0386dd8410cd6d5e717671782bb2bd0061e37a9058ec6f5956228e4b0965af2a

Analysis

max time kernel
94s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
Size

76KB
MD5

71fcc50dda2c0058b80b4a2169659851
SHA1

22aacb91c980a61c8cde2bf9902cc4a57b200953
SHA256

5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a
SHA512

067514b88165ba6bb6941e791e85550ad3d7424f0cf5d95dad10d2603d3edda21d594837f8b9f172fe623553f51065dd69bf9767f9400c20c2dd15451cec331d
SSDEEP

768:L0FmBkpKjPYpHD9YPR+P+3CYOyyEStf0wmWQgoUqwo8IwGKd3ybg7lyL10XI3OuO:LOhVkR+tYdHSsWQdJ9EEJ3CmfiViK7t

Score

9^/10

persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2446) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f0l883C310jlvRp.exe"	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcpq2.inf_amd64_2115846fffc22bb2\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmfj2.inf_amd64_167948d0c94abc27\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_69b5e0c918eab9a6\Amd64\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\wbem\ja-JP\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_holographic.inf_amd64_6ab9629b23deb837\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_legacydriver.inf_amd64_c07aa9c633b5271e\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\040c\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmairte.inf_amd64_a99a7ecb03853141\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mgtdyn.inf_amd64_a6235e923dc4047c\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Windows\SysWOW64\F12\Timeline.cpu.xml	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\de-DE\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\zh-TW\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\fr-FR\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_memory.inf_amd64_6fa9664593233d6e\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\it-IT\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\Netwfw06.dat	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rhproxy.inf_amd64_7d28259fbc48ab7d\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scunknown.inf_amd64_90993a57907d9959\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tpmvsc.inf_amd64_9b03a5f041e8d2b2\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\de-DE\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_mediumchanger.inf_amd64_69ea0d8614286224\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\ja-JP\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\es-ES\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tpm.inf_amd64_154e6da862a6dc30\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ehstortcgdrv.inf_amd64_5cb0c23f45dac01c\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa5.inf_amd64_8416dd97e1ecb6dc\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\en-US\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_pcmcia.inf_amd64_92be188847324ddb\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsuprv.inf_amd64_696bb57f8e3bab65\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_ce438b6e0c5b1af2\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\WindowsFeatureSet\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bcmfn2.inf_amd64_5ebadf201c5b5845\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\fusionv2.inf_amd64_a47d9636ce0d7dab\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\MUI\040C\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\ja-JP\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\en-US\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\Dism\fr-FR\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_c089962740ea1f84\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\qd3x64.inf_amd64_fd7b06296b7ac679\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdyna.inf_amd64_d89605b6b478d768\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpsion.inf_amd64_28542b9aafacda15\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\en-US\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hal.inf_amd64_fd0ae947345ac7bf\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_skl.inf_amd64_9d9dbb01837eba23\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\Speech\Common\ja-JP\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cmbatt.inf_amd64_554d46f6008bc631\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_dot4print.inf_amd64_33c48c563d7541f7\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpenr.inf_amd64_20c8782372e47bd2\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_f83138380f5fb6ab\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\Recovery\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\ja\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\en-US\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarWideTile.scale-200.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\Weather_SplashScreen.scale-100.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageWideTile.scale-150.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\weather_2_travel.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageLargeTile.scale-200.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_altform-unplated_contrast-black.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer10Sec.targetsize-24.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-100.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-80_altform-unplated_contrast-white.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-48_contrast-white.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\SplashWideTile.scale-200_contrast-white.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-ae\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\AppxManifest.xml	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-100_contrast-black.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\DeviceNotFound.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-white\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\README.md	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.tree.dat	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-48_altform-unplated.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_PigNose.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-125_contrast-black.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30_altform-unplated.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-100.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-100.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\canvas_light.jpg	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-100.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxAccountsSplashLogo.scale-140.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.boot.tree.dat	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\Logo.scale-125_contrast-black.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\scan_poster.jpg	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-256.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\ThumbAerial.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\x_2x.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailWideTile.scale-400.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-32_altform-unplated_contrast-high.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\dd_arrow_small.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\200.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\AppxManifest.xml	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\firstrun\startup_background.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-60_altform-unplated.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lt-LT\View3d\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-robocopy.resources_31bf3856ad364e35_10.0.19041.1_it-it_f76695b559f6f568\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_11.0.19041.1_it-it_be6e6eee5d887a36\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..tifications-service_31bf3856ad364e35_10.0.19041.1_none_90397eb1dfe734e3\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-msports.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bfc432cd3cae693e\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft.windows.h..ler.wpd-driverclass_31bf3856ad364e35_10.0.19041.1151_none_dd7e43541d33313d\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..-winproviders-assoc_31bf3856ad364e35_10.0.19041.746_none_1528595196b6dc66\f\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-u..latform-facilitator_31bf3856ad364e35_10.0.19041.572_none_703d07b8bfd6f277\f\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..ckagingom.resources_31bf3856ad364e35_10.0.19041.1_es-es_887348a5de2bdf45\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft.windows.kpsclient_31bf3856ad364e35_10.0.19041.1_none_5292b41087e14cd2\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\msil_multipoint-wms.dash..addintabs.resources_31bf3856ad364e35_10.0.19041.1_it-it_837297e8c5363b0a\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..nnectedaccountstate_31bf3856ad364e35_10.0.19041.1_none_af958bd5e4b302d2\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1_zh-cn_c85482ef7f3cf368\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_stop.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-pnpdevicemanager_31bf3856ad364e35_10.0.19041.1023_none_88ae50ffd4a524b5\r\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_es-es_e994a1eda802405a\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_windows-system-diag..rmdiagnosticactions_31bf3856ad364e35_10.0.19041.746_none_7fcef65a80da9c6a\f\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.1_none_96907e39a64a62d0\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\x86_netfx-mscortim_dll_b03f5f7f11d50a3a_10.0.19041.1_none_8f8673d8f5dac9b4\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ilerepair.resources_31bf3856ad364e35_10.0.19041.1_es-es_f89aec81f9354094\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-graphics-wdi.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_0fda13c05336d1de\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..icysnapin.resources_31bf3856ad364e35_10.0.19041.1_it-it_27197398e9469dca\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_tpm.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_439f8956e2cba6e6\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\msil_system.runtime.seri..ters.soap.resources_b03f5f7f11d50a3a_10.0.19041.1_es-es_1d46016aea0f5a65\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-api_31bf3856ad364e35_10.0.19041.1_none_6c76b9f239087add\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mccs-synccontroller_31bf3856ad364e35_10.0.19041.746_none_061c4e44ab7cfc28\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Printing.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..ecore-acm.resources_31bf3856ad364e35_10.0.19041.1_it-it_9c4ac23c6d850126\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-audio-vac-service_31bf3856ad364e35_10.0.19041.789_none_030f570ce4b038c3\f\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-onexui.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_71297cd1a2895309\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\VisualProfiler\images\i_chartzoom_reset.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-debughelp_31bf3856ad364e35_10.0.19041.867_none_d631453aacea193d\r\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\logo.contrast-white_scale-400.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-wbemcore-dll_31bf3856ad364e35_10.0.19041.207_none_bfe5342c357fab0a\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..sprovider.resources_31bf3856ad364e35_10.0.19041.1_de-de_c07157ba416c1d79\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-nbtstat.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_13e49f9dadecf0a7\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\PasswordExpiry.contrast-white_scale-125.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\f\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.Shell\Images\Icon_MMXresume.contrast-black_scale-100.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\Square150x150Logo.scale-200.png	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_43128ab833fd583f\f\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\msil_microsoft.wsman.management.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_270e0e697bf93298\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Device.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dns-clientsnapin_31bf3856ad364e35_10.0.19041.1_none_30419d1265221ae5\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_he-il_0be8f8db96d74140\f\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\x86_netfx4-microsoft_data_entity_targets_b03f5f7f11d50a3a_4.0.15805.0_none_1c87165626e7fab3\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..cking-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_7dfbc39a28e869d0\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft.packagema..ce.common.resources_31bf3856ad364e35_10.0.19041.1_es-es_e34c0973cbe3bb8c\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-g..licy-admin-scrptadm_31bf3856ad364e35_10.0.19041.1_none_91af4795388fc8a8\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-shlwapi_31bf3856ad364e35_10.0.19041.1_none_ba1f69da786d33c0\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..stratorcore-service_31bf3856ad364e35_10.0.19041.1_none_53df33422e430608\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lxss-manager_31bf3856ad364e35_10.0.19041.1202_none_f31e7d867ff69c65\r\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..mhardware.resources_31bf3856ad364e35_10.0.19041.1_es-es_a07825599566b8d3\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tcblaunch_31bf3856ad364e35_10.0.19041.264_none_ab3f188d804680fe\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_windows-staterepository_31bf3856ad364e35_10.0.19041.264_none_da91f6d427f92540\f\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lsa.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_66a210ec64140be1\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_fdwsd_31bf3856ad364e35_10.0.19041.746_none_5ba1ce4020f51d5a\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..35cdfcomp.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a7d77402258aa796\DropSqlPersistenceProviderSchema.sql	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz_31bf3856ad364e35_10.0.19041.610_none_296d158b14423048\r\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ngc-tasks.resources_31bf3856ad364e35_10.0.19041.1_it-it_b155b4ab8385be13\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userinitext.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_37778d54975677db\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-qedit_31bf3856ad364e35_10.0.19041.746_none_42e9d1cbda975e87\HOW TO DECRYPT FILES.txt	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AEDKVQSIENKVWOC\shell\open	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tuslamon	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AEDKVQSIENKVWOC	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AEDKVQSIENKVWOC\ = "CRYPTED!"	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AEDKVQSIENKVWOC\shell\open\command	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AEDKVQSIENKVWOC\shell	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tuslamon\ = "AEDKVQSIENKVWOC"	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AEDKVQSIENKVWOC\DefaultIcon	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AEDKVQSIENKVWOC\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f0l883C310jlvRp.exe,0"	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AEDKVQSIENKVWOC\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f0l883C310jlvRp.exe"	5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe

C:\Users\Admin\AppData\Local\Temp\5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe
"C:\Users\Admin\AppData\Local\Temp\5840ac98a974844f8ca64612c6311e74bfaf235b06b52c91657f781b6224e41a.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:4184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
5f9736fa2b975db63d7b842d1717201a

SHA1
a80decc6f692a66b10c0ac8ebb60420dfc79e02d

SHA256
c42e842efb5d97c17f9979ac7b09b6e43510ff36a42b9a53ef8a699af86ffd78

SHA512
c296753813163411ee5f51ba4a479f69c2770ab50f06301054c0950922abfdea40df29fb8a3df0c65711535d2936278ede76d4cfe26cc7c0cdd73a32dcf02120

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
4fbce14d7970eee2cdfa87eb5d0639f2

SHA1
b066088a224c32fd11811674c7d979b2fb67ca38

SHA256
6b8dbb7f39ee702608f16c96e370fc6ddcfbb6dba3c0a6a8f863265f357e5666

SHA512
082bb86f6ea3ad7097b8a012dba5669eb38a4ad920f02ab7b46eb4424ffc1415e0c852fd7d63e4811e01e7ea6bca3d3058e3fab0c9fd6dfa9ac40fbd328ca382

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
e4cd204b90cc6999ab06010e329b64f9

SHA1
b2961c98a9d2f354beff667e19c967c80bccf5c5

SHA256
2574307ffdeb33a0c86edd36c2930530a26f6d284ccfef11d96b6e727447a246

SHA512
53366f8aad12e9f2456bbfc150d1698a4af21a7dff0db15a97dcd3e023b12f0685ebb7c177bfa0d1edf673158ea236c996988bd54e6939e655e46745612a5f46

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
24fb0fd5615e8441ffc24a6f86d1d555

SHA1
e823e70db451b00ee2f300ba690ed76175ff7a5f

SHA256
966cf29f156448a545d148f8e386efed16843283d729f4f89d5784ea790b23fb

SHA512
eda5e1592ba22201b27d501326952454d84ab90e3b5191d84c491fd5beb3ecd879ad6ce43e1836f69eef1b93e669a3839268288fb0a9924f66aed995a390e22c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
4f8502fd0f379c50d16f96af6c83f209

SHA1
334ceb0ad8c79e668ee54866080e1bd6b0b10a71

SHA256
c2d5bb73d2be404bacb80b80e7b3b1f25bcb630bc3d608434a44548b657bdfd0

SHA512
f37f53d8f3889a08e75641a8ec748d6748e6eb2565881a5cb7b366b3868ce782ab4b13893939269dbe7637246277c0778d11e0cd0b7e8a548d9fff56ccd834f9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
1accbe4f2e28e6fbca460c533e7c5934

SHA1
c8903c0011ce674179817bbba67b8cc65a1658d1

SHA256
84a8844db6ddd677e05b07297cbcc2b74eaa4ae06be1f65092b39c7e285d89a4

SHA512
cf5208c1eb702c12b4e95074c8c8907cf07d8f84da589724170d5d165b43b9fe93b0564c7fcaaff91c6d8883f79d9cdb8876413b85735d6e7396803015198994

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
80fa400ffd16a0fad6c4aa1e1cff5905

SHA1
d7c3ba3cd65decd41297ed63114394ed040365c5

SHA256
be1e592beb9f145ac8d90bcdceb4813b181f6f63b9fb6467b036e12cf83f772a

SHA512
bcfce8512d0d0c52fadc9c13a015289ed14fb8489b37f57a37d65edb01e84c54a20947e1e65ac5ccaa825a94f8c12d0db5ac87d4cbd00fec2827ecf451b8bd52

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
a06fadd838a01ab5d08b982fe9622b65

SHA1
00216bdd52269e062629e9c4f749b9970bcbdc48

SHA256
754772351083182032834bcb8861d76368fca7d9d9d9ef7428396b12e63354fa

SHA512
323c59705f32de56b97f6b7d414228e738ca395ec8afcaa00d962aa892543540850773f7a11cb8361bc55b7e6bd840406c358c2fbfbdec1b36be92145468aa63

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
1bd4ad8cd356e3f1c72a800f4ac5c306

SHA1
e4fa410eafc1dd02d8a8da52b740385e1fb434c1

SHA256
d4a0d74017a370c9ead2362ad7a8eee2962b6daf5126f6b33d27a1d92578102b

SHA512
e3da605141b10b30626f0a0f6fb37a1a0bc5e72ce60c9156ebcc0bab97b50174483a4133f0a3efe4440062f98a8f57b1fd5292e46be2171836c8c69ded1c3998

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
4d515ec9a92b7624691ef05d718e193c

SHA1
f1ed16299177bbcd296fd74bd30f4445b759112b

SHA256
bb2cece4dd1dd9b4acb91882794db8b501d2d2549ff8e64b1b6a1c5041818535

SHA512
0f357055b05c0da81a651910cc594166b2b6bdc8d3be1653445ff5209e01efacf1435c8eb29f5f9e83f56321269ba2f757a6c314f1bd2f3b49351eeaec4dab69

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
31d5fb83100007898e354e205b11591c

SHA1
8b41caabf27712d818a05f9f5c6bd4c68ee42f0b

SHA256
3941ad8a38a39ee1f136308c378f93415763eec1a85a7fa8e34bca9b01572268

SHA512
ac361d659596591dd9ba1b1cd110816440271fcb4587886c1df8f5213e7ca9a191033ccaa678c2900bb03fd3d7cf3f8fcbbf28669513c012f34eb3b9c597e947

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
0430c22a0cc0cbafb5f0c04a2a3f6d8c

SHA1
8fb0fdc9d63e9f145ccc01709a1b1716cae02b3d

SHA256
bcabf9a9be6807c86ac974721acf3abdcbb59f4d14a7ae2a204fbe2ea4db23c0

SHA512
de317b29f3e34e9e35993173513a5e159bc127720f7bfd517bcafbb28282f88cc073da015ad8bb0f950f75bc019d4beae32a26e973382320b837a0a3b312cbf5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
88741d97b28228e81805a93fa1ae2863

SHA1
48e21b7c88b56d0e5c5c75e981c00e3fe94d549e

SHA256
0bdbce3b4fca0d2cc663526087c432d3a74895ba817a88fe6438643a384133e8

SHA512
d68c9f96fd05fcd5a1c8014ab0eb626f180947b6e5ac39b82aee5a79c8a05f6130f1215dd74362579e36f2685f18759328bf8dc1c2cd83e2c2fbaa5573b04f0d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
f5e3fd2cd27e948e0b6fd5efc74c1aee

SHA1
830b488ec0ec3e9843b829ca76fec2d3a1ef1835

SHA256
75898b2085874d11ef68da1b053a20116f1b36665ac36c552f803b8424acdef9

SHA512
5b80ad1001903d332336f41093eec54f63a6e0e013be2f9db7b3897c8f95bb5f94e8180abcc079aafa0db592984f83575146d9d6c77a4e1dae1b1084b97592bd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
73373f1d364969c97b1a57690cf79e93

SHA1
40eca3bf3c848f681c9d3e9e0fe0cfecdff00a48

SHA256
27c80401d751cffdae1711a1cdf71d521e533c4e1116366cbd9e8bad3550ec0c

SHA512
a9e3ec60c696dc3b10f7fc70788eccfdbb927a04030a983e4afea3fa3fd650695dbef44d46b0457de77ed0a423e9522407fa29fa36b9a2dc855d46f495cc30f6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
4666eef2c2ee1586e1e996bdaa94513a

SHA1
883488ead0e85afa469308eb0102d71ab3f1a3c9

SHA256
8a901fa9f8f65c871307e5582d96423acce6bdbde7a821e2a18e415ee04f265f

SHA512
0dece1678b5bcc95885eda180a7d490dd48fe398ace0df34238bb752dbe39355c01aa21084da641e341b74b6a079a5ef56b874a5ccab8d0dcdbee792adcb3c67

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
ba3ce0acba6bf87d01bc7a159d7e89f7

SHA1
20a13a3423ea5435ae2d4901f69c9efd80f4bff6

SHA256
f58926969736257d83bd85f2c0d9037cdea4bcebf37d5b10e7db31fddc1ba272

SHA512
4a8b8c7bf11fb8aee3e659137c837b9c7fac83452a51ebdb18d8b10337beb9b3691f6e23fc07516f15940ad097392cdc5406cf1eb775c1983c867ce63dfc138b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
9b7762882cc6e6d003d78bb30f1581a0

SHA1
5ba7506f49f1500b88c7c9d3560fa3ebc4beb516

SHA256
2f2b4764bc2280b11786ab407db358b4d5367254ea89fd332f643febfd0932ef

SHA512
a9df5028b33e1dc7dbbdb2f1ba764731658a76acf04d866e121cf4edb2674725318cb192e1bf0976b74c85482a9fe4051215dd5178a2a66f6957f8fb24968eb8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
597f5ee4772041a3dbe7ad25939b090a

SHA1
29349a3f930f7e158b247b46549662cb92fc422e

SHA256
5f8abb5db78127a7360cb9078be62c2fa5b85691f1536fc1974474162f3bc445

SHA512
7224f131b61b195030fc8f015d78f2cf8334a55b5dd3268b47ef1319e8a2eeb2ebf0b3f26ba20ca2d17ce95f51797332bb0e51ae12d421e8886bebcc05f6be08

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
ed1d1a7f7e0e472e87ca88b338a8ff88

SHA1
6166c3dfda236824c7a9d07c5a5af45957ddddcf

SHA256
efbcc2472c2a67f3763868cbf5b3ff6d3b8f71754183a903962fe9a4d308bf8f

SHA512
a51c41e8656cbfe4cb7581ba08e3d975496e026aff9c9cbac60bd0a6019a992b67f54d9ed087cfc3a9ff7aa17ac7112a72695f440ec4689e221d34f2aa5c9b19

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
dd20979c0635a654fe41f78b5ad70910

SHA1
707d8a61ecbbb27d405071e9b0388d9041c5d4db

SHA256
bfcbd766333e210eab645396729e27a4ce49c3938aa34668a59ccb9d484f8700

SHA512
a6189fa0465b2a92876db360ae735942fecd916e9199a62201a3e5cdc55e80ece3e4eaed48e0d16b0417feb395703d93d1d8de055d47b44dba796a665ad89249

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
42e55e4ee221f9d5afaca98d8fdee84b

SHA1
f5ffac027d32de803b8447ada93628002085f292

SHA256
1b54efe2134f84d6158a013034207d7d727c278cae4f630b736ee1eb6e97b879

SHA512
95490cfa9313c0def0a3c2be06c1abeae158e5f94df3f405f6013c2d0ccdeccdbbdee5b9a586d22beaab647170f4ae23c65aa3f5c1ba90ec9f046af5451abebe

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
859fa5bcc0fb29ace3d1a51c08ec7e1d

SHA1
ed250bd6f1ddf4c8fc880730b4715bbb8ab698e7

SHA256
eb29d0847394a1a9a59600e7045581f14f292501aec0dfba8d518218207ff43b

SHA512
d018759149e621f8eebd7a07b93a5dc70452a069bf4bcb44b20b8921662b65c676df30552bbe03ed82b7d41623e046140decc3df25d8dbc71cab911e08501f0f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
6ca800b9a34a4d5cc15f19a7a0f86a62

SHA1
618740a958127034074084d831cb6c041d42fe39

SHA256
50072bd3002bc15ec2e8ade72908a19ef430f1d0e6952bc06b09a6f95a883d3d

SHA512
edf7e825a05283ddf1135ae4c6f0e485f740a8303ce8df120a9b5f691c009d8eb21b8e50fcf251e1bcdb3ef106e7fb5c7111b5f7fb85322f0d71fc9aab96bf81

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
5bdf91dd507f2b46fd6e4039ab0182b7

SHA1
0586eb979772a1f7f594d576487a6c216c18346f

SHA256
def5556823ba2a3fb4d36f8de5fac7a86df8e8b0cd1940228ed9ba5a8f5040fa

SHA512
af6772a287c16824af47a7be9206a4921c2503841ba8f90fb07a7faab7c2a5d0639a753354e02e445c9fc9599dbc5fa42b7c673803b268ff4d90d577d85feb52

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
a7d6d9b82dac0105191d93f7dc2485ac

SHA1
7924e501f7940e85420ec687148fb189988aa6f9

SHA256
dcf35f15f759c80c7acda6508ea0195f8aba646f6d096899dfd27d0a033222d1

SHA512
5d04fb26012dc8039812691660e9d02ef1441fbc5b72a9252e2da7532af21b49946d28b5d411ecffe8f495493b9f871f01f1b708b07473996b08ca357528bbdc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
b1ba5288263d22f052cfa05157260e06

SHA1
88df1bf87029c60029649018eba71543b787647f

SHA256
6ef76fd45c920da858a417505bb66bdc4ad502e07cd065fe41b4cf93d3f12853

SHA512
ad9f7283c265496b6c21f09c0b00b6d611663c45b5f5ce8503b5fc60cd630dbfbf0f741aa21a9a1527dba0eb4d2323412f402f01f099d75da27e6a895b62ab00

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
48f9b31bd3c008e0b9d201814aab865a

SHA1
e9692d5ebc950c85b51a8053740b6da45f7e92bb

SHA256
4a2213d6989237cd66a44d0ed89e2875baee4782264e5eeae1bc22fa0afd1e76

SHA512
f520ac1dd6602bf14b75e1f8645f48b43ef3d838f404ffce85fbc10dd1fb2ced78a6db35cd8d110a09235a6ec520b0795942638be14be3bf18025e607e42f9a6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
8b692a96ff15d9958218f2129181d955

SHA1
7e8191e85bf9b88fdfeef2aa0410db866adef4ad

SHA256
d086d4d619fdebdd354a17f84fe147a5df5f79ba43f68add41408a0faa1904f1

SHA512
5c8fa1c9a8faa8f1e848cd5e476b631d9ca0299756b7e7ff12b9bf97c597a577b6934b4589fa7fbc8807604c9a5a9ef63f639f471f0cb0398782b3213d4bf57f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
bc373504172f22e61a3541bf4a25f2d8

SHA1
bde2246a06176bc554816c5c7c11d83597081a8f

SHA256
7bb47a7e12101969bff596e4e75e1c196937ed00e0d6cdb0f92ba62d12bab1b3

SHA512
17f2fd452fb2eb2e89da5f799ad2de40e857302ebd3627b895c82e01b9379b79a49ac1c0c38591b933d63dc66085b37bebcf554ba41098ebcc89c4f6e981f141

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
5abb2771bcaa552de32caeab275882ab

SHA1
fab12b6dfe7f26d15b28c7db18af42e2317e1310

SHA256
79598fb76b39c7ac1dd32b84a8459924a961a6beac9ffeff959a3447f3539bcb

SHA512
0670493650caa9bb6254a4660e9a6c562fbe2f3ef49affb0058cdd2c10502b2e0c69be699eb264e5461ee69db99ead2cab32146a1b4ef19ff39e135df267f5f7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
f4e2584de148c4d0c0cc23345039cbef

SHA1
2f1e626555f7dd27bd76c382dcddf8507f8f7257

SHA256
ecb0a8b549251d161b9264f95ddfc42e1994cffbd2047d040c3bae74bb6958e7

SHA512
1831f37ca9519837e02bd4133d53e8bbfa967ac752a99eeb795ea2a633f202e730e01eb7c0ce7ee3af6e8fbf340bb17dd1b82b9188df8e94bb86c9cd069b95c5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
99cfd9c0e60aa752a3da2070022e4ac9

SHA1
a4c73b8df4ceaeb2001e0af74521519752f9181c

SHA256
83822fa9fe3731d03af6c87d37d6eed8e9b5213b657ffce36b149ba21db54526

SHA512
a5f6656fa6372b8d0c50649de6debb97c0ae804e8b0be9e7dcec919a75fd47007d780cc9745ae09af0e10c3a3108f84bc9a5719ec5a91af6ba8e29873e5dc4d7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
c1416f45b34d817691bae1b89bf987dd

SHA1
9864585c46b17a747d6659282f2c28740d218268

SHA256
f0944d893f8927e3458469253b97bb6524d6b0ee572fc6cb86166f0dbf0f8cf4

SHA512
9f8cb5125981c37f29750ab75dec8b9b93e8b031cb403deb2fb01db344016a9faddb8ab51f2adb5270c4ff2f19a098b0de2b910e8da8efb0ad61d240dabe6365

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
0b15e4e12cf16fe53a35c86372eb0593

SHA1
dd9ed2d74ae3ee1c6a354b447556087cf6e056f2

SHA256
9a478b428a3b597e4a4d00f95bfb52bab215f674fa1e2646d573cd85bb415139

SHA512
15ad04335a3d389dcd6cdc39dbd6789e6855565aae52561cad353662f93534c8bda0d0993bb0b2f3ede93815f4c416fd552ec694aaf0b59701e26ce73daefc02

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
b80d1bcc8d5041e0cc653de473c57c1d

SHA1
dc8463250e99af1dcf658c3c908a4402ad23730c

SHA256
d1b3412673a909325ffa66cac4d555e1b75b8e22b266c576252886d1fc8380a0

SHA512
9b7b1d2261e6bc2896885c01d6bbedbf4b12f0ad387302aac777774e95d08292e7baa6b884382820c8dd06c8ba2e8ea06bdc421ab79292738b19006e18e08b92

Download Submit
C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

Filesize
437B

MD5
d27cb49b8c898cc698bace285b37b3f3

SHA1
131dd0909212fbbb796e515647c492cb9b5019f8

SHA256
558c82bbe96d0bd00dd46c0bd518f2ef41952357840305d965d4dbf36b6e8c55

SHA512
d21d34ec4af4becd4011896f933b759a081913b6c1f9518062299066d4daa367376a33a422139a7baa3835e271df8b5acfb13b23a2faaf54eaba973bbe02ec7c

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
d294fcd01cc7934c15db3d683342a6a7

SHA1
6d6bab2f5735d775a99d7546437467bb8d04663d

SHA256
e0f397761268ec47c213ecd25d03adb3f6189fe0f2edacb2bb0efca6e2c263da

SHA512
afa56ce995b51c82a4e496939b9847c924ca56ad67ec37a4a6e1d3c34a9e51de5a6dbdd5407ff4a10595bb9328e39ff74363887f0e9c9ffc96ed0c1f48463106

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
5bc324402a44047800d014aec5ef6602

SHA1
3a6c37eaadfad7cdcaa1c209d155b85ab973128b

SHA256
2c5367321a15977a1e81509b68a5c94657d452c774b926447c0fbc8c98b4e4a0

SHA512
8ff1b27ad3fff586d29b725b131e0bf45aeb5f7d6f08e18191d8912d674e098b2982acd2f67f560f75b438e5d3089c3448772955c7dd5edaccacd648aa453696

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
552de1141dadb3f9f4a4fd2f2c70c107

SHA1
a25df9ce2d5a21ae9c8096af8fc4e27266e3182a

SHA256
56f1d9a54354d250e6b9172093162b5ff2034499f44b171779a97fca5e3ee809

SHA512
07863938f4d8b60c49788f95fe798f17a7073ebe24422819117179113e8eef39871e14c63e27b1e8dd9ec44d09a705bbbcf1ebe4586413e539df5f3e0b5ca101

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
c68e23b3d482ebc008b0ee4762a93d4b

SHA1
f46786df02060068b71706361c156cbefe7ad026

SHA256
705837b4b55ee1c6906195052989f660cff8ae782cd1c307d32900b9aead5218

SHA512
130adcae5ca5fbf4b640a0ef234f0fe4c8c466cbf06385944ecb9fc81588f196f5ef1aad986effc663590b98d514c8a261ca9d81297d59ded14b935e1111394f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
7f2abe151ad12bbd7abb8a019da97757

SHA1
0e821c1d0111dc3ab8ebbc2e92fa7fbe2b828f9c

SHA256
09c5ac0ad82c1cfec32b3cecf7187d727c0f514e19e46ad746af33cf4fc5466e

SHA512
369086b3745e3c95718a36b7494de1e681b9da2b0b1dfdc182976d898e868c7af6ed6b264a25939c23c6de4c36390b3bf19a86dd4ccd924919f4f77ea592133e

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
e9b31e5555ac7f95e340f681066a480b

SHA1
63907cab1ab5c471a22867b497265d8df7f9b9a4

SHA256
1ab9798cda6fe81ed28bf22cb0625d1dcfb11d0bfb895ffa27bac3cdb7126746

SHA512
64c611d3a1125666e9314f0133a70ac1f3e25266608303bacc377be6820bb7a075a17e61305ac953cc3e7bdf6fac3f1d9d5a1a123d8497ea43bb275eb005a756

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
2f2436735b9d16bc801560a671be4ad0

SHA1
b87d848ea270e665aa01defc5275071ad391fa02

SHA256
81b5bfd81f05209edccefdc6ce02028593f1770594d594f184ee0a8ca0782cbc

SHA512
01b914fea423c258ddb6177564523aa9292fb775faec970ef65b8c95a784c7941d9b4568db08f12d9d60739e2933e3ca3f1f78badabff21fae4ee5326bc513b5

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
8d97c874d47b1e8a1c20137539da6607

SHA1
5734c08a8030b4b0f5bca58155e843de26de0cb9

SHA256
3ad9241c19aaf0ce029879509f861307458dcf43cc433bef227e25bb3aee9424

SHA512
db8bb3790d5ae778e3edb3973f186ab32afd0046694986466269b04fd8c673d0361d8015ab7ced0c101f338a124ed670852d0ce589885153373daefa5da62201

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
4a890318893841e2acba36ab81181144

SHA1
0439a06eedbe093dcbd901adfe72c6ecc0bb3eaf

SHA256
e8f76b1f25767380a6490401a7a3ae0ad57faaf0dd0899ba50f49bd53eefbe80

SHA512
69381e12dca11777be4129ab1ab0ea34424e63e75dc16a90a3b9998802d30e5d8ff3f2bc157bce9eaad8c2857f7e315429cf5efa455dca5e3e5c06e3c107edde

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tuslamon

Filesize
2KB

MD5
b4ea43541f6574b764c8e17ac02e26ff

SHA1
64562704821441e99c95dd33ed86aa31f42f6298

SHA256
0a9575ed3924c8055a0f83bf8974f275091a34b169095cb53ae7690a2ff08435

SHA512
f1cac9eeb6fb205d95312b7fe9a75403e34f1e8a132e0b96241aa358ea5ef5f56e6d59699a012f4b768c070120d2061609e34453a90455dae66996fdd598003e

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
5c7142d6575ee7f16c871e01dbe23e80

SHA1
598620e94c46a55a2168111aa0ab9f194f43d0d1

SHA256
022fda187ab2ff0adaf3a003996a62d0004dc93ca87a5a89709d83bc9314e5bf

SHA512
5c30de437bde5ab659044b5a997770e99e32cf2d684f51d4d079a3f2dfa6b603646e5256ba45a87b3f2ddc24aef4bbff28068951f9e693eb3f3fb2545a0a976b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
c1adb3a3e669c120b2d87b76dae3f981

SHA1
d1128b0fef763be190bf1dc7a7cd1b1ef97b1aef

SHA256
6226622ab2d0af1498bd8783eeb7a7653e2142212d7cc41e5333c09fb8fb7d68

SHA512
22709dffda83b6d296b67fe36f71ccf7b7640f3511eb3e2a84e25b48402901621f3cc89169c8e27488ae323e727e69025ca414cf410270e204efb046c5248d09

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
1648ea01d9b4447747f45541462b2dbb

SHA1
a27fda3260db8c4ba78c2388533df2266f68285c

SHA256
939256b5aa4905540932e2ba45b67fe0f9c8ba7135ec16be8fe339d4ba4b9b55

SHA512
a4b1009159b8991bb69cbaf71be366c7b362d3066c483930b3a73737dc831741cf93a866bc04d39235918c34296afbe91df752af8a541165d444a407b9abe056

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
b797e84a2f7e2dcd15ea50944d81fee1

SHA1
476cd47062260820b14ddd8acfb920d245bb2a8a

SHA256
8bc463da53c44e18119310b2d1961eb0feb61790a1934a8da95fde2142ff4656

SHA512
ee6debb336fec0ec852ac738b41808ad9a867ef9a372c86ae42b4eafe5ffb58addbcdef767963c8a982f142492f8f8b5cd56ca763e2e95a6c02d7cfe000852df

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
6569de14e038af4a7ac8d8a164bf1c32

SHA1
9a392457dcf4b5354eda7fced6f8b03adeb3bd8a

SHA256
ee89961848bfd66bf7b34227211760d545ab4034fd55d97ff4137a369ed3dd5c

SHA512
e844e93a1b6fe63427620e99b8de96c62edd8ea56002891cf2492d22352ccfe990a875050b378dda7271466fa24253554b76745760bc1b6e97ac3c23820c2cd3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
52cfd65c5d5eb5b2d72c896e559b1a7a

SHA1
d53114a5b93c2b4c9d04e41ce1bd832b4695d8fd

SHA256
29a3c7464e46503881972034ba3de3902dec3541f8b8cf8e6417e50c9ffb88df

SHA512
2c9168cd181178c9fb3f73d12d5033282133570d31e691635af8d6d22d8799071d16fcccda725a8d546cf4f87682c76028e7471c7a3a42717de6700a3241e1a9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
89952e29b2c56c206955e02dcc885ed5

SHA1
51a311e63033f85e1063425dd73f7d0d8d0eada8

SHA256
5bcb47c66c0115a13d396bcfeb3309645a0bdb7453cb4dc2050711d3e370b265

SHA512
6371a597f54cfdc6c5541faf348fae613a2b08b7c7d6467e42fe019b3a8350dbc4455483f8f49c6599f4f8075a4c471e7352d1e89f98c46050f6227cece6f4c4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
d5ed04e40e01e23f269ad074828f7de3

SHA1
78ea1cc635f23bd90ae6cbddcc601cea8797b563

SHA256
af7e2e085dc852b7375b35fe184f7dd20a0e9ae7a03b3009d3e7b5d8dca4d6fc

SHA512
ef075576a60ff12f4e3e03a63a2f2c8dfb69d551f36ecde06473025ff57f7cd74fde1442319c00af9b03c9b8be976b98a165bee9a91400adcd5ddbf35481e09b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
06116113d684da403746e9dcf2b20289

SHA1
5f163e1357010bef013032a85fe6fc958037ac5d

SHA256
1d7d0779593ecea198c5e8f8ebd76f3353374d53795c349b32f75a8064b31199

SHA512
e27f96ba2c6caa0dd71daa80446c54c0e2bbfa3faa689f3b191888c73d437f13372e6bd002fca91e42d3fc55a1e3d5b4b787aa06f952c79d57521c28c48b8950

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
74b1c220dde54c19d15ee9415ecb3538

SHA1
daccbb3df6a1f02a3954928abd27a649db9993d0

SHA256
88bb9cac2207c2649381455951010bae123c3d0a15789a236853ab7ed5f3c25a

SHA512
87b0de1b799c1a061118400bcdfaabbe150cc364a7c3dde52df84e3f542b56f4caad2418c7d8e612f2e477bbd5ce8e410efcae89ab3811bd5b29b871fde9360e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
1037c41faf0b9a6654bcab29c8f161e9

SHA1
c68c9d44609a0e4ea2477f7f7e08cf32f983df23

SHA256
136c0b8b27b9bf18bdab4c8f6b7a003f6e598032e34f91443122982c6b94ad36

SHA512
aa88c7a61ffe07b0c3d272d24c84e26882ea6d7a201c5ce71afd00e64cbc89546bc9e257f4788984517f4fec229e9e0aae97a54f06bd58292ea29caab922c95b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
ac7498a2d253db92ca0170d2d1333ed7

SHA1
6b161da6080465a2d5faddf57165edc470f9d053

SHA256
e832fb3c406772f5709548edc669f98c9e8fb445376e336546f2949b043f0184

SHA512
b7bc0dc591164f246c1e9938ec20ba13eb64f0303da1667ce06072d5a38799841f94a186a037769703ea95a04a7b4b539863a56f005eec3da981308d53d255a5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
89851f9c1a71b08e3bd994b70d5d75d9

SHA1
639df0501025dc830656d73735633412c0629ee0

SHA256
764226bbe4ba635d5ff50822a2649e9e29c2889c6e81bb032b3f8510ac2627bd

SHA512
3dabbcd03968ec2f65976c43108199e6be4f485619226bd467f6ffb1e090c9d988b762e9b5fbe5c32c2e2c524ad2817b8ead8cb6bbb14c9f2b4fc6799e16489a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
b5b6e7f97d7abd0d2189453b85152d0b

SHA1
45743b6928c5f9b93c6c07b7365f2b9139f9a899

SHA256
117d905d4fbb392396d0696303ccc7821942b57e3ad63924f4ae9d296145207c

SHA512
48e7f49200507198ed76010eef7e317749ec5d75e04de5e05f95d6ad17b97b766ea5aabf8b2d9e7589b6ce7ef6f404a9083c76b57d924c0329487729abe502f1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
ac6b45c9d597affaf4742987782a0d11

SHA1
c5132aafecf0b2c26aaba9b1492f466192d78327

SHA256
71b141e8ee4990ab66d8ec2bfcc747a6c1515e3e94a8b203999e3338e19ae3f9

SHA512
7016e50152ab9e43da4ef67b7c0eb666f7c268283328ee87a2dd2dc714243326586be506fc54a2634a5174fce4f6d6a1dada9bd5e7f8172569371640fb7e1335

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
a31a012524a78865bc03f4662883b880

SHA1
e9162f46ee5f90d203c2e370799cd93ee034568c

SHA256
4303c92483857180d77e4e825ed3da406b7e848ab6fefa65b241f3e21e4c616a

SHA512
cdfeb3873f603b95bf10b1f7bb21e4668111f155da24bdda70273a5dc14ced94991c0b21287f73791b9b87aa42881d29977ae5b0a82568855808a465d8e91691

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
0e73bc81311c38650acc3edde4ca01fc

SHA1
28c81c5e0a938b709e37f724a71f0f6ad5907082

SHA256
17ee4351b4b82873594a47dd44847ce1c8e7a08845b311d90181fa8117c83042

SHA512
a7d8ceecd50c704cfe3df8a377a4822c6c2b174e3478325288e991a267433e981cf6f547776dfcdaf8e355bf53b77d891aba6c5ce64043b60013c12cdc95c61f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
4e25d7516eddfe9830dde7b8aebd68d1

SHA1
52ba904d21753d1c03d5e61a4f42533e538bc856

SHA256
e095b2d9a3256fe963c369edcafdfeacba21976e62f0ee316fc44946567996bd

SHA512
c45ec08e6d784f09e82f128c813bcefa505d6bc3e2e3fe19db5b2ac880a354569ef28c0a6c96e812947cd4fcf69b9fe1b1c0c74addc6e8f1bb95a4570dbe2dac

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
218a5e9758e657ec056108f4944ab676

SHA1
d83c1e98a4894a03edbe525282e670664707dd7c

SHA256
342e50c900df7bdd53ee05f1bef6a1bc7bcf34a1222899d98a1623fb5190f671

SHA512
70eab00a4b8a9f4ece69bca2e166b2cd309e08a733ea987d714f4874db4db496a91a7c67a988a8e0578f3e834ab94c8216bd075d9a6707d0ff26db2b26d41ee8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
243801004c819722dbfb1f54378a165f

SHA1
ae60603f1731c56b19b80e2cf139a17137a7b581

SHA256
9ac3d55904a2c25a5a034edfb3b7c103598a3f13da8eda042d55b14b3c8aa0f8

SHA512
a604309cae26bdfbfe69021ecb93d97ad6306a9c62832aec54ed5f4417a74c4becce2e5465c9fc400f124804f5a7fbe1a8014f2f6b3a3166c2a3de176b5af8a8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
505f8a2110ad035b63fc82e06dbae81d

SHA1
94d56bfaedeced428cea0f3f94cbc4f7c8930005

SHA256
ce1290d4a7429c437613c13d8a8d7685ee738728a51ec67590e5581f25f25b25

SHA512
d7f94f4253a35946a518292db179ab6e692ab408a1051b1a85c7016da60c542310074af2054890df84fdf7a741304725d7f0e8a867aa382972be9e9c483d1fee

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
241b3c53f8a6d20ef9b68dd7e2aefc23

SHA1
664d923c5ddcc994c51903e39d87ab11d3f4301f

SHA256
2c02f54a0e8fbe1e6fff7551b578a0eba3f80c29ff480f45e2a294c8508b15fb

SHA512
886ce429175b75bc21ff70f2cc2bf8f3af3d389992d1cc4abfe0dc6a58471c8341a6ccb9b8a7ac5a65aa0a75943cffec5439d531034e6fb350855c8a59183a5f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
d61e3aa042b50bd6f3c4200b96d1ae6a

SHA1
0c21c7056127d220ab8c158b01876f1b6889a105

SHA256
e2a6cf117527fb60825882074dd3640c398999785be49e969d0b4cf807cbb4da

SHA512
bcce29a30d60a98c28c86e13c580ea2bc282c2fc597621bb2d33f18f53266c0e88d21e74e8a962f1af2068602ca3f9776533af8c931b96a1925e6dfa6b3bf9a5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
3eb45647952bef85d3b3bb4ea6963214

SHA1
338a423a3fe72585782e27e5d8e43d885481bfd4

SHA256
333758ffa7fd8b71ec26f20a3296852754257fbc77e0d70d2cea75df9b1d5aab

SHA512
413ddab898d4a1314c05442bf2a40beb601bab35d9051f3dbc15d26af40ddd83cf3f5e6d056cbe9c147952d4e504668dbcc3c1ae84f4a8e7afb5ae1d87a6ca37

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
0eef49290322c4b2de1ed553f9add5a3

SHA1
867e36b46b94da6c3b81ef51fb50914d5b2349c7

SHA256
e25003c8009ee805ffefc606c93fde8fe7d703a2c355b23d24f9efcf6bde4a89

SHA512
ee6dcefe3bdb10acf5e7320d1d77e5232a17b6e0bc0d788c2317e3d61e45d1a729407711f7483674840a3e4b8e89b1ceae048a732344bfcdc1d55d1ac31063a6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
9cdf820f90e8aeae8bd44c049927e62b

SHA1
9b995cb37a402d6ec8bde76b424396faa42a4b99

SHA256
bf22513879feaa43646dc99837594629828f475c8a2a465df920a171c1fd92ca

SHA512
eba016a4afdb811856a40313d3fb6030c9de365fba5aa8a541c8ad592374c238a5049593bb7e385b2fdbc535f5f089f71b1242cc97652d5846ce3eefcf69f276

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
656ef87062c49c15977ff009c1427028

SHA1
312c86fead1a19715547ba225af739a8a8093e73

SHA256
a5dd97b62707b4c19b0be64dc6036d04e9efa9e219225387b90c684bf36f93a8

SHA512
811a13fe82d4c47d947ca9b37f59fd21ac64d10426b3c096198bb182f6ef890d5254ed3134dd5bb55ace89a71b0e7504eade7c7e4cbc210cfa7f61ac096dbf01

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
0aeb8baf1ed5862cc6c1cdc0854bea27

SHA1
be258350e41e0db78d20b5d7c2aa415a5e7e04dd

SHA256
9c1f6d8adc9cba823fc632d9244a1327f0c7acf6a0a93102c3f361f2f971fcf1

SHA512
1aa2fba4d51af555a6074c48d606a2a936bad00249fd88e7d27e25f7a4c791e3696c2d64bcd7fd6bccbf64ab138e597fc0e74da71a201f3e997aaae3e570e530

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
ae254acebd0e32826aac124c91d32f2b

SHA1
2376f6faacd32309cd559fa9a481f1e033a301e1

SHA256
4e08dc5b3a1a82cb7db8f204790adbe829feb19b014ad45205a9dc7de341536f

SHA512
d57e4c5322302f888cf9cf5bb594f3ff0c94967be58902e5452e37385712609cbb6314e992719b94aabb4917c5f1f5ae626615d1971099af5affcc5ab2fedef0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
f4b13c8db0922006daf30e4b28926c7d

SHA1
e3d6ccd60ec599218a36e8ea4e46967f2644a95c

SHA256
ce2140b43407b9610fe4d71354d39b62c84cb51d2a7a0ecc86c7634ffc31f08b

SHA512
cf7fe027c3cbe67794f3e8d28e44bc7cc8ad27739e13b76cdbac9692a38bb3770e1f9256091f49995e67cc353e791826a1030e9cf96f6238a0d5706d3bd6d7a6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
42cb49651fdd3679c797ad2e00b519d8

SHA1
9833a59279c73b105ae0849947607070bd03a84f

SHA256
2d07311ceb52e96153c47fcd87edc3ad9c2d998e8f04e589368944f85559d97d

SHA512
1363e46e62605d2b320b41e6725e97b76aa06b0a9653d0fe8cc5464c95b316b0d534c563363c5de7246ccc623c10c1e0a805be66aed2af70202e573bb51640cd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
368cc68eb824c890ad85183483108fb8

SHA1
51627e5387a9da0dc48c7a3e454e59c33925ed4f

SHA256
cdb583d4eaa50121f417a52083d471e137bcedffc29d6f4b3f81d69579017353

SHA512
7bf95b2286fe9a6140f4508966b4942619a24e264d069e1f536859f63716c035ce9e42aa5cbcd6e9ed1c5c1517b698670e95ed397ff7e77208ab755913ab5132

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
6899cb3e0c2b9be0a8424445707259af

SHA1
a6fbc875d6acdfe8e2c6131d437ff2983124e5c9

SHA256
1f895948c9e05846eaa93e15b8ba91e8e911d1c2fc082529cea10f5f2a994eb0

SHA512
b0782c0518837c0fccbb51c821063997da198e8fbde0f08964bc58616d577d958e09d4ac1ba61e4bffc100b382b9f4fef17419e1a85950d519b519be4c18eaf8

Download Submit
C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

Filesize
8KB

MD5
b673271f894e5924fde2d96ef55dc458

SHA1
2737a6dabaffff5528e99b0f501e8db269be1d76

SHA256
bfa23ca06d51e89d5a410bdf2df262723ffadc3f1c10f81655684d11ee918c7c

SHA512
da5f7ded5c05daf6f1e438ae706f6e5debdcaf31a1a0dd9121a1d3153836df516d2598cefd92943c8e4ab5d95d9103903dea49a31e7e6ba5a5da7dc57b0e7c43

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Filesize
512KB

MD5
4a35f61ffe9fe82d2aa89e49d240784d

SHA1
73e7b697a4149ced4a1d0edebb8c139b7b8df15f

SHA256
3a76046f1ea5265e350cca6d56ad2458318210432e9855b7ea15ba966c52843c

SHA512
c99de5001b40c4bc621d2b90a71b389d8dbc04ec6402b2d16b477af768ffa838a3dbef9b38594dbffed5810cbcd6cecc496d4a41b79ba2a164e8ada1547eea50

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133573951755700946.txt

Filesize
77KB

MD5
b3dd13d7857c0b8996057395e4d277de

SHA1
a80c2ff57ff9fa1200669c6a4af362c2e219cf28

SHA256
c756b9e1e2bbfbbf8ef9c21d9cc7f30c567ef0d3d5be14ab46dbfe39286808af

SHA512
2d290fc599db67cb35af500c4f16b3dd5fe7de17655d652a76278b7e8c0a7b7c4f5b26feeb2eacb710f7d7387bd1b0bb97588c9b0a983c23ddd9fc10b2b88360

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133573952277912752.txt

Filesize
47KB

MD5
46f629661d34c9d994f58002678bfae2

SHA1
504c344c8eeae33a163bbdeb28bc54b027da591d

SHA256
3bd5c4f20998f783c16b1d959ae8195af7bf8f74ddff0ed2d16bc325a48c995b

SHA512
212964a5a9755829fae75930e7bb4df2cef9199b406eecfe11073fad8bcee730da7e79ababdb5c357e48f9b6c8e59c6fc8f674e6b26481984ffbe9cdc72c6836

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133573958620101981.txt

Filesize
63KB

MD5
acc7b9c4ce5e34f977dffa2d67fdfe90

SHA1
ec36e40a3c4cbf6928f81f5df668694821512d24

SHA256
a89dce73988b9826cf0b7c609581d2a0595ceb56f9427892c6677607c226828c

SHA512
01a73e0ed839532a9627ea8e976b6728d707a24d8de1f0fc1d4f5b5ec87bf9620d4a113abdc78b2a40fca4128545f5958c28425c89c6dd2727d397d9189da723

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133573969828934593.txt

Filesize
75KB

MD5
60227c006b5cb962374e697b51176e8e

SHA1
e4fea4d0afb0aac391d033b505bd25fe19b5ab42

SHA256
5d3a228db4b184b29e5451fa1ea9a6a075e2b85573dd4c4588bd368176e9235a

SHA512
9ef3513a87761e2932e81bdfa92eeffef1bf9fb7291e1cd52e38233cba7737093ee9b94dfc01c07bf9428fb0ed90883e892a2fe7416c3783efaf3ee40f2f794f

Download Submit
C:\Windows\INF\PERFLIB\0409\perfc.dat

Filesize
32KB

MD5
b024c1d963bf67fc0256f206ad522964

SHA1
b1792c0884f8776e7deb566a88db08549d0c2aee

SHA256
ffd83dea9cfb929fe5a7e31c7f60fcaf736b7cc91434d11105bbeb6142522ad5

SHA512
40dfefb2ab3b4fc6432f749c4f18ef161edb4220016a4d6e6d274b18e16712d0f93c022c6cf591740d5a26e1d7ba620cf6c54e42eb511c029518b89b0d649335

Download Submit
C:\Windows\INF\PERFLIB\0409\perfh.dat

Filesize
290KB

MD5
9bdee66e6111d2230909eea707c3f46a

SHA1
a38c20f550149b9067df69dfd7de4c06b083802e

SHA256
3807660585991e3f6657c482fac3157ab0a3449a7ec1dd93b1d3ed4d9efca77b

SHA512
55d0124ed0624f6bdbfbf0cfb25c922ab63102d2c6886c109707396a4e1dc282148d332d6bf95916305353acb910a8fede30f80815726ecff7ff40f32d6b7dfa

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml

Filesize
317B

MD5
2776e5bae68cb4a5d25da4f5d66c5b40

SHA1
a1bb6df1d5166fbfb89afb67159c34b6df2835db

SHA256
f11999f3612ea794f4cf4fc8198e4afbd22bc8f104ec9c0033fcd4fc3f6bc6d4

SHA512
0fa2830f275a2ce3342bd57a5879680b1222ade9479c5c740cb6531f1f3a3a1c80eb39debc8ce114b263d6415f3cd403422af243a844f2db6d0e9608de35e046

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
e15c5a6d6d7f64c84a0f38e88ab959b7

SHA1
036f96ae9496100c506ed71b251318433acab8cc

SHA256
4c8482e586f5610ffe540fdbc0b9943e6ba72b1218bcd0cc7dc6e5afd68a3a4f

SHA512
8b5fc97c2d8ce10a01c5ffd6af0a0a5e358559457b5ec3f9d22f5e5371065751309b7831482180c41f10c8de597b8b6e69015af225bd55a6f76772b3794ce719

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
157234d4de21d50b95af771d7d67a72a

SHA1
d5830599343f4abc48a72a824a96ac5173e883ee

SHA256
56f00ef372186aef3c27e7fa625a8b8f4d7065031157acb619ccbf06e9db1536

SHA512
098da4f64385e2759115c2279be7cf6dcfc2d590532cb5f129bbc81ea4fd5dd7a6ae7f850e11530719ea685cbff48b691c3ec38b8182a4a3f46895ae49d9314e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
3916c0b3d4b817f10a2ced16973aafb4

SHA1
614bcbd03710429a271b08406770c312c71a2861

SHA256
657cd847265cb55f5bbe8fcd7f29adf9edfdb8fd3d1bc2b9db6fb835ad591de9

SHA512
b365c286f1591d598f7929e94e44294b39651f0dd12c772804cc2c87f9543770cff1ebb693d399defc6bf472b184f4f33b172766f0423d65a40007f9847c68e5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
5a3d30fcf10aca1651aae06c2ebf8de9

SHA1
725e88d21a933aefa3843b826c5d473747ee694e

SHA256
99d15dfa10508da840401431591da99b534cfaf517d4cf7216726c4e8f4b67b0

SHA512
7b0a3557c30e4a89b70faf6fa4c99e63d7d7f6d3bb20de823d599c36a3ecb7f021f56885288be2401ea34b9fb910e11e01ae5b9b390b520234e57f92ddd2e925

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql

Filesize
24KB

MD5
16701c6ad7051c632aeb6b2e0cbe8cb0

SHA1
979c81028a0cea57bafc145405316cddc6418202

SHA256
9f28e588af9a663fc19f248317d3638af390991cf675b800b99d1a2c16076cf9

SHA512
6262e857afe9a4f9246a741dd4c197b12a9ed6e5e961f410fe1e71432d097acacfea6e9b0bf20d6b57c400cb0ac110dc91299c0c6b9fe96fa0a5c046ee337467

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql

Filesize
54KB

MD5
581da46f681213a3954e2a559cd470e8

SHA1
0317a492ffe803c078ad2c2ba375aaf3fec711ca

SHA256
ff0b3af537c8d6c490459347f3ed946ebe58af0f74f46ad481c07594656349bb

SHA512
20968baf8c37cfe8553948f20e4789caed34094b6c497146ff894f7e4804b3f6efc6db20789a1079ebf4a833588e29ddb044cedcda3fa7c7c366a6e59f361ba6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql

Filesize
51KB

MD5
e54e43302af3c3be45799dc018eb386c

SHA1
1c6b183209c876deee26340c34f69abbf0dd4175

SHA256
94bbfedd69467ab61ad950047aeac81cd9e02b694c1edf1f41bb5ceb3913bf1e

SHA512
96a34f7de91aaddfa9d2eee3926433dca14fc9577e21f3fc79cd585066772fc3ee180e2f93eef302ecdcf18ff4541ab1e57c1252bda2e99959be5bed91b1b14e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql

Filesize
34KB

MD5
78b25b58dfe7bee20dabfe3828e15f1b

SHA1
2f737fec8be4450dce35e610ee0916622d46bb32

SHA256
40651bc8093ad4e2890b55db6c381b18a31de58d1a281eb9bb37df0f118a8aac

SHA512
5936fbba83def3cec5248520661c3530286e3474c2492b8ec7b43d8bfd221c9e2a7c868051050a0f381f1b89b07897873a94608fac9da478c90c81d8e18317ee

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallProfile.SQL

Filesize
20KB

MD5
100edc7ff93ca33c8c1f7891654d4ff2

SHA1
a07733163b9c30b540fa3fb33b5dc94ee4ce7cf4

SHA256
f408157d2f48714609db195d20a43795542148070ba5c677a817ea491cbebada

SHA512
828a431a2fce62b7c6f8849b702e001f5030b4b459e8ff25584dfef23d45e3d588a3d9cda1226c966b3f00dab0a4abd9d36b4cb1a334571b262f8870b4e4b0a9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql

Filesize
33KB

MD5
1aea4802db95e6a2e284df6019b12dcc

SHA1
add3260d380af0e74db75334d582c8a9e4c39c8e

SHA256
be65639893e8b0c8a4fc24a98a2113bc9fdecf447dedd5f5ba0c199036ec4e25

SHA512
477d24667cb91fb86b7675cbbcaedfce99e2c4ce88fb575b24aff9cb87312fbe092f30425c1b417f37a45fef618ff93b6695f7eb7e135cf8ba0e67bf8c0c0362

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql

Filesize
50KB

MD5
d24a77a0d1fdc0102c04d2494f4ed074

SHA1
c63bc4eddc44ebe5b702abf74b005ec8a118ea40

SHA256
10b5217dff6de7d29ae8d3ba772c50f5bfcc08f5a29da8273253b8c6ca47c5a4

SHA512
802a168909714326aab52dbbf653e44fa18094d904e74c37725c9fdcd9a039cf6834bcc459f48091319ebfe07aef8ec725be03c673fc99ccb28e95f36a722c3d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

Filesize
52KB

MD5
69f3284a7ca1f126f8e5f012866af31f

SHA1
3225384cfc20c723c4a027306c30f4adcf6b9446

SHA256
a4007b51386f6893651c8b25e4be5e0d991497f868b6e1e11decf6f0d056c075

SHA512
b3ad566813d96fa9b683889f72bd8bdc197b2ff079915a5fa90ddb39eff9e8b83805fe344ecfd7cf5553fdabb511787c6ef3ed4cb27778c022fd0480101b8969

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql

Filesize
6KB

MD5
c134acd6876404ef2c69916f3d1751e2

SHA1
ea180308e08e7365e0805ac431a702ad6f39ef48

SHA256
ec5f2e2dfa019364a049b088ee4bd574ef6a06c73d1c5eb17708236ccb8398fb

SHA512
58859a55a68ebb7613bf227770a65dd83208e2d1c0cfc42d1535405f42b7d2aeb149081deead16058b24fe619daaf203fb1b52e47edb8c9ec2f04b4ecf49a917

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UnInstallProfile.SQL

Filesize
4KB

MD5
daec90ee685933dd808e10726bf7bb89

SHA1
d6ba7d8931e646f537eb081d186e7c67613dac0e

SHA256
ee054d69b67779e51a29bbf1c70012f22797a27194a751e9d6174565fffb239e

SHA512
f7e69ddadc6bea7ba4566d8cddc7a43560beae0a1317a1da3f705b620ba5e57a5b08a66d322af991c91646616f12ac61d9b032a5a84de36a41acd684730d8302

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql

Filesize
3KB

MD5
2a0b30bba93a9a862a0407f3c9a2b5f1

SHA1
048c85d5a224cd73e46dad5555edd012c06fce06

SHA256
528582f94b7784c37a19ece8e99b9ee14fc1705cfd30be6e65e0e9ac2f4b363e

SHA512
5104b74466d472c8fe187bef7b9d8650869e745c0fae845132e7f36c2991ecafc95891358699e0e2e867d549ed78f38d6444d91e3deefb5095ed89dfa1d677b9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql

Filesize
6KB

MD5
83519dd0c8ff6f0d3a00302b2be783fe

SHA1
8bfe42ff59e24e16971ba56d3b9d7ad441848a9e

SHA256
0dc6d5eec26fbde3840fce19ad641a9da4def6161f76c189bec65b79a5a0672e

SHA512
f289ca6d1be7256513c4bd22440cb4f1aedcda5573782ff191353406d4594dbecb9a63c8915455ffa15f230a9bfdc42ec8c50da709477f5a9dab304d8240a7c0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql

Filesize
9KB

MD5
ce4d7bad68bd0d687747fe7a32efbdee

SHA1
5bc21c5d242b30cc295372dc97b7f7febc1ce403

SHA256
bbb247510086b1e337668773d714f400ae75fe1f38f81c5e63fca385a4c3d9c7

SHA512
f63bcf936ca193bd5dfcc766f5fa39135d66b3458e6c9bcfcbc4cec2d9de846564f745420d8eb7cefc37d5c5aa36ef3685291ba5caf4ce9a099f4d5ea0c02f96

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql

Filesize
7KB

MD5
a0b29756800534ace2b389e1b9ffb4e0

SHA1
6710f45d4cc35356b25ecde2f996180c72ddada8

SHA256
0693e36ebc8b1a16df8f8ca4062bfdc801142faccc615680cfc29a873a619df3

SHA512
b5d141e55ac58f8cdbdd5f1f3e24521f50035d98c98a9f5e4b08a591e68b44559e4adaf77f86c182bc3579c4a77177e15e6e1f5c97d527848f61db88c01a2a42

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql

Filesize
5KB

MD5
1e31a98bda54fe7a0464009fe182230c

SHA1
5c59edea626fb1941e3be2e60a50fe789f7f7c50

SHA256
12bc91aa44618501371f0f0a08fe15049a467e9b863eba4f415817b9102f63cd

SHA512
8d2a49dceb8ae9aaf9a3b271605d2be697b976340e19251d95e11e2534d8770becca646b9b46b9128703b4e569db8b807be0a2969a0a43deb287e4c8c82b69ef

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql

Filesize
9KB

MD5
dc78cffb36bdd33b98835ebfc6472de4

SHA1
0b63e16bc12bdd92729cd444e0be45fa2f1b734b

SHA256
954492da7e8e7410f99c5fc3a8b892d3fb1914de995930eca3a610f482615323

SHA512
2d791c185fc1c4711c845d12194fa5c8047854259c23a169cc34e741686435fff0ebc733d5a4902faeb034ddc7a299589959a8b32becf6d0b45c231f439d3e49

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql

Filesize
11KB

MD5
f7f351ce580444a45ed91aab4e1b84e3

SHA1
82cdd6501c8837bf388014d376b943e9edde921d

SHA256
30457b05d6b36a87a3c88c6691eaa4ae46c19e090961a1060b73d48a6e9e73aa

SHA512
f73b0b5c955ad8d71328f81d8210726062ed2a9c2a65354c7bd782d74863748b651926631f6fcf4ad0d9c5c35b3400fa61adc279e993145d9f575666b61e39d3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql

Filesize
2KB

MD5
cdfb7310a5d8de95ff493292f1233bfc

SHA1
4a4f77d8295815c3667d345ee7fe02e783809dc3

SHA256
fc321ad972b817e027e579774d2d0f630e61c79afb10d3e5c1f60faf70e49214

SHA512
a90470b75e4363f226ecd3dbb62cfda58f84ba215c02a5e375f0fdc224470a5befc43ddb23301ec4da5aac06c8cfd5f3fc22aae2a9b1a5cc15dfaf33888ca3cd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql

Filesize
23KB

MD5
6b44d1d245f43db0261adada965c25b1

SHA1
89f0e07917b6f9e92ee58d31880623bda618f4f2

SHA256
7762adece533e0a48813bc4d525a2fc5787745e27b1a159f289b71e02aef7656

SHA512
ecd023929e29cb751ae988ed60689d12aa301be0a66b95393347536f0015574a52f1cd8e40244c2b03149dad3599dec7aa295b28579eddeb47e09e26551ca65a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql

Filesize
4KB

MD5
f3f995d2719bc95dcfe8743b03fd9923

SHA1
df9a4169a42a2597c6c05b9746298e86387212d5

SHA256
d8ccccafa5840bae88b301a192b0f2a63a3762323f07ed995cf385c6b65fddbf

SHA512
c9e71cf6deb4faaa62565ade42d025bdccd96182bb7fea082feeb2028a90343cabfb3b929fb91fed26cd1bba96b11f43ac487d09bc400cd3333eb327acfcf680

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

Filesize
372KB

MD5
5e67cd9b0659c6836e9197cfe43e243d

SHA1
a4b32f3583e4062a17768e73434df4cded3addca

SHA256
45847c76e8fbb990d349c5974416044867019a96a0606c9df32894798d4a3871

SHA512
4c3d1ef0efb996af5dd7ba7843e0e42f398baec2f7891f24e9156f95382c5f89a5b877c7e7c64b808db644f5a6353902b7c073af8e5f0cc681226728082794d5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql

Filesize
49KB

MD5
a67296a5911299943fe8abb50df95616

SHA1
679a384ac15cc354910ebcbbfe186ca78df73cb2

SHA256
03f8db14d10ceea8914a0edc00bdef5fbae1a5f9f266cbd9ff28036c59620cd5

SHA512
58cfc85a2e831e0db8f7c3663944fd2926fa39185ed9dad1a1dbfef72932703b789501d373b4904d60ab53a31bcf7d43a79a0f42db3c13f648f047261d74bd05

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

Filesize
2KB

MD5
02bfb037dbfa61173d60d5cf2f31d1ff

SHA1
eb93e0a52c57bc3ded402496d1d5e0126a69faa0

SHA256
510808c1eb7466dde2bbb5a0d505b883a66e807d7223a4f76044b15ad44cf61f

SHA512
f427f9ccec4cc33ebfcd8102dd6920d779adb17acfa455e0812e19b395a3f1d47c34e38497a3fb91d05e7e6bd50225e8f196cabd8cc867b79e2e10c780cf8f43

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

Filesize
13KB

MD5
43a81d98369ccf221292b55c45b0e9d3

SHA1
135fb44421562c6deddc628c233270dbc66d11a7

SHA256
0d0c7eb33bd0746fa647a3eae324ce00d5908725c38b6c9ed688e689aff3c98e

SHA512
05ea59bb5794e7f9c575c2c5ccbad70b28d671f1e451d161d9253796823398afc411ead4a0b27e456ccc20c6fb8f1312d3c8ce545fea32f4f3207b6ea57b599e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml

Filesize
62KB

MD5
3a07c63f61615d94f2d4f5842605c3a6

SHA1
1343b8400b2c1ae01fc2938bb62f4ffe14c7b0aa

SHA256
4127850aaa3cd2a4344fce9639cfda64f530f815041d76cffdc2609b67426f4c

SHA512
767d6d362d2deb9e4804b379816761915811d48a171b6a2bd73369bb297bc11b078c0874b9cffb9ca4b74f5d8fd7f02f97fd7aaf1253fe351e8b90d8c0d12c48

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
5d35c9b2a3c374c795326c02833a6960

SHA1
9b6a41e8beb538f37f7720adfa663686ebf51c69

SHA256
48a614bf4a23e17ac84c94a1c47e66694dbce588a7b7c5d1b373d67be2aa31bc

SHA512
6c448172a8d220972709540a7d1984c79d7c2d275eda9e47961c77d67de0bae84e21e309f81e1020a6c9e7b4bd8250ae86c3083ea25e0d41ce854b96e0d061fb

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
61275485d3b9441bdbb237b985187393

SHA1
231f6d5bb6eda2e6fbfc65fc5b90e77d409e740a

SHA256
b4756bd765a2329575c97bdb622dba94eedba0c60ceb3b7b39c3ff6b00d6758d

SHA512
ab30cb0987d4a596e6d8e9966703ff13a4bcfd335c1be6f56099c2dc0599242d7172c3cc45834675d408cff642dd185f5e9f4e5577745103c3b645186215804d

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
1097f36be505d5187ba5372121d535b8

SHA1
0e5038199364337cc2d23a993fadf55387042608

SHA256
fc72367825307fb1c1b346297ac772675723549d0c2f1d34f8027aa8cb6ad523

SHA512
00dd5f13e00807591dc97f4e01ca2df72dbe57e03433116e63d9f180c910a3841645aeecb884f93134d1bf51d7379594cbe1de94fceeaa3fbb0329e38b40f914

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
0cb0c290ae5ab256c34f864b89480418

SHA1
248c05adba73d86176f691f92a743bd27230c8ef

SHA256
c646c4ce378b71c19e07f298ff94d48ce3c865e5608cd9a6d3c90cb4c70cb9a5

SHA512
a1ec659583b2780255f5bcdc7e23832e3f705826d65772a440743c5d7d77fa74d82932f4cc68e5d81317f4abebe62bf23d5a3cc7bfe3c1501178e3306fd8eaca

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads