341-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-343-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-345-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-347-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-350-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-351-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-355-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-359-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-361-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-363-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-367-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-371-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-375-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-438-0x0000000004BD0000-0x0000000005176000-memory.dmp

Filesize
5.6MB

Download
memory/2580-439-0x00000000051F0000-0x0000000005282000-memory.dmp

Filesize
584KB

Download
memory/2580-377-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-335-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-319-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-313-0x0000000004B70000-0x0000000004BA2000-memory.dmp

Filesize
200KB

Download
memory/2580-312-0x0000000004B20000-0x0000000004B52000-memory.dmp

Filesize
200KB

Download
memory/2580-333-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-331-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-440-0x0000000005420000-0x000000000542A000-memory.dmp

Filesize
40KB

Download
memory/2580-329-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-374-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-327-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-369-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-315-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-325-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-357-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-353-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-323-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-321-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-314-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2580-603-0x0000000005830000-0x000000000583E000-memory.dmp

Filesize
56KB

Download
memory/2580-317-0x0000000004B70000-0x0000000004B9B000-memory.dmp

Filesize
172KB

Download
memory/2704-615-0x0000000000890000-0x000000000089C000-memory.dmp

Filesize
48KB

Download