fantom | 7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6

Analysis

max time kernel
175s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fantom.zip
Size

198KB
MD5

3500896b86e96031cf27527cb2bbce40
SHA1

77ad023a9ea211fa01413ecd3033773698168a9c
SHA256

7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6
SHA512

3aaeeb40471a639619a6022d8cfc308ee5898e7ce0646b36dd21c3946feb3476b51ed8dfdf92e836d77c8e8f7214129c3283ad05c3d868e1027cb8ce8aa01884
SSDEEP

6144:gEXMZKhTuDA9rBNxIzdZgNbSEehM1Kq+i:gVKNuKdIzcNbxD1f+i

Score

10^/10

fantom evasion ransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>BlxSydM3/mw8hQS2FuckfwK+hqdxuJByTjGuW6Pkbs3xudV6ONB2KKTM/5pIdsciDfbJmhfbvFpCGsYFMD1FW2Cvgkz0F8jMZGNQtBuTPzVdHR3pyhlt4cZo7do2B8/Mzd4tv24l321YikciyFHVRJpQwC7pc4EIg4kHiPPT010rVRhkyNF8NyABUKMvY4MnJJa8qhKw8ExEVZ7jl2KOMT5aBNaadn9qA4Xjj0aLiR/hAQ9WJ/7hB99g15mE168s/hrL6GIKLXynXL1rhlyRP0DY2nL8IurcaB4ogtIV/M7AFDMXEJwrByyeQRa7k+lzIJKPqBhLGzAPNYWXwhkw1w==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Extracted

Path

C:\Program Files\Common Files\microsoft shared\ClickToRun\DECRYPT_YOUR_FILES.HTML

Ransom Note

Attention ! All your files have been encrypted. Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets. That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us. Getting a decryption of your files is - SIMPLY task. That all what you need: 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] 2. For test, decrypt 2 small files, to be sure that we can decrypt you files. 3. Pay our services. 4. GET software with passwords for decrypt you files. 5. Make measures to prevent this type situations again. IMPORTANT(1) Do not try restore files without our help, this is useless, and can destroy you data permanetly. IMPORTANT(2) We Cant hold you decryption passwords forever. ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. Your ID_KEY: N66DqyIX1K3oJFOLQSD2Ey5C9Yb95Hbgnz65Xj0+Y4NzMIblSBAkFT786A6+A46nojKvX1nD2tgE7oC/ubkeGWUDUY6Tt6W0BhiH26xlxLTQddv9ckDf6r5BSv6gLoMPAL53MMnNOv2Xgz6S4495zkoN4JCVKx92i3CJi8n4dGwZURllZCZrPi0Sa3I0isQTRr3zOMx7UC6WgNlkcd2cRNqFTnpXNpb9OpaeBYhBOlNEi7/K7qOLHZqQQc7HnQvnRURo+ybBcs8b6bGtSj38+PbABI+3Yg+ocIwDlbLFiCkBrm4GfgZ+4WQTaVfFNaOOiFfNwAwVyKn6ju0wpCiWoA==ZW4tVVM=

Emails

[email protected]

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>N66DqyIX1K3oJFOLQSD2Ey5C9Yb95Hbgnz65Xj0+Y4NzMIblSBAkFT786A6+A46nojKvX1nD2tgE7oC/ubkeGWUDUY6Tt6W0BhiH26xlxLTQddv9ckDf6r5BSv6gLoMPAL53MMnNOv2Xgz6S4495zkoN4JCVKx92i3CJi8n4dGwZURllZCZrPi0Sa3I0isQTRr3zOMx7UC6WgNlkcd2cRNqFTnpXNpb9OpaeBYhBOlNEi7/K7qOLHZqQQc7HnQvnRURo+ybBcs8b6bGtSj38+PbABI+3Yg+ocIwDlbLFiCkBrm4GfgZ+4WQTaVfFNaOOiFfNwAwVyKn6ju0wpCiWoA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
4020	WindowsUpdate.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME.txt	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	Fantom.exe
File created	C:\Program Files\Google\Chrome\Application\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\db\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html	Fantom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Internet Explorer\images\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\Triedit\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derby.war	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	Fantom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\et-EE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\dt.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_zh_TW.jar	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak	Fantom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\System\Ole DB\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunmscapi.jar	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyclient.jar	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_zh_CN.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar	Fantom.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_fr.jar	Fantom.exe
File created	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_cs.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\jconsole.jar	Fantom.exe
File opened for modification	C:\Program Files\EnterStep.html	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml	Fantom.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml	Fantom.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133247868214512060"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1776	chrome.exe
1776	chrome.exe
464	mspaint.exe
464	mspaint.exe
4240	Fantom.exe
4416	chrome.exe
4416	chrome.exe
1976	Fantom.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe
Token: SeShutdownPrivilege	1776	chrome.exe
Token: SeCreatePagefilePrivilege	1776	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe
1776	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
464	mspaint.exe
1140	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 3692	1776	chrome.exe	81
PID 1776 wrote to memory of 3692	1776	chrome.exe	81
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4720	1776	chrome.exe	83
PID 1776 wrote to memory of 4228	1776	chrome.exe	84
PID 1776 wrote to memory of 4228	1776	chrome.exe	84
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85
PID 1776 wrote to memory of 3952	1776	chrome.exe	85

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Fantom.zip
1⤵
PID:2660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9c2e9758,0x7ffe9c2e9768,0x7ffe9c2e9778
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3172 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3308 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4484 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4548 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4680 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5076 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5044 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3364 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2480 --field-trial-handle=1796,i,16875632635831714353,11156229251250594169,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:428

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:456

C:\Users\Admin\AppData\Local\Temp\Temp1_Fantom.zip\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Fantom.zip\Fantom.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4240
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:4020

C:\Users\Admin\AppData\Local\Temp\Temp2_Fantom.zip\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_Fantom.zip\Fantom.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1976

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\InvokeComplete.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:1136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\$Recycle.Bin\S-1-5-21-1013461898-3711306144-4198452673-1000\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\PerfLogs\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
7606d6eb4790558942b45b9b22c33afc

SHA1
f34069715ad59492cfbd249bd6338194acf55943

SHA256
237cd7297e1579be9197b1a6c13231db188f3eafeb07ad479ecab507bebc4cc7

SHA512
c8796447a5fa958532d964556806181babc9eac931e98dfef73279eb5e53c9922d7ef6df080a02f22f254c0887786d63a35a6434d0c6b8fd1ca032ec1bedbcde

Download Submit
C:\Program Files\Common Files\DESIGNER\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\da-DK\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\el-GR\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-GB\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-MX\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\et-EE\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fi-FI\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-CA\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\he-IL\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\hr-HR\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\hu-HU\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\it-IT\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ko-KR\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\lt-LT\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\lv-LV\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\nb-NO\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\nl-NL\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\pl-PL\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\pt-BR\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\pt-PT\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
32cb8ec0c621eb9cf54f18b6b0a6bbbf

SHA1
2f05038be415ca823a70f603f6ea755baf74b061

SHA256
9a431ae77ad452a06c017a419f79b4b2e06de2a1e15bd85386938797741038f0

SHA512
c64e58006e75b9deacb512b8378857f2f17d295b4d06024ec2c13984214c28acf3c7fdbce6730fc11c2fd3d64bb67e729dc58ab423d0f938a80a5c8d99255e57

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
cb4ffefa3444ddd227e2049602c37820

SHA1
b374b48b6e8a4f55188b1a14ea95b332cf9dc146

SHA256
9978cad2906524db8ee73f2ce2501da5ad02fdcd9ee071e4a80b0f8868fe4334

SHA512
e9090f330881549d68be6d295319ef0477089f535870fd4b5175385e26188ff42845da3fb02862044a1f6a5e93dd5a32a66622274a41c9e73322818fc786202d

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
ef4dc200e04f21724d0558bc49cd9730

SHA1
30e033fae36f3c787bba013540e72e03d50d8b96

SHA256
36bd1c17402db3c46391b103a7c3f32340551a5c9b9b622301e6a7049f1a7104

SHA512
d9343b7a225a50d4d3b78ac0bdfef60cfb9b7883c543f866a5a65912a37682075c13f838a1d24c4cae1e695e732b3230fbf953e734943a5a84d77ac190869dea

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
28d336da20516dd98e9837fbc1125322

SHA1
ce02784dbeb1329d6275f37697f2d751836ff4a6

SHA256
42963d181e02972fcfea6699ffb92f6e827a65d58e3f3bfe3a209a0386b8e2c6

SHA512
9bf9491c801032785c19c2d4fd646ab2452313e276e7bb605150bc632855300b1c6152f41b2024cd0c45bded4b3f80585526f94b9a841857d846b11516a5e199

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
b5a4ae8c42af7da63b3dce87e190ad1d

SHA1
999174e683d88fecaa5e29fcf10be31f6d047d5b

SHA256
3200c8712c555e227dfbdfd3566cd5ef2ffe0fb005e2e8bda2291e1ab57becde

SHA512
bb4c4af0be6c51bea2b65dc5d60a6da51d8267edc5947489d9530e8669991e52da4e58a91249e4a6b453597c842d1ed67eb355056a6baf81c46229a43cf8eeed

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html

Filesize
8KB

MD5
c6627429ac6c7b2e961eaad468620d3c

SHA1
156307b63d1c4d063257d4ef15576a8eef63db2f

SHA256
c4f71fec744090fdfdca47d4fbf079dce6e1eafdb08889de8abc25276145f0e9

SHA512
70bc0d1bffd1a25d497abfdbdf820a4cbcf5db9c0378f43d5b942c7072d49cf9995c5e53c8cc73a9ef6fa7930cc9c1f78f03b97d742a79a63a149db8331b9c6e

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
9ef59748e6a860b62d9dad9c564bb1b0

SHA1
2055d5767f88521196cb39e5dd47e760590055a3

SHA256
3dd4feeef6dc803b1ad6f9e1fd0242d19eceb487e559320067a32ed89832dff8

SHA512
e2c493c6ea9c558079e351a8c431ac8583d080ef8fbcf5d1c3d04dea817ce50cc5ddbde84868201e7d3a378e45dd3191da49fb703c9281647a77716365497aab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
74b9d0d7ebd04758dc6e46b010efa66e

SHA1
c1c514a5a72765e6fe05bbe24b3695b1fe2d8ee5

SHA256
422a8db13d304abfc915ed0be70c852e8ea325d4d6a115fd4f0b5910ee28a6a6

SHA512
3901bb385f593111e8032cd13ecf0fdfbebbce96fdd8682a7de9bbc1c415dbcb5fbb00a99b87b050391b51dceedf4aa6c16f4f380cfcd3e0c618d0535c95b5b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
8057238bceecef3e3c1cbf7edbfbfc60

SHA1
17189b45e1368797bc1b93d23f5359ca25a59df0

SHA256
e3cced28c1ab4048bf45d7d278b7c7a3f8f82560d2617d2fa0b71cf3780b0273

SHA512
426d447e918417d9f068e3b0f475e2c5dfffeed9df91a265871f5e395688aa159df61f056d75f6ad26fbc3215e96beddfa7b4aa0facd0e3ac7e97e98849dd35b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
25773d0936b98683ae34f75b2cbf8da3

SHA1
c9d2a0c26a7a0172da6ca7ed47e13ccc9891ffca

SHA256
6df9a5a51fdf43bd0935a2d7e094cb7d28d6e2345d3832909bb591be72cffa7e

SHA512
f3c893963eb73d5aaa8e03138ea6d74e3816e7f98b64de91c5c62f54fa5fedaa78ee61865e28e54406c2b8837149175f3b23398d5c552715c1ec630e4de4597b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c47bb997f9da28b3bae285a08f3d5cad

SHA1
6d32281b96a18fa0845927edd243c926c1c0ee04

SHA256
334b2eeb51aa96187293f0707e179eaf76e15e0ba4f4b46e7f832898104a241a

SHA512
74a023e56b73e84446ec83e95a7997ce031f6bbc1068be72e091dedc14dcbf0aa684f8ba7e7ee86c71e98a293c854b5db82d2399a01e62b6d57c552128d82907

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
25f0dc0e258388f998b6cd8a3c61ac4b

SHA1
6dd46f35f02272395d2fc10931dd2d9c5b7c67f8

SHA256
fbc25a795ab2184a8486b31e022e7957ae7c1b472f33ed02a7bb292a9bcb1648

SHA512
a6c32fae79ae4848e441e411af3c1e8ac650b0c5f78fa39490292e52b7c9d690ebf03c1ffc4cbc0e04e4d6b8252c97d1da1530cc768f3bd55fa7e7a65efd6a95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
263781ae80c00a0adca22aed02dedf2e

SHA1
cd6b8bbc37404f3b24bb844d279bc2eca9eb1b55

SHA256
b1aac63ad9197ddc494582c598802b368b8f46d66d23b8dd5c7cb867ba250894

SHA512
006be739945bb8da81c4a09b2f27b240a3204968f09078fd3a4bf6f9deefa9a2a93bc548574bb55297c30c6d7ba5bffc4d3c6816c4c2338689a7c85418478a43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
369B

MD5
d8288c39bf0f09993db41fe78af660cd

SHA1
62686f45f93147f1c99e10ed898f0ef14a89d808

SHA256
873e0e3b63f93f7d30b6c9e89ec5fb693d2ef2a6fc65435317bb78a786f91be9

SHA512
0a227ce69bd2c004c03563e2b6da79b3af5b11609b0479e3e941b8de694379ef50d79d417c7e95791a918203e303c57b0dc4d8f7f1a7de4c968215273f132fa3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
191d4094916f3c959517a115fa0e05d8

SHA1
657ebf42e031736d9e766a4f24e2820734957c77

SHA256
02dd2877e2bfc000402693df42058cfc0077001671f733b93f6cfdd7d4ed8850

SHA512
5ac92e223062474804b62be88f1206ddf2325e5dc27c7f2d1cd249d10a70417214a416cd31abf1ca20897a39d0e6634bae3ba28397b4911cc487b705c634c9a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ca82278398b7a67ae565b6b87b146e24

SHA1
f5086dab6718b53411192c5b41a98315e51f25c4

SHA256
c1648efa74affbb5450a44062e467d64ae20d7c6062d9bb642fae30e36ad830f

SHA512
1888740ad4f40549ba5cc0a88715e55677aa1afea783e91bb6a880c901e3fe5f826b0466c665d747943694b959d05e35478c10a8f4934e2c5659353245dfc669

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b9d9f2725bb742582ac99851d5f7218b

SHA1
7999c4710acacae53ae433453a829486f236a0cc

SHA256
30563827e932e95330c3a237ff4d2cdb4c9f7e514168b9b8b3f78298f8490712

SHA512
22aad95dd430276b1a1adbd2e0aa85d9e67fa390b2b5aee1fd977d696322462f044ebdedbd5a2c0da441cc5429429529c191c25fddd0f7dec90a87e4908d3b90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
cdf271a267480cf61e7996d26e19887a

SHA1
11565afcf5474710312d4a210e8541b64ede6c1a

SHA256
1c2a6e4118ae6cd047415eeb48116ee0eb084cdd19e169e78742ab86c8387f1c

SHA512
9969270648886b8e693fe039dc72b694b86a4f4cd40321cb157c8044650162da0af960033b1c9036c5ecf485d266647f95aff3303ec9cead1bfb5db3776a62c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b70e58479d9181dd3554509d44c07b4b

SHA1
df690db537ba4a54dae483abe59ae74af5919b96

SHA256
5708e9b03804bfe777016b3eb17b88c985a12a28eab098a91b34cb8654e4b38a

SHA512
6e900bbf0744afa87ffa56398ff3a488579954e17c9b7bfc7684320fd3613d820143ad805a01764fcc0eac706080b79e98315b283bf9834437a9759d5682c081

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
f4c52c3b041a856fdb21ebf8e84fe73a

SHA1
82729e1407f1572dcb537a5bf9f46d928900c225

SHA256
152425ee5f2a9effa43b39051fc65dfd2624e1acda41493d61c3765f8f29454a

SHA512
45e36e744c7ba219788d1f590181465ed1b51114735efd9163f467737b6d2b45bcb00ca9cea5a948832a9e6b38124e27b9ad88f3ea9443bbb53c5c79d91294ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
9cf6669c6db4f2aa8ef33332eca8d50c

SHA1
2876a9518310e00f127ce8d3796af7a4936ee1c4

SHA256
111e7d21dc48fd971088c193fef92ab3bb7ef9e7dc533f74f9721f57e93828dd

SHA512
c3a652f6a1ed3bb53bcff0a2cf1c2d8559bcf1d86c860e50ad41f5833a59b612a9c700ff0ee81cb9ea624af1c58f5220f220490c7492a717a23d2cfb85e8a1db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57831a.TMP

Filesize
96KB

MD5
69cf4472dcf5d6d5867224361cf5f13a

SHA1
4e454ae0a89752825a369dbc439cdfede61305c0

SHA256
994851a71c1a08360a57a666c10394a52628addb438ba9da8a546b9bf47b768f

SHA512
64a6cf5d3a0ba9b42b6487b81b115157f77573207dd57094abd9e6658a4e8098b4f98a56ba13684199e947fc21c398bbdea9555e6ee717c2ea6bd3a376092346

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\Downloads\Fantom.zip.crdownload

Filesize
198KB

MD5
3500896b86e96031cf27527cb2bbce40

SHA1
77ad023a9ea211fa01413ecd3033773698168a9c

SHA256
7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6

SHA512
3aaeeb40471a639619a6022d8cfc308ee5898e7ce0646b36dd21c3946feb3476b51ed8dfdf92e836d77c8e8f7214129c3283ad05c3d868e1027cb8ce8aa01884

Download Submit
C:\odt\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6d5938b5ba02f4906de14bd4fa7134f9

SHA1
0103a62b885064b3c15767be5f6ea1ec9fb7fc7c

SHA256
c3bb2459c66253ba1dcf4beaab90b1f28a5074c312c91cfaafc5d61f2466b188

SHA512
e38554cf7efdca3759262f164d051f0f7cd39cb7c1d5a4a781d51d57c4dba68ce18a8b265ff34954016ee32b5ebe718f47625ea3f4f40284bf6507e47f0aa618

Download Submit
memory/1976-622-0x00000000023E0000-0x00000000023F0000-memory.dmp

Filesize
64KB

Download
memory/1976-624-0x00000000023E0000-0x00000000023F0000-memory.dmp

Filesize
64KB

Download
memory/1976-623-0x00000000023E0000-0x00000000023F0000-memory.dmp

Filesize
64KB

Download
memory/1976-621-0x00000000023E0000-0x00000000023F0000-memory.dmp

Filesize
64KB

Download
memory/1976-620-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1976-619-0x00000000023E0000-0x00000000023F0000-memory.dmp

Filesize
64KB

Download
memory/1976-617-0x00000000023E0000-0x00000000023F0000-memory.dmp

Filesize
64KB

Download
memory/1976-618-0x00000000023E0000-0x00000000023F0000-memory.dmp

Filesize
64KB

Download
memory/4020-1048-0x000000001AF40000-0x000000001AF50000-memory.dmp

Filesize
64KB

Download
memory/4020-664-0x000000001AF40000-0x000000001AF50000-memory.dmp

Filesize
64KB

Download
memory/4020-657-0x0000000000090000-0x000000000009C000-memory.dmp

Filesize
48KB

Download
memory/4240-474-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/4240-473-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/4240-472-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/4240-452-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/4240-451-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/4240-450-0x00000000050F0000-0x00000000050FA000-memory.dmp

Filesize
40KB

Download
memory/4240-449-0x0000000004FC0000-0x0000000005052000-memory.dmp

Filesize
584KB

Download
memory/4240-448-0x00000000049A0000-0x0000000004F44000-memory.dmp

Filesize
5.6MB

Download
memory/4240-421-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/4240-417-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/4240-419-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/4240-375-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-373-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-371-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-369-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-367-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-365-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-363-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-361-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-359-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-357-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-355-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-353-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-351-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-349-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-347-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-345-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-343-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-341-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-339-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-337-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-335-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-333-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-331-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-329-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-327-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-325-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-323-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-321-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-319-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-317-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-313-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-315-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download
memory/4240-312-0x00000000023E0000-0x000000000240B000-memory.dmp

Filesize
172KB

Download