xorist | bb2af509e0c550876fcc7b44b052f9fd9e76a872dfbdd5c9ea987fc9fa335a9f

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Size

40KB
MD5

0d3db8fc7b4e9c299e613cdf2809e840
SHA1

53d4fe38e838e009dc0bbde5209be3d939059894
SHA256

bb2af509e0c550876fcc7b44b052f9fd9e76a872dfbdd5c9ea987fc9fa335a9f
SHA512

65d0b9fcd86afa1dc354599c53b78be7b28b7c0450a53b2a7d43e6ad35971846ab82c75bb654015e72ba19562a60063edf68c864c55dcc3d6355f7ae30f7068e
SSDEEP

384:BebFNw4Pk1itKkpAjjalrU5BrJEqYvjS7kDCgSl8HXMB:B0FmBkpKj7BY77DC1ek

Score

10^/10

xorist persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral2/memory/5044-0-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/5044-10861-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/5044-11292-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5044-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/5044-10861-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/5044-11292-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QMw3uEY442717SD.exe"	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmosi.inf_amd64_fce30a36dbc4596c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfcvsc.inf_amd64_dfe08f401a2eedbc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\InstallShield\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_swcomponent.inf_amd64_f378d70fa39d3577\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hiddigi.inf_amd64_dde7255b040ac897\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmoptn.inf_amd64_583bd0f3892e01df\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\wbem\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\winrm\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_c089962740ea1f84\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\International\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl003.inf_amd64_6b639ff361f628eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tpmvsc.inf_amd64_9b03a5f041e8d2b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\winrm\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_modem.inf_amd64_8cddb75e34142905\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmcd.inf_amd64_43b149b35876b241\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_sas3i.inf_amd64_79c7a4d8be0a9744\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sensorshidclassdriver.inf_amd64_b5ae080ff669eab3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0013\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_hdc.inf_amd64_6e00e835fbceac58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis2u.inf_amd64_0c5757ecd1574b3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\sppui\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\Com\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp_src.inf_amd64_0bdbb11733d87f9a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms014.inf_amd64_faec3fc366f8e1fa\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\nb-NO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\Speech\Common\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nulhprs8.inf_amd64_e65ae5a38cb839e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wave.inf_amd64_8e8496aa33c0a7f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wdmaudio.inf_amd64_cb639d1f182bc449\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ws3cap.inf_amd64_6cf8ea2249844b50\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\WindowsOptionalFeatureSet\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\en-GB\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcpv.inf_amd64_906547002cc7c58e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmneuhs.inf_amd64_eb59a40d88060ada\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\spp\tokens\pkeyconfig\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1851_20x20x32.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-20.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-32_altform-unplated.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons2x.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\WideTile.scale-125.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\THMBNAIL.PNG	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\7.jpg	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-200_contrast-white.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\import_google_contacts\googleOnboardingCard.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-64_contrast-white.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\MessagesXboxLogo.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-colorize.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-72_altform-unplated.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\THMBNAIL.PNG	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-black_scale-200.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-150.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailBadge.scale-200.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-32.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-100.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xee27.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_05.jpg	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-200_contrast-black.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-400.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-100_contrast-high.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-64_altform-unplated.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\Common Files\System\msadc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxSmallTile.scale-150.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailWideTile.scale-200.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d0.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_altform-unplated_contrast-white_devicefamily-colorfulunplated.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-40_altform-lightunplated.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-24.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch.scale-400.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-200.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_altform-unplated_contrast-high.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\add-comment-2x.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\StoreLogo.scale-200.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\SplashScreen.scale-200.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Planet.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-40.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-shutdownux.resources_31bf3856ad364e35_10.0.19041.1_en-us_36aacb7f6bff451d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_system.componentmodel.composition_b77a5c561934e089_4.0.15805.0_none_9f616d3454487e5e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..-internal.resources_31bf3856ad364e35_10.0.19041.1_it-it_498945b3b1793bbc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\PasswordExpiry.scale-125.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-directwrite_31bf3856ad364e35_10.0.19041.264_none_b07f10045e5067ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s...appxmain.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_6efab81c5b4f4ecf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..sprovider.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9fd2cf872adf60af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft.secureboot.commands_31bf3856ad364e35_10.0.19041.1_none_ee2b16a5c323ae23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_netnb.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_52b772167ff9f01b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_bthleenum.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_610a98563af6183e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..mprovider.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_84d4ddfc726dd4b6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..2platform.resources_31bf3856ad364e35_11.0.19041.1_en-us_9e77a126d86aa92c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square44x44Logo.targetsize-24_altform-unplated_contrast-white.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\images\F12Logo.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-256_altform-lightunplated.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_dual_perceptionsimulationheadset.inf_31bf3856ad364e35_10.0.19041.1_none_12ef5e2717e33aa3\3803E232ACAB2476E81BC8A88D5B231A677DA3BC\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..-backgroundtransfer_31bf3856ad364e35_10.0.19041.264_none_e9c6c69e3cd8d560\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-onex.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f5dbe4eaafd7bcf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tpm-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_17a7295b2af51b11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\TaskScheduler.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-8.htm	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ooler-core-localspl_31bf3856ad364e35_10.0.19041.264_none_0dfcfeddf18f7111\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wwanradiomanager_31bf3856ad364e35_10.0.19041.746_none_1e05069df0a0b9fa\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\msil_system.servicemodel.install.resources_b77a5c561934e089_10.0.19041.1_de-de_d0ef4bd8a32e89ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.19041.1_en-us_5801e9f68bdc3d85\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wifidisplay.resources_31bf3856ad364e35_10.0.19041.1_en-us_c6fdd4da1ee2267b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon_31bf3856ad364e35_10.0.19041.264_none_be3893cb65ecff6c\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\INF\usbhub\0407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..oftwareinstallation_31bf3856ad364e35_10.0.19041.572_none_5fa3be78baf4da27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.19041.153_none_4a14997c70d61386\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..inalservices-drprov_31bf3856ad364e35_10.0.19041.546_none_abd20e7b78123e85\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_security-octagon-enclave_31bf3856ad364e35_10.0.19041.1266_none_c5ebbfd4188c4c8d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-ncdprop.resources_31bf3856ad364e35_10.0.19041.1_it-it_d434cae435511b0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-150.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_c_fsinfrastructure.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_59f5e236507335be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_presentationframework-systemxml_b77a5c561934e089_4.0.15805.0_none_f77c62f0ff74d234\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_ae5ec9e59abc05e6\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..t-console.resources_31bf3856ad364e35_10.0.19041.1_it-it_b233a97791bf91ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_wmbclass_wmc_union.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_57499960a5b80247\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_dual_mtconfig.inf_31bf3856ad364e35_10.0.19041.1_none_1444c37187ab0346\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-3.htm	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..vider-rll.resources_31bf3856ad364e35_10.0.19041.1_de-de_41161d725fa2f3e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPStoreLogo.scale-150_contrast-white.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-o..-adapters.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_ecf55d92d7d1f02b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-peerdist-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_29276692d9012aa2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..systemmanufacturers_31bf3856ad364e35_10.0.19041.746_none_4d8cd7989326ef85\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.19041.1_ja-jp_784577b833043457\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-qedit.resources_31bf3856ad364e35_10.0.19041.1_es-es_dcaf4bafe8d249ed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e149786fa07e68ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..datautils.resources_31bf3856ad364e35_10.0.19041.1_en-us_518b7f106eff8d5e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-edge-edgecontent_31bf3856ad364e35_10.0.19041.264_none_1e104b5734e6411c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mobilepc-location-api_31bf3856ad364e35_10.0.19041.746_none_eee0db9ccf2c0917\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..mmaintenanceservice_31bf3856ad364e35_10.0.19041.1_none_f33effce7f94d952\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-transactionmanagerapi_31bf3856ad364e35_10.0.19041.546_none_3f25415e6728280f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.19041.1_de-de_ec1c7017ac88fbdd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.964_lt-lt_9dbe884efe85d5ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\Assets\SplashScreen.scale-200.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_multimedia-mferror.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_602d9f8e48d267a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\wow64_microsoft-system-di..s-diagnosticinvoker_31bf3856ad364e35_10.0.19041.1081_none_790ff2ab51e8e31f\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.928_none_1d29b4735b607954\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-dusm-api_31bf3856ad364e35_10.0.19041.546_none_d2d472e23827041b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\ = "CRYPTED!"	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\DefaultIcon	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QMw3uEY442717SD.exe,0"	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\shell\open\command	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\shell	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QMw3uEY442717SD.exe"	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.enc0ded	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.enc0ded\ = "GMNSYSTZZRFDVSV"	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\shell\open	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

C:\Users\Admin\AppData\Local\Temp\VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
741a86d05410b2ca0583044454f229b4

SHA1
4fd42fa8c5def994e4b7cc77851fd478855373f4

SHA256
86f086413594cb0cfe12c313c309c4ab712c21107aebed8e0b22834de7cb60a5

SHA512
52a0965929da49d7b8d628c21e50df05ff87331b9a68d0393a6bd89accffeb763b2a0235a67960e791ca55eccda7e2e139e1f09f86aaae9da85483b04c77b379

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
635bed8ae556ba5cc602643120075f2b

SHA1
028b4e17c7bb16c68fdfb4f13a9dc9cfcff81230

SHA256
eb9bcedff7aa1a5c69f80831ccaae136d9079b6faf89cf9401269a0835526d56

SHA512
fa28d76699dbe902745fef5fef2cfd36cae90e487849e91278a0951473bc1b570d3503f96c07c928aa99f4becef2671b1c847cd8215487de36e75ae4edced21f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
b774cac852a73fd61591c334ff00846d

SHA1
19b628c626b2aa27a7c1d4512c9a5e3e97d51763

SHA256
72a47b5e61257461668a281c81733ac3714b0245b8e223a91aa383b59d30b609

SHA512
57f849e54050f05ceab6c17293787d8129c9ff17c6d8fd5c83c9f661ccbb3d05c5b33b489e17aea97039e31cef25212877984e2add7ecf583f93cf60798a40c0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
a0c2a9a1097c1d490f924e2ff096c84e

SHA1
e70327b07a45e1f9f8fa28bd3fa2486dbb77a063

SHA256
dbf6c8fc0894e2b658814b093f05fcb94ebfe208ad6cb8019b1408eed604813a

SHA512
22703a03650a872426d94df1c064f9ee4985ec9b1285a4482ac590b95b5411f654e5b82c06461d930e1a9228162943bed6dbe52e33f4d65f92e079e81007d0d0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
cad8c2e962e23313a7610a7f8e66088c

SHA1
00ca14c3a24e0b6a59929a16ea5290c75bbe2609

SHA256
52efb6b684d9004664cbeec721c620bfd6fe36c41725f2a5cb9c18cc176824dc

SHA512
7d82972ac63955071001e67040a176b63ca54b5e94b91ac9aaf7a81b3a63a7338c68c4351f1fa0ba1d54f2ec9f3b074238e63f67463be9eb44b718519fe4f937

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
2c29905a0fd0a45bae8a60f64bf7a988

SHA1
2eb241db3009b384292a5df9838cd45925d00c05

SHA256
3e0af01d181bbda17a877ba56da705ef8096d12473944c91a82c4f6e5130794c

SHA512
fc8ee55563e20b605a290e85a824134009e3d58c4e9a2d736c55a93d2972e446b13b6458b00a6d8fa53729de62348b7abb57d1e5b8455f76c1f8a5fd8ed4db5e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
7d4f55371609ecd8d36fcdfc6b0f0076

SHA1
3477a698ef22680405fff93803bc7cf845f8f051

SHA256
b2e4bb1cda7b0cfb10e557b82e4486275f0aa4b26e0bcc9c31cdead0ec40edab

SHA512
ca9c761d04ad866c2ed7cdf21b960a5a1f07f6246e404ca2068ec78580d4218b676baa37faebd8de4aa58ecbffe623302af10c4509ba2f21d586967d0850f95b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
3075fd5ac29738ed62428916143e84df

SHA1
f51bb5c67c384de459f8ca3569771302ce820b91

SHA256
1c141c3302d762c3b9bc8558cf9f12417fd8a1cebb4ea3571c6cd7ef65522e94

SHA512
3c9b660eecb71dcc0773f36f8b065175010a1bfdee828b5fdb0d5918a412b6c866ca0dae466d0fd0ff020972d20dac04f6faf37d37fba0b19e44d44847c3bd69

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
f692d73604f03db2f5f33d79a9141b84

SHA1
5bc790f6294d8d1f949d7ee8387366bdc03b7723

SHA256
9cc30f986791cb273aa8b307e607da89124839796aab7d189bafcf23d2f44b6b

SHA512
ab36d6c2572d25fda18f719a9d3613e2c7b4da2d8cb3698a8ba064dd4062606579789c8185af508314a984658239a338235d65065c85331815e3b0a3c161025c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
98506ffec20b9a0f9a3ac0e8e32694cd

SHA1
a5f25127192f7cbca72c05e35d423ac0c208e201

SHA256
70b4a9795d17dfd9e6ee653430fad3b9d3377622ec9887748a01bf96cd4bfcab

SHA512
c82c4617e172feab441f1f5b9fe1f9cfa9f71bd39d6abeeb4ccd803a10a23a137c35e369beef6629417511cc03de015471eaf482fdf15de8875a70c1f1f04b0a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
c111493b9f8a17eb77ee18cc1f53a0f2

SHA1
5908d4a0a4d9255cdfb869f269a0b6478284ce49

SHA256
1de15575c122f100778b45ff9829fc97e767df2b53044a43dce831f3358b70c7

SHA512
156d75fcac1cef03a03979ab628501917ebbfb66fbb20027564b559550f6c7e15391189cad27996735bb2b7366783b686ab1968177db27a1dc421e1f2d909b11

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
a8915f79c36160d1e4aaf11debc1e571

SHA1
f45a9544d43e117155d3a4ae5a255a20cddc5d76

SHA256
f5ecc1c57f3b5d522aeaf6c970476fb498691d7fe3e90270fbf73b4bcfc0c780

SHA512
4760e9e6eb380cf947444a72a332449b9c0f90a083d4031a31b22465c4372f69d01fbac906b9d1f15ef458ca89ee30da68ff4e001f1505a766f88bef73c5eb58

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
d26e19a812ca674f7696a4a5b528e3b1

SHA1
3653e6024ccaac59da700522392642c8f542e386

SHA256
86f545c2a61bee9c51d129db64f90dc169f36aee629041e613a1e35e938d1110

SHA512
71190cbec207ac382634ef6dfcd1d8e7b836bac7f56b5b25a93529937a0ce2a9593a98fa834743dd13e27787e15abbca9b7ffff35249cbf73eac755ff55689ab

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
d6b673d7edeecafe41f1bc3a0d56ee3b

SHA1
6d0027d1f95419205da26a98729eae93cf34a657

SHA256
addfddcae235340d25c2ed0e7af3920313f27e6379c1ea17696af6634432f5cc

SHA512
122780574abefd84c30e64eccdf06327d5a6da1e18a449ebea0d0cd129844cccac0d5b801113d68a1447aabaf224826d8c8eb65d490ec72f41ab00661ca5ee97

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
3edd99c6ce4a05c75bb73b350e166f17

SHA1
135dceb564f7dfdfd1c471ac5fd519eb25f0681b

SHA256
4e4d30b8f8c6e6190201baeea14b8d24267af1d9399cf3f8233f603d912b3e38

SHA512
9c08e55f316372331f1ca7b91a224137a44eac909e8661467c7f9a0082380c6c4c56fc3e9ae8b1d7882a6288c781c8988f5d0a22404965024e0d707bf0eab490

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
70ec5dbba7abcaffa855d49e8050b91f

SHA1
f39b53e797dd56e3ba98bbfc717c92f29802e32b

SHA256
3e0206d104fb86cc55e603c696e6fed7c777ddd74419177c74fe4b1233434186

SHA512
6fc9e71f0304ea8c70d52d2c44478b11c37166fbe0dc92715b55d9e10ce72d839a7e6560610ce41bbb7f2aff4365665d0a039258ba5b57d74c3e3e5fceb23ff7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
88df238c30a844bf944b4847cf39c338

SHA1
d1fe5ebec84087f8626f8f0e9635a48c5eb2d335

SHA256
98ffd746fe759486b0872ffdbe5315006f5dee5952cc98d36424506d4b46e8e5

SHA512
2faef240c9a7c8d32a947c5b149f0cd19bfeed813bdc6b734e1eba02afc0c866c7a4a977ba164aa62795fcd7e0dd8c687a1fd844b546d1b0eaed8706019a2473

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
d88f7952816b6d874a528869ba6b1da5

SHA1
c518b82d32050db9c594114a913faba06fba627b

SHA256
7122f0c95ed647ebff79dff28848f5857eb403212d73bdf0a32545573fe57459

SHA512
178e0aaad43d7f413d5c4359fbd61a4aaceac405cbf02f503dbc1bffe3a46d2c766fbd6a1993e8b38c06c65b9db9a32fc8f9420dee97d998ff248c9fcf966934

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
d55f07095c0c4b456c5814143197c76f

SHA1
2a75b8865147fa429d46b9572acb585ad8b7ef97

SHA256
8d7480f8e1746e600d9be9247606a035b7b1a51d01d4b627461659423a997c52

SHA512
bd094995d50335153f74f99357693388d8bc345cf505a0d811d40061f33924e7cce42b821f03e82b5cb95380fe01bf9b7eb15d063f779ff91fe183b82be618ca

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
9a4f072843fca6bd3fe82cf7436e18ba

SHA1
41d61473b408b73a452a3885a7bdf5128f5a2340

SHA256
6a4151b89bdc590856036ebc9c1685a190a55aa307bb3ba915b4e0d557686c42

SHA512
9926fadf0c7bb40c23467a67ba6f069fac8a314e799517f8c8c9f0edb9cce23f7ccd330e12649ced047f864ae89afe05f74aade6af3d63245df87aadc9034d84

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
e08e2fd89f49806cf2cc338721c105d0

SHA1
bbfa1021830e4d7f077a9d676de0942f728969ee

SHA256
5f365e506ef858022f243747c0188fdcb3f50e1c3cefc7f5ae923e49e1d7b60b

SHA512
0624f6ebd454462283ae6351a88324671cb7f5ac775b52076e06c4c977474838eb7cd8d2c078d910a7465c2b8b91c1ff18545b8c50d4e4335e22e4b145c5f815

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
79806f9509e5e12270593589d9e20d8b

SHA1
631a16c9f8b49cea23dcbd3d06c334bbf0ca2785

SHA256
8ae7754306cf60a3ce19308c6b1fcfc038d32dab7b7186ed77b1c92a443af1e8

SHA512
8caf374fe40f02665f6ac1cf942bba0eaf8f9462b39d84eadce8e4c18c01a1c87e91749bafaa72a7b64f9a190dc4a6783d94a66acb7d3888ce1e0471b6277c80

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif

Filesize
19KB

MD5
12784fea1360f83872ad71be24804aca

SHA1
78ff08decc499ce71395ab70a2ada5f3fd100bfc

SHA256
c48a5bd7b5647ae7bab11a42e40884f6c7970d3e9c4fa5edd26a7171aa95c84b

SHA512
f7d0a766cba48d015ce9f2e3947966884a4b82bc74ba3ef941e83243b2610cc6940823446f60b3e7a1516dcc34e1e6c14cfe19f7b6c44e9e4ac8210d738a61b1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
a8d45b180ff31e11b5896d79f6b376a3

SHA1
dc16ff9bd6943ed66015a15372d6fe6132d0a9ec

SHA256
8e6d765912d73fc297c24f4c6604d0697e9a3683a50271291664809a954274b8

SHA512
5a5ab2230d46f4c02c6a68b34c44b8e177ffdf3c541122b0d075502ce00f1a8404b93426f0f7e23c57054e16f5562b482bbabb8abf950a66907ad267b49b79f6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
b8620f19f89714f154053bd0aa79d64c

SHA1
1287e0d3b20b4b0359b04b3403158ecdacb070df

SHA256
008459d3ac6e020a59300f24971c7de32995375ce20f0b72f7416c1ec365c0fd

SHA512
3b4adb48928dbdbff5c221e0ed143a358d52934ba1b74064f8f420844eb7cf4ff91f7f479f630575e3940908cadd046e860f04ca949006a73c43e95b095776f0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
09020b85271820b0e19d07406869efa4

SHA1
5ba030970acfd77d752ac0fadd1a4c8de97697b2

SHA256
96d24ad8cb22c0fc7a76acf80dc8ccdbf958ec2bb0cbd6b6774d2a9b138741f2

SHA512
1b06bc822859dc6c9a7dd7757edd600d2e8fac0fca5bb91b0da2b2ecdcb41cd3f0b4f8959dd1bce09a2bde82d0a19651f905f03a2b2351fc9facdf8196984900

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
eac2d38950c8ea5426e0261372f9e356

SHA1
80df16d7287a72fe3d8f7420bfd40947e7a1d7bc

SHA256
c3e83b498e243fd90c0b767fac791a103b3564346115ad3b07a78d4194b96e45

SHA512
f5ed86a47626ec13bd56cc1a959115267045512acb869f15cafa1bf7c6416c2ae45e3484d77ad1496684e9fa4d8fc40c389e6edde4babe470d3fed5a8b1f3b41

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
7783715d3830a3cd6d7605498b2da634

SHA1
5f809c124d013285fef983de998e1afde737395b

SHA256
1875c1f840099c381709cae39e2bc0901947e0b4fad633e61600540f3abd7e0e

SHA512
437e6e655dda169e7ca2754a9ef9393adce7f7588d0adcd17289c22706989bc66eaf300ba12543c61e9fde1d89e4318656929ebb3fba90d812cf8d3a73f0c967

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
33f4a60d09016554e83878d513dfc948

SHA1
67debc2cd488ac42e0469feb572d988e2c1e280f

SHA256
4e1f2e67627f06a21124fc8355e4eee5f821b3cadd5d8cb9b461dc6fc9b4f185

SHA512
3f9346262414ed31195409a8998376c72f032781bb435e525d753eee81d44b885f23159447983dc4e9cd37340e9c9d377ae13425e3e0a86d679e5aef658374b4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
c7c0baae1c50ba536d653ea7beecaab8

SHA1
76ccb84287481fbe9fa74a514ae56512e30993f1

SHA256
6cd69eb759b9b628aca077802ff29b72088018c43d82ce91b227f842b054414c

SHA512
95a290877034cf7ec2b9dabd2bbdcc3c2c3117bbbcf51a6affc6f38d3d28572c75bd425517ca5ab9d3ac9983d0a8c3457d8faae9e1b10c1cc37c32d68c4cb60c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
217be78f64235ce645d67ad3b919363a

SHA1
b33a247bbdb1fe5e1fee5016d6f5c04721bfd118

SHA256
1f9ca33e9e31d7ba96e59404ac5b2dc0e9d692a4f9574817cbb569d6367fafcc

SHA512
4b5affc861f812fe620f2a5d668565b23cf2013cb887ef087ac58b3510e54bce63a947ee00d859d56a00de92da0e16b5891ebe21b568bd00b092267b26b041c8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
0542a4bf92038cd2891887428bc0717d

SHA1
6368c28d03ba55126c942261813e9080a6c3b0f4

SHA256
a21733fabf238bf87cb7462b3081961782bdb7a9b4a1fc1af360cedc63b3b9a4

SHA512
84714f7fd2e8758d5b59ddf57296dee4d40e1d39ea65aa0e3c4bf44090b40feb3765742885544be6400794caa39050ba58a85f3cb351ab7461bca2a1803cc35c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
f4af101e24dead39ddc5a61807087766

SHA1
34cd3ef69e7fabb49acbd816319094f1c97741ab

SHA256
8453fc207b83d71f9bfeb0ec54eff59f09ceb176022d8f4435716a850bd5a3e0

SHA512
d4c34e411d7fec2df284eef4e32efcc6218572ca8f52daa4143f956d049b53622f7868b79d8a97dbfe74f75eb0e1f85c9012ec03ecb9c225f02159e2e7a8e20e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
5a444d227ba927a12c35d9f6a8e9802b

SHA1
662622517e243b0cbe97ba596b135ffd28d709bb

SHA256
1f635fa5d2d91b23aedaef72a76226a121ceee3a99bcce96b7abba1480368322

SHA512
85b3e11e1706368307d6c6d3a1ab608e428bb399488ed480ba92a54e3043733aade183a34fb248a86cdeca8febeec9bbbf77bcac874b22b0bb07076fc1bff5af

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
794446f427f3fb4381a69eaa5ab187ce

SHA1
a0422eb5c685c061afd949ac99b90d6fcb56e013

SHA256
fc8f4522490ea2f087ed77a89bd8909f56f45cc765d04d2bc44ba44a509a4025

SHA512
1badac765c7d3a5ddd522a3efb16d86dfdc1284019f840a685f33b56babcbf52010a33ad2a8929aebb6d80610fd725e32e279a5b1bd18397983a7e3c26530b67

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
169af322ef408c9ca3a7e3f9f1451de0

SHA1
a9d1675f7e2743101ced792c3eac3ee0c9ef670a

SHA256
5e367e593ef5d11b0f730ac918600c4f6ebbb59fcfb0f0df995b6b235bb25c58

SHA512
47fb5b25d78432011610e77816722cab1d655acae43e8dda61a3d671d48ee648dc2fb153f7c2d1ad76138e70b0e95b969823fb510b812c29a7b704b9857f7790

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
eab12f034d90a9e6f0c86763f18eeb96

SHA1
fa48319e13ef0d56e3bca23dee3dd939dbd97b03

SHA256
b53ad243bf36cd626895f5bf47c3ed45e918bff37995823e69a3eef77df2250b

SHA512
9c971fb893efe3ef0136ef7fda817bb808cbeb594ecc36d858c0d091773b780a172f00011ac91419f1297489af3e9a036949b7db3222ee419c40a2e3c4f97a0b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
a3804ca452241d4649b5c92cc25d0dbd

SHA1
2527c54e133b16b0ab6345356211ab16baa0cf21

SHA256
00393b1c7217ec1ff8ce5e99bfa506fab917479fdcefed664398f941eb160cf9

SHA512
0400416eaff546fbf6ae41aa679e3f48d90eb137249ada5c1389fb4aa52ebaf17d351f70614bebc491889158cdb9aa1e172c9747e09787643a3f6e9528d95769

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
3e99ee21b2390df2d985369dca2cd902

SHA1
b91af14ed94006e3fb5d6392ce4a69ef98b04637

SHA256
1f43e463c865975517768dddab310c6f1dd14ce6cdd8a1b2471f9e277b369925

SHA512
3cbb7e218126089531f6bc8445d66754be0419528dbb4f3ea40f4271b2bee37af6888ff823f7ec916a5b2af6facdd777dd67f0d61477e6106f899726ae629e61

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
638B

MD5
bb09a26a25c08eb560c21095b5060300

SHA1
69f699019e6762b4dcb60d7fd100735c38780672

SHA256
3d11fd4c80d8ae84a688a9be80060024f9ac3bddecf3d4e58cefaefaffc90403

SHA512
26af31f1d44a7b6df0411bfb4c502569e126daad4df359f8225c6d792ed44611221f0bbb00c72ad178ad1ac658dc8b57830ded932e039260348cf7f9cb4662be

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
b36d90942adc9ebd0afaea4d323862cd

SHA1
f610dc1c40ef710bdf04d6a145718afdb7cd1479

SHA256
59c6e803bcc14d8818cdfb14c70622bdf730043a3148c96c48b3e2989ea85744

SHA512
ec2ef77230abf72706ac6b4ad528b68f8e7b5359438122cd2271572e8aacc1f70d04294cdbeeed28036f6de54098fd92a95497736116cfc92dcbbcf7ebbf2e78

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
6a38de459ecc0c2714f3995e04c53126

SHA1
c0a5aa79ba8bca05c44338eb35874b2713ed35b5

SHA256
29ad24e4adfbca76d90538d4888ad55c3f1895be3c1fb5cc2926d7a21095ca8f

SHA512
442c47c918e0f40ca0f502db6c5547b73253eddada2ab3780cc459a49a92fb31f928e55cdb20fabb164a10c74bcf4e5d4e1990ab161081b7168bf0be8a686acf

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
257ec6ceb90678da36da4368e5563e26

SHA1
88d95ffd719bae8aa175d34a31577b9beec8c5f6

SHA256
450a83f1e05a9ce9d57da1c9036885a0f07fbe1b51012fa0c5f393632b80c6fd

SHA512
e394b1e2c71b10e4f48c525e9899ac38bdfeb878f31ece3df68c6492b3abc40590dc4e529bdc32c71d67b51ce24ca6207b614b48c8202daab5ffd07b57c4103d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
8487780c7ac62e077aa1335653bf8e87

SHA1
b7746597d0f58f8ca5f7f7ba37217ebebdbcbdb8

SHA256
bab0cfc0a6d2dde016e0358e5d174e20f2e71a387df6f7fb40b9a0d57266486e

SHA512
d24292b82468e146649d48b256391f42f6c77af6b868efa8804361ebff4f3846384f43982c9dbef16696b6b24f7b7d0b8d959255f21676bcdb5814a8b1150229

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
d0382fe6aa199556866e11a9bdab0fd6

SHA1
5ab55e2c1258be89cbb83f3e4ff915504f25661d

SHA256
f372e18256b52a3bce1e5d63f30cc3ce35a4a4a0042b4ba1e4803768afbc149c

SHA512
cad48cbcc5da417bcf0dee89b9cf686e67fe3d2bbf333920bbed15d3f92c0a482ccfd19dd4b374951e4acef0383643be95f94fc26d0d57a626a7d3915c1f901b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
54ae71e0d0bdb0286bcec7da9493ebce

SHA1
2832b6cfde2e59af9e43baa853f4d13abc04afa1

SHA256
19f6002267be5fa42b87cac055ecf63f3a8e98d4f2b9c5451e9941f256b7bf10

SHA512
0e565782693f108ff9278748810f5c61055317d9cea9f709eb0b19c4efb27a35a2d8376a5944cd3985b32edbec292c24faa347658f10fcc9358736b70d482a63

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
b2f97a0d20305eab7baa3b156e1791d3

SHA1
dcd6d03ede9dfc57654a9fd2c84aa45cf834db24

SHA256
8ce818f8966277e2584f8aec6573ad8c7a8af3429f8d06e244249719df06670f

SHA512
fb3d0ad65016352f748224472d8297b10f7d0eb057a4de28c4cc8ce2faa4a038959570733add00612a6fb9173ae3bbb5a2eececf89dc0438d87ed7e71ec47157

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
b881514009ce802175988aa962de0afc

SHA1
0cc2d7060e9d0280fade14bd8c97aa89b763fcf2

SHA256
f075d7ec55826723374c491860b3b325fd0ec4daf939b18b78b296d34d1719e8

SHA512
10b55f95c95cadd520ed67f073e7f2889872464379a71889f9bf998e7fb8506e07728fd4b4eebc945395abb91c094855c4d7a7d483d92f15831a73a958d4c742

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
e78602e1ed20c9edda9a9f9dd9089ed0

SHA1
99ffd343710e6f491f684f5b622ac293251a38ac

SHA256
b8143364ed75482123ac4319e4f1c3e5002222363604978cab8295b39a4463b1

SHA512
fd0ae16a589fb92782ebffa46f71fad724133c6dcde9ca2818194763d1f223325f517c44bf9eee7cc5417a395a6c270dd5e759cdec694d290c7046ba2666cac8

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
6594bf4c5bccb6e0d8a0f159c8596b1e

SHA1
06f415a3b9d71aaf9c8c4238cc5f50b31b9949b4

SHA256
287e206841f48f5b39d08a032a44be56dfd504807b6faedf80768a57447ee000

SHA512
cde669642f8380835370c7e498c79be68322589eeb1ccd03a0d8a8c565da0f7537cd58af28322655500c0b5c716cd38ec21e398d4617873b2f867a5f6e508bfc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
19e3043648f95608fa10ed50be4fb0f5

SHA1
653ec0a3ac009b70c9ebcbbbd28e51c2cb504b7d

SHA256
d99371bd750f25f926141beafd65647061d1b7cf281807f99883e56f56c8a635

SHA512
a127b58fd5c4de9009ca27ea94e97c1161cf8c60740864863439f234039eba2088456908b06a723a0c7cd0bae2b371d28c96494eb29a18f9bf4240bf7edc2479

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
71f2245d32750ff548b80914918ffb22

SHA1
73a2e702365aa728360565846a588a39885e77dc

SHA256
137245e03ed3170d6ec13500150d06bb760183b5ff0a9a572f9ed098697b1ec5

SHA512
3aa310fe45386d44df2acf7221bab4aa7aee73ee1ccd7d4f6728a0dc5b9a442ae45854d8654852cc1df18683933e9b9f6f749e4e558010ed8a0eb4868fe2069a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
1655393001e41aa7d2d2e7f008ca1c58

SHA1
ce21e4eed8e0b2377335871a434321e23aa38173

SHA256
76cb48b7f840475ba49cd84cbc87827dad2f222915576c5fc6ef85a3376ea38e

SHA512
75ac0a0512b39097ce686eb1085b246ca04268661abd7e97cac2b9a4106548c1ef8fb5fcba7bba890ea7998cfcce0a360ffe70ec4a024326d3cb9f5011b1a0b2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
2c4c33ce590bd97cd69f1bb29251d0f2

SHA1
7c59c0fcb281d32c59d693c6d0aec188cb1ae1c3

SHA256
a892c1f0d04147a3b8526789cf58375f28227a8be43a664e8726b5581de3a449

SHA512
262328258fa7c6d7d071de3236ce4793cd6538528a6415c2594ea0d9d4e24f611fa398667e087e4ff8f30268cf80b3cb4f4486fbe3ade8a37747f8b94f42ddf2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
c5ab78711c8439e60aefe218b4a24f31

SHA1
1a1ff9a07225cbe16589e90bd8b4ec595bd7e729

SHA256
f9c1e42a4a17915304727301d46b5a9af8fb9f367ebaa50e94c495ae5bb8c895

SHA512
e15796c80dd064fcab71b6625d0178c69e84da48ea1d30b82054319cc90c38869f83f6d013e5479f82541943eefb2f3d86646f27d12c863c144d3cd6a33d3f54

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
9a39b6a3d492d59af9802117bb87b68b

SHA1
f1b99b3cea487223c20cb385d5e8f9eac3a624fe

SHA256
f188763db9058569e01df28771d460f03789a199818a5c59f8e9f37c7f5d5230

SHA512
ab6d3d6ac5d87413ff0c252d58b1f07400c745d0b6ac4d9fb927f6c53dec97850266f3eff0feb60dcd0842097735726b6d3e9bba1399018ed198f52206a67412

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
fd86227aafc3e8a171ba695f74909e72

SHA1
7eb490263dfc8f493bd2367bc3092cd5d25b9510

SHA256
13257af88ee78a6a0d17175d7bc466873d92b99e55cf3eecb2fc7220bd4bb69a

SHA512
5c8f088ed476e618f43d7d67a1f15b10f40680057d863899c9e07aa9b4197cd46929dc37eccf164d15daa8fa28680125d7e162968992542957153a1c2443e7b7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
b6435261a486ff09d20fc9224615c7e9

SHA1
19eda06e43d063b615455c9de8cd047c1b987403

SHA256
a2b6269e8bbd3a0fdef66bec8f868a68a44c2509c39d8d6a21899b002e2ee0a1

SHA512
4112b13d4fed0b994cb49daaafd95b12176be7ab3876a2ec4dd7c55fba68b8db3659a1aeb23a9de3fafd929ea3813fa606917a83b330916c7764a13f81cfaf4b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
3014cc81059ecc8bd0d465a889595140

SHA1
182505b1355f104d79eca48127872ed321623f1b

SHA256
98961403f47ab3da36d57a0c6874a1c499e4438f3662a4a94b9a1a135ca0bab7

SHA512
58604d19eed3874a4f2caf356037c0c6569a9eb10b0c6f5e32a58f523fc2691a31b7c5f68c404320d3ddd78462089a1f88af8fa34ab76797117217106fa2c5b9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
8dd50c80a52d221f02b9b6e4d363df22

SHA1
615e2f282977c3f019756bce53e83ecb2fbb02d8

SHA256
2fe509a676f6a4f38004b1fb26919ff0c67d5bc2cf53e02e558f5b131a9b4168

SHA512
e8203093e1b7b8dfda364f5ff85184785e9eaf352677175216f25745b5da83309adc00856b02bd8f84e844662575b9907065f0da542950d1c8e7585f2c0aa347

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
041000e0a9f661988f14722c8d5db166

SHA1
2282ead24811c38ab84bd3a8166e3cada02cfdd7

SHA256
b7eb63866fe9e48f7c0bc68d9038c374e8e15810d5ca2e201053f999c40ef928

SHA512
d6cd36fc4db84ed569763d9dce09c4a2a5c48f1987636a71094c7d9b9f62a3cbecc342b277427d380556121cabc35faa55a77f7d15b01709e8f9f90578bbb108

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
83af452aac6e93ca4f09458bb26950ab

SHA1
95d24ec548afc00abe397e3f8a1a804d4c16d839

SHA256
424b21dbdfd39992263a41724858a6ceb06f5957c87de44075dc0c802e8f82e7

SHA512
38bdc3168af8162cfedca83cdc80b388ee1e032fbc335d006bc466967eae0651b5370d95b1eb65cee2e460bb37cb6dfa2820d6d8b6a5239f3d3a4b895f79f9f3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
ff04933aef9e18ce158fe377fe9d9af5

SHA1
66235d91c818c339237d5410cafee1638b0dd83f

SHA256
77253c756aa5196e795fcfc82fd95031d5b9fe9b3844996e4dccb7f0299d3923

SHA512
a32d4a01975cf906c0cfbc0004fd3593dcd00d09f0c159cf2fbe9722571c9da8c6765936205c6c53170a9293b916001fef5e01d59e95dc4bdb9de7e847042a53

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.enc0ded

Filesize
1KB

MD5
1db07868510b419971c4161266cb6eaf

SHA1
1c8f4247a4129bb053b3726fcfae07b89d15cb38

SHA256
a6a7308ebcc7c4d7c322f918ca13a3dcd41bd3fb5144f700f59006764e92daab

SHA512
41fb16b2968ebdc92b3642364da127ff1761256aee6cc0d0508638a25af23518215e6061fb92b6b0caa157908327dddcca70cb2766ae69d43b583f1438514179

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
4472fde1fc35a27242fb47a16a7b2717

SHA1
817a0686d88bff36b7085545ab4b87862faab760

SHA256
dd4d293eda4379971d2327c3668ccb1ac3a8674ca09223b2b442b3722cbf0a04

SHA512
3decb83fe30e7ca8b01faf422720d8469ab0f4fd0c56d2a85a4ef9fced05f25667500b952d0113adb546cfa26a80cc04b937535b22b10f9c7db061ad75411567

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
55761ba843d801ea1d2579d95cfe02bf

SHA1
d1194dfc206a1e9760f832bde3afa69f450b6f7f

SHA256
6b25422fccf77e2d60e4d72503d7605ccb69349fc337386a1bd2b4d4b4e16319

SHA512
2e2855c9c36c71c072e73f22b238a68615a09d6c5b361d59681ee194b273c45841e42e59c0993bb3f828898703d8f1aa4191500e2f064543e53abd207c212000

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
ae62da143fd773f5039741dba3d24955

SHA1
4799e118aeb6cfa6fef8082c821150ac466b0fd4

SHA256
a103dff570c8dd0342da3530fbdd06b48b57b4a98df155768a5b41dd4ac3f352

SHA512
1767332425101647ee8414083ea1233d109a5ab645644fecbda3f9681e667423298fa7eb6a5cf3ed66f3ca4e66d6d2229eb4e59bf562a795896856fd6efdd7b0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
daa0ca0117005b734a7deebab4708d54

SHA1
6998a68dcec1596a53c281268f1fdd17ba0dc747

SHA256
7e61932fb455bf1f6f2151849a7667766e14ff38f9ac66c269cc18a5563362a4

SHA512
91bd7d80be5f093d85cc79431a081dfad44d8189e88b7aa540abdd0ba5b0644866b2a2b688dd355247c18f3c8fa38eb03bd1b90b8c97e66afcdc70a1ea1677fe

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
94c8d0150c8b9531c63284f9b9588f9b

SHA1
42ac6e8470ffe913b628b32f9597f8af239d807f

SHA256
fe7feaedac7685e141198caa0e08677c1ebd2f8a44ab52bfa2b06fc8edcae726

SHA512
ebbbe54b3f0d42a1460c069a0f06296bb01e6b6ba87fa7620c9fa4db47994eab9024da152fcccbb33262c34531ffde8482bbc0cd068e619866e1fd660484b134

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
8cb20523250d756b46d75b507e0193c8

SHA1
187956a1a35586bbcfc5da898191038e0240c0e6

SHA256
396ad4c593529740dcbcd7ada76b837228f3172cc5996c0e76020bc75ed1ede7

SHA512
7cff7a8e0deba799425cdd4851e01a0ef41c2acd39bb9e65992ac2c37c5d8cbc78e2884108499bdc0642c43e80869e4b5554d80c3638dd0287e0dd6193df4f11

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
abba3b5b15ca96793dc69638781f565d

SHA1
623bb915e22ab3a5f637f53b221a361f01902110

SHA256
e148c60cff58aa28a70578a0675d16b50bcafe846e216aa324c913ff2480678c

SHA512
1afa4b06f486ce82de9484b02d422592659baf75c71211cdaa4cd73619081a766f4d493085dad90e695e0a1464024f9af6205e7db76fa84a4445dc8409292c94

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
a7a71928e8a4b1808bba63aae9119042

SHA1
fd1e5ba035bfdabd1d9dd6e01fb314514c81c031

SHA256
5fa40fdcb6c484b502c7e234dbbbf7f90b45309e2a611a6e4875d816b5a167cd

SHA512
2650f5d79b5dbe7ce465ed58a6c55530eb2dc59ef990a907303cfb414ac5f7c8d136406923212df3f6ab67080810153677c33fc2e1d61405b6711eb60acc5c11

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
f7da1f5c104799115e159d53324b7f90

SHA1
8509aad211d3654a3d6d897e76c81331a747ff3d

SHA256
85bf75ebe79168ff9e0293449a612ac29551b2d848d77aee61c2fa07cf7eb136

SHA512
fdf927a866d0c2ad297f071a35734bf015e5e08b0e5b3f29e6e47e86afac82492ddf43f6b016353706bea6e7b8d83166e9c1198ad1fc11e87274c5268f3ff682

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
10e19391b02b772f930bfda6728a2386

SHA1
dc557809bb031084d4ea87e13e77ffcec2fd91d1

SHA256
f39001e4a50e5771c6b5461e606601eed04c159fc8fbbd1285baf2888e88c6b4

SHA512
49d5af9418451276516492a19c0325b886c8e03572379df6fb7d03fedb881475454a0e3c84a83e416844b90e017958eea9c3f9f6d9888f86d83fd2265fd3f3c9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
f534d986e9e1f052084300c4759defaa

SHA1
2186aaa2833ccb271e4bd12657cf66a92cb74d96

SHA256
a00de4ad9df7a6d01aa5c34d6ecf0d9ce02a68cf2648a4329ce185d7514ef6df

SHA512
9526943418da0ab6ac3febfb7053efb6a922fdaef7cfba66ae4dd7ddfb479c42074b873131166b2aa954ab5f8c3deb69c7e9f194a3b7f1a1cfec295e8c9592c9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
e864ed745743e1f729dfacc06362e057

SHA1
0063bfdc8c9bf88d903ae2a35baf1e50d47c8195

SHA256
36938ff5fc1f4c0d588882fd1d78f07601df9f12381278f8d07f442ac2c06374

SHA512
1f67721d2dc55643968e84fb21883b4cd372099057e47c1e587274f0d5e8d9981f3c0fbddcefd22de3a629ee8ccd4f192d1d056158e1ce3ee425bd36ef7e8038

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
256a146e0d1ce76146e769c07245f464

SHA1
66f3091eba9bf77f45e381c3795ed65fa8fd21e9

SHA256
8a074cef5df9381133bd5e3a4efd303dca5c75e0e619df0042812a3e3d4accd9

SHA512
b6c398569dd444e926e0bb3892f96e8f39c29d2d68025d5081389d4f39657d8659868cf190fc81d65684283287634a7f3e5e6a2a82fcce653e2399ce910b13d3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
9a16802c8791df35e7abfd4302118767

SHA1
b531f5f7dbc2d0755cd33eaaed2b00c26208d903

SHA256
2e1afc40c1e990824069d82406f0a2b4f3aa00a96de0f50f1a18bc19177ffda9

SHA512
1a6f4e26972fab81895af0f73d83926e46d2beb1566288ccdf5d82547e362cbdd21d5037ee389f09b9b41301febc2f613134a89c9e53a6b2d2c05e422b96eb3b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
3296747b510ddf1f430cb011ae722796

SHA1
f04bf06b7e729768f57f2617fc9c8036e7c058df

SHA256
311c0fe9ab680925a462bdafa1685ab5a6f718750eed4dd8f74f0076f89ddafc

SHA512
ba9260964556e1a0ca04214117772c9b373301eab5501b320393a323c2e25c0134fd27bbbad7dd37221e5a30857245ddf6097398735f934db579356a0f3a5f60

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
42B

MD5
9faba97424a6583449a30e5597f83cfd

SHA1
e7b9dc6519c25593d6a24928d45296bba1415649

SHA256
daa364bb9ce23201a21b1308fbc7f9437be777794dbb940d83c812bbebd609ec

SHA512
fac781967233c4120c500654e50891361ab97d474ea243219268e6d3ec395923b261b627b8e8546ae4fbae9f1efd830193ac45b0acb2f7df4a3d6df8cb94bf79

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596438811717470.txt

Filesize
77KB

MD5
7968b5c99276ea5da0510cc6e686b5a4

SHA1
e79f0b4d38868a607572be46e637b1cbecb671ec

SHA256
7ef08ebfb74dceb86e5e5adfc4365523bfd74b79e867db57af4636b30bac8e31

SHA512
6af5d866199073805592cee11e49c6c8422a102bc34057991f937db9a8ba81f41fe9c94c93ab66df98bde7c90436560c0cab48fa90907e64c5407d8d46de0bba

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596439372677212.txt

Filesize
48KB

MD5
64cb3908cf080e49972bccc6a0d7a934

SHA1
137b22e56c1337510f2bc744ac8e69b60042fa06

SHA256
59b8839d4e1c70c1b2016d67c48e4e708def8107b75e64328c3f737324b7d6df

SHA512
1cf82a42f7d5ccc9c9acfb93b57a5b285512f8d8ec796378fd3429b38c629cf12871439e20c31c31d3fa2b17001b8b4c5a2952783691d5b929490309f630e14c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596446339488261.txt.enc0ded

Filesize
63KB

MD5
45f96f23ab7086623e20c6208ef09869

SHA1
bdf2e2a3e140b2931a3016aed777f3d6b5b8dde1

SHA256
f701fa9256caf7c0a44f9045ab9992523008e1f0710c6b20ab925622aae46f82

SHA512
1ce10fea110b176b51820f2bbc83e6acc2e25b5ec7d479200c5ef43ceabbda7ffdd418eae8b333ff6ff118832a570aa7c5847d68aaaabaf5971eed44960bd897

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596449526171674.txt

Filesize
75KB

MD5
540b77464563f820d8733cf4a527143a

SHA1
e747d5ee63f3c5ce68c9a721360d5806b5690b66

SHA256
774e4b791f6877bd64eaedd3d8fecced5c58e1a5b56c1beb40103df6f543a770

SHA512
8b480028c8b84622602f922d6dfde1099753466245f4a8a43072ef4e8f2018de68ef4177503067672bbbef4bad33e7dc62a33b2468658207e72ffa2c93ddc0e4

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
4bc3facc15a3b346c9f7f2650b2e774d

SHA1
06995b488e0b33454c5e709427f7bacaad7a5c10

SHA256
dc2be168bcceea9a858396325cdbf13cb971479e03195e3cf3275d6cf1f92933

SHA512
4b9f84943764584b5fb25de9ceaeaece3d0a5011f0ebdd4192bb327a0dfc6d275523b4a0e4374cf58f06b98a37c4ad8dd4daaa9b6325303f0502aedfed1522f0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
a729af738655e2ba2258f50e47169049

SHA1
dbf070bf81e479b5bacac1a5706d1c2620386c43

SHA256
9958611235183b636b50d02e85b1a3aa9a07a290acfabe381b0b37d10af8bbe9

SHA512
377d9cd60e969cb65fe13a047647c28b4c7cebc34b2171c0dce7143f79c79cb12187e1971c8ff0b144987f4e366f63c09256f4882b9af616813998eed7b94f43

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
69cb72ded0283f2198cd05b219e28ec3

SHA1
b96040426a7f7a6f7ebc7b44986d71ec718c1568

SHA256
acd6ce9b4aedf156c09f11aa3f7c9a36022739579d2378e6c1a51ad6618266f2

SHA512
d25e51fb37adf31ec3d71e6f6c35ebd6f57e7849ab8f219fe1489377b5d7f9b2995a979474eed947f5ee7f31251e8643ef69a2141ddc8cbee928e61fd1a180e6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
0c9d2657deb3dab0cb4d7c71be3a6504

SHA1
7e9179dfd17af3dda0618d8d0c7157fe466b6ecf

SHA256
6b5a720dd4f4858cf2d624b062b94c1621446edf4a54994976372a878bcb1eed

SHA512
e052ed915a4ada3670390735ebaa6fba7062aded911553ac6c0dbf005dd3bc0394f441f91525e6c24b0afbb933f704980bbdd647f65bbf038827cd4bdfc29b1d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
6a77512f7a8c84d94aad0f89e7e0265c

SHA1
09fe84a1284f758ab766e3e8f9122750808850eb

SHA256
c4e251dc98b2bb5ae310b5fc3e6509ffb1eccb40da5aa3a403b5584d685fe0f3

SHA512
17b854c3790787be3801341df7465de528dd26e0a1c9093ef7b8bd103d0123642f9f554f348eef1ad8fd7297bee1eacd2e6d07a2e658533f75ffad46a3315408

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
711c4282c3c91192825bacb51ba18b72

SHA1
e78320fe0591ae0249c197c701a4c42c5d975a6b

SHA256
573db3696548f79086e13e58491f74ebb7a03e0d6e32324895dd176b2d621121

SHA512
9fb56591ad456f925c196afec291cfc0bf77377d9b89a6f04e92dc2fcfe42a05200e3e28eaaa731014d022fd4ad22e39697c07f60c6408ad58b0f7c7e6d818e9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
d2bfbe9295587d3186a2afc6a00b509d

SHA1
66d1fb64a881752b04950fc50a0ee7b1e15733e0

SHA256
786a6a6c705393ab3e0ac3d948aa3c85761a4053d1b592ef842308049a92fa25

SHA512
2a4ab37895d53bbf0d5f99fa95a271a928b284eb69e41e1be04632ca515ce6af924ef5334d14d42582c16255adb8829cee4ae586185127bcc9f89610a3adcbc3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
c0ac1e83a11e7fc70a87269593434568

SHA1
b19edc952fd18d0e08ac5d42ae323a9dde3fb936

SHA256
ba1eaf2ccbf704117c8c9ea8723d1226695318cbf4cc4796b121e5ae2b686129

SHA512
def048917b3fd92cfd7836f8f54c47d2c4c6fe463a283c693384d76ade7799df2776f55294947401496cb599d23e0d0c67bc9e6027f901e89d7a2f2d8bbbc4f9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
c5d189af2d8b5696cb2d2ca4689f8661

SHA1
35b214ccadb123a72952af3a50a9b0297c3f5127

SHA256
5bb5d1f6623387b663753e37aef920af0e1040b8aacc004bc837e9d9bca397ce

SHA512
b8c22707b2b4c7be1d875284140a84724bb7a3c06e3ce0485efeef7cc7c426d491fc05cc56b677dddf596f2bbfc3284e75fa8307d9d72c12eff14c96d1628cad

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
678aab4cd35502e8aca3f3fae6a0d210

SHA1
78b4a16db8a68b6d6bf109e506b0b640407f634f

SHA256
76d87738a5f6f1469b685a532251e8fd8e86769006827ea601130d3bdb40f516

SHA512
d743d777a698bd8932840c94190f97831370377488f80ad6386cf00111e3bee3d98be4e65de2a230b8c95e4f555eb376b7dbf18943a4e696d580cac1e0a0c71b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
84f5f4f00158c3806f18e269652c9ffe

SHA1
50dd1bc96837c38a20283f792bac35de53047154

SHA256
901211fb4843aa48e74466be65b859ff544e0f9807aa82f563f575672ad888f6

SHA512
18d4fb5bfaad20b57a63618eda2f59ab26742701e907d1d6834de4ac16503e3df468caaa7b9742d46134af0869c3ef3c8342ef252d884cacc79e8c021738a820

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
7113ff941581d685c395c826651c9b66

SHA1
31d253aa523f5064db19429fc18de4007b1e00fb

SHA256
983055729e1d53375bd6a98493c71a7d5e36f6149b75644181cba9f3633bbfdd

SHA512
76e73194fc918ad065312d9e5334c9268ca4d0ef68748e50c1d52f9c0f319b105c8f201cd41332c1cc845a5dadf5aae9f5a792d7211812b0993affa7b395a90b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
0d6e5d6a5e82b2ec599e0016a771e3c9

SHA1
b7a8b3fd432b18f16d788beed1f076fd542edfd9

SHA256
fa86956fed6a512cf5134b384a017c13de9237b6628c3f3a2b4198511eafdbbc

SHA512
6e3654a1535bdab655be2c13068878a1677ad8086570547ed435d8c4fda468e7ce8b7e7fb7325552226f24f505de7624bf78c9ec980fb409258d7fc624d8ea5f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
7f9a3fdf526dba1d8b1a7220a7fb1897

SHA1
91cc315e1c84c516046f9ae1acb405b506ecc009

SHA256
50529e2a5ba65e5f2d320849e9cd1e98cf4ae89c062d0059f40e41932a2d069e

SHA512
c1e842f82aff73061936bfcaa30190d34f979b856ef9a57206831a92cf62f50270ab6c2e07c224042fd22a5cf66ad3eb0b58cbcaa28f42e981b5de96c87c98d9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
ec50d1cdf97f0d103a35f88fe62e36fa

SHA1
9ff9c5c7dd641eb1fb52d66b4b65908950be708b

SHA256
8b3e56fdff4608c85cff17b6b3c26fbf7aad3b1c5c14e2b79ef14c845a3e9043

SHA512
49ad19c83870a5fc7a19c9cf870a21deaaaa309be8e7f42c47f10112620c100f137d992e3bb2e3f614212fcecd7a01770163002b36e459d3cfa6aa712b23c685

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
8f670b66e2e798da8beac6fe0f7ac47c

SHA1
3121b017bd092367017e4bab17ff86e1991527ca

SHA256
6a6cb9fd6fe73449d60c4776e0231e71a80e134b35a1309da131a636f73b715c

SHA512
be951af29cfba997be8c6c910bba8b80ce8e8d46709f038139724649874456bc62e7c0a0c7b75ac13b3697a562ff96e021f6c9604df87e7650a1dcd689b5a0a0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
99da6eea91824fafb8b93e0bebaf632d

SHA1
e50aa605bfc2b1ffeda722ca6c88308e6f2f1911

SHA256
83089636d004caa0037f21526b2e1947787390d143867671c155c88ebf0888d4

SHA512
a428465730b0b4f16860e2d0fa76871437c0909035ba1bb2d0a5a18946f737917bbdc0039ec293a4a25beea348796e7983923224ae22d19f7b9d8243a28c794e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
7d6e077ce111bd910e9f9960c4860071

SHA1
d60392ef0a04178c83e1f5858a5f5770b6e53ba7

SHA256
0b5070df976775ed7116fea3bdd1553bbf75309e08ad7134b26c3b763db57996

SHA512
73db765b41a1aab1c4b66fb5c96f9efb4552ae2e02dab50ea5cb4726fa59c0ee55a72c4b85754ff3793034c17cb32120a8216b314cb99255993f55e5d2f7a971

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
31dd84f2873edd77a1d2afc4fb3db204

SHA1
a12a06cb1869cfe6f55f17dca9e4b907637dde48

SHA256
a7fddf140498fc5b8cd1c25babf073d10f635190b873a9f636ba7eddef7d6b60

SHA512
d1aa9dd9063714b7cf4688d7783aa15b1d65bd2664020fec06f1f0c01784c24d756b19fec39f62fa8c830d9e5080e55deb3629cb0986d7f0dfa986dad986fbba

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
7c2cd93886100224f7bcf25f40b903c4

SHA1
396961880ac1ed25c10636ed156d479c39ef8f33

SHA256
90b71a305c7d512209540ee0bd26bb385d5140699acfc09f776c1bfd44625c12

SHA512
1d254c85c32a25354f64d2db0820e784ce92b6b0a20649e75f953dc3aa8ff9083620934cd4b873590d394e362ade6ed2b7b4775e9844724714ea735d79b84a4f

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
fcea660be688452e2c274bf37f19bb63

SHA1
07d2654fa890a98760b726ad37b5667d03345ad7

SHA256
258979840542f727685d807f467a941307b4f20128d5dc812e030f4545b08b7c

SHA512
b4d773ed7668d777881b1a6fec4ea71be23e7293c32f19809b57855efcbe1fc217b59d63b0618ecb374bfc9ce207c6a8f2ed5a2a747187d9e0b9407860a93884

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
5b46939d9ec3f3144a7e73d7fc945502

SHA1
615926a25a2b22c3e42698cdaa848c8da3a4c0e9

SHA256
a797daeb092cff5d44d7aca7d4f64b4522d5fdf77c2f3e7b3faf4a2af7a1bb44

SHA512
8a2c79d77640a59ba6cf8b477e29067dd94cb6ee647ce9970616294acfc0f4fa3d20216ae11e4c86d02bb96171514f79d4916e28313af2c7d9e27a29282ed70a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
6599b254b14eb83cb7f3f36b089aa68f

SHA1
31e9c831f746f39368c3a4f6acc8e544c99f49d2

SHA256
142f895f413d7ce2bafdf003d88ac742c3362f4944bd4c41d5c58984c8ed58aa

SHA512
361397e5c15ceff6d41864e6eca5ce3debae30a3d50bb558a0c2e79532d0d34da633b8575b2666476df5af90495c027202c00e12c9210f5f59e2426d120defef

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
2f330872e138c9e8c055e33c6458975a

SHA1
ebf559f8dd7b31c315b10427fa92cdedb6cb98d6

SHA256
5a4b7122dac23c0e1eaa57a410b55580b057610ff9141ea78a3663d9bc3ad76f

SHA512
6608a13a7f85b3b28a1b0688ef0575526add36e1797fdb7dc89ed0b42af2714ec684026e6fc263ef5231e3e37b4297f349b9d505134b1f0678770b1eeb92698e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
0c166750198374f930d0bfe915a05e74

SHA1
45504882e3366a0abdc4850ecf25f6e54857485c

SHA256
2968e99d3934e454893175308600be3fe640e30d2d3e70a07c9ecc99ccb58e08

SHA512
8c1286682327fff8e741a566b1461ac3cbadb78fc99c967af88c41dda35a6dc46e65392b93f66d65d2bbc7fcd05a975b5904d87bba3ffd3d252987b251c9b4f8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
7d163822af976487867c9efdea1ab935

SHA1
9da3a726cf61a97542aba8aa4fcf208032f19da4

SHA256
0ba5eec3804bd3c09540ae9bfcb63a2e3c7dd9b97e8bbf9774823c02737915aa

SHA512
961d43984bb4e9a9ee2ed5f00b7542f90bf0e351bbc88451d47f3c3707967cc7cf80fef2c7f844a25b5e5a7ab6b81f32a6d06caeea5e7936f69040075a1075fe

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
e36127387d01ef52462173738a201d29

SHA1
dbfd8b5fe6da4fd1eaa7c6973b17aa250e4f9a98

SHA256
204da41fa5513429025791dbaf2fff9213ca2e78ceb9302c3de61eb750827ce0

SHA512
d26fac4f1bd4fb547d4ab9d50c0cc0d9814c45d9efb28f9e76e8ac852f04d70a908b677963fa1d0c7b6fd3e8bd477c0b8057915649b6cceeaec4d7c0163d9f36

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
54cf9bd437c8921d74e541a148c89222

SHA1
0a4ca4a55b801ea266a8ef5aaae09e98c8b0ba45

SHA256
dd4c26d4eaa6a470108761f8f2451bfd865f43e8b1f445b1b1244bc181a1abba

SHA512
3771ddb425201e39efe4dd7752fe2e265945d1ff8d1b137bda0b2ad3e9d0735ea4b1bda214a41d330fda8c09675d8b3fb61297b0448384ddc23f4cf70450f3dc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
bf2e6a99253ed9d35d6153b7a5dde63d

SHA1
bd79b3a7203f6ead4b5235dba5728f3d30e6f7ec

SHA256
9f348a3510be82a07ebbcb08705c2570751cf1c36a5babe637730f0d26dbcd93

SHA512
a0f85237f9e38b06ca7afd3911b4bb41f04ff4aa977dde6846a1dbf79f017ba7a2c9a0cdb0941e9b3716793af361fa4a878ecb58ecc1a72ecdf2b14ae1930ce7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
5dc82e9502b964acea7d60fac7e8b903

SHA1
49f727a6333a80d2b7f1be06465baa9c973b144b

SHA256
d807befca37e88eacb870ab61b2aaffcb0a22ce0b7c16de89a40bae714a24ff8

SHA512
691b8c616bc2232edb04455af2bc6e1a09f212660b50c02647440bbe2911368a66633209f89dc17c502191ed0a9fa1c0813d0ed0e6ef6cf6eb49de8d3f21885e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
def4ec3ac0b71214904bb68ac6137f84

SHA1
ef6681d60a9b3102f3034b9dcceddc874cdeed03

SHA256
304ea844817726ee6d2120bb23409491b45b992a308560b50dda4d37adc06dac

SHA512
350dde0e239394360b9bf97e98b65aa322808cfa3f86fc7c2bd7dfa666b48fba04b0f43a0d1a769f725aa235fd44ffdc17a21bd4f88a7a8b352a9782ea2f1a63

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
23324af99bbf705e15ea60da88db95cd

SHA1
68166de2492522380de0f3bc734e7e8dcad2b83b

SHA256
d23592fe9b279f20c4c0219c21d0d707152c848f6ffae336e6944a603dcca346

SHA512
9602d52f410d106a16d8e871244b09df1b9b0231e42cf6839801174a58582a5ede6938e753324d027eba23c913a3e9580b426e55af58a6355fe66ef202b50531

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
707e64abc32e7d4ad4c12bb0ea58db93

SHA1
0e518222c179d3f8f35c7884762a1d9dce25cfb3

SHA256
89d1c822a7786e0543a3a1891a5e38db6f704c977d9e22f7f0719f80b5d92f3a

SHA512
e50d6eaa2f8a2aa8d5cce80fa3afdf3881373440377d42f7139ffedc3219fada19249c020ff703f8c68d9c271e5687da824f1340d9949c5b9b12e18a4ea5317b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
e279719969451de99a5b7a3930e0fc73

SHA1
e403401e02d01ef6b92a74fc9b83ecae0e111bfb

SHA256
51f9360da136fe6298ce3298d9e18d0e7a65a68665bbd0885809127d0bec2d09

SHA512
317bc355bb94744b4a19eccec4736b9e605095f937a7842aecae6509880ba92b4f0b230a8ca982634cee90439865944c4a0e75e9b2f4f5d602fe917089133647

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
d7f4e4ae6e7b6f24e370644776bf1dd2

SHA1
fa0a486c9912261c607b7ccce10d5d8614235b39

SHA256
5915d7e31475d99194c9651cc288bc4dd4d8a7d9688731215a5e0ac9122f428d

SHA512
21305427c4f12ce5dc18344c1c07c6e4e2840b86c1205aa923594936dcd46cacef618f05296146ee1ad070bf8fd8b65a1a9305741a2ac07b3e90921de1e8e223

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
fcd03940a2c4cea1e5830038051dadfa

SHA1
d09e3d2d68171f5f6841a99e7d8ebb7fef49357f

SHA256
79cd20114b1ccb2852cef8073d4896b01e4626945dc7a1f674cc5bfe24c8c01e

SHA512
32734269e48a308166edcc91f00a0e0d686c44891a165ccb1fa74edd6c8d8b42d85148b03020198266010c5b1d2792b1749da6ffac9f98b68a831370bafcf3cd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
bb78dc1b5033ed0ee2a08ebfa993d332

SHA1
8f353a9eff1f62388571f7826c35b4de7904d5d1

SHA256
583256222b78d0b890c9f0c3ac32e06677c6419a6a27a268ceff095dddb8a755

SHA512
da18bfae23dd0b964ca6575b11febe3713a50bc16136ca9394363bb4048a11fd0b6155203078dca511c52b45aec2cf5cde9b44ef378a4aa3a07770dde066e73b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
e5165fafe9b310c5e7244e46b4fb49da

SHA1
1aa7bbda2a4416e12e26f6e4a65389d22f0eab83

SHA256
1b7ac0d2bede935867087711af719f0266f4c84198cfbe42381b4a68b95488df

SHA512
94be67118177d73628c3f794aeeba9b5fe7c1f2bf4a7550e739a4a026e533046442e5a2419e07763db33214b2c280bcd492ad4aaa98c0903282f8f6d752e1aba

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
6c42876d9a5809df19a15c13c5ac854e

SHA1
f4fe83db57a6868989ea234ee28c1df0d888c437

SHA256
0b829be1073ceb8c040ce236a706432fc4d7fe8548baa1092432d9c83781e3e4

SHA512
2ec46584f595e6352c6e7e7809e47d84050b66dc863eba3614c8fd05ae091d8098453197e86c45971325e38c46cec9d26508f04c00d40d8c4af3382d7cbdd9d1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
3faf1c37f1e7d3f10848ae4db6727fb4

SHA1
de9934f98e000b565790a689e278a7a66eec7a0f

SHA256
d4293a533ef4302fc910f8bdb93baa186dd849a30d4ad75dfd47194674564285

SHA512
a85d98d1c553d42e374ff4783163044d08aa5da02247ac2fbf4f7b7f79eae87658a5388109c8cf510087b2fc11cc7fef095ce017faa9b54f54cc422fec284cf8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
b6d26018f34c0798029f6d27d118a6de

SHA1
064d937c58f06bcc8aa50777d849b201be961791

SHA256
34c676a1a03e1458bf83ac88cf300e08455416accfb2b03d604c9aaf06059712

SHA512
9644404febc280f79955b76a2a07ddff875beace46ab7c3fe0bfef5230311c88d871d2084dcfe46bd6d7ecc8f1b0a81ccc339c0f78f248fb0cb5c5141ee68569

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
a71617649de570df37834db8f147b5be

SHA1
a445cc07b4329a90af39d6113a077aebd8dadf5c

SHA256
4529f6a3766d785439eaabecaa34ef14ba36663fdb028fff783db2bf2c6f4e67

SHA512
fbd0132eda6b70a3961b1eb1485897be70d5d44c14ea7f4a83028274ad5a1d5454281255700860e1404ea25d79bb34011f2ff31adca35776ffedcba0aa090c11

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
126789a98b77fc71eba1ab54ddc0c28f

SHA1
05ec8c0ca235b93af027cba743454381c72522b9

SHA256
2002bb0f8a97bb69dda4c21b9a3bff5b1904b49dad21a78ce07ca69b1da6d3c7

SHA512
bdef4ad8cea3d55d502c2b5382c61117b30f4a6a2cc568cc0ff80c1dbb2b03340658043657d0f26ce8abba4a2876125cdcc179d19299ac7436f74c768a07f1ca

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
e5496046a5693d2d6f826a97db3e6456

SHA1
269a3f1498031fe5164592f1a76a102345ba5807

SHA256
b9835a406ec040df101168d8d880986e6899a72bad9ea61dca3acf3197258a69

SHA512
4d0748d6fac3c63a089ed59f6d2a17c2ee2dc4e6a901cb5dcfeb03913230397a6ae215280ded0617193a8a7d14137a170833748e562b373913cd849a081d2279

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
d9f3d400f817edc1b3a7fa6b7fab997d

SHA1
69589925129cc4ac0e0f5c7a4213c21e80c7027a

SHA256
ea18fb94e07ba08ca33d10fc3522e1aab7ed54ec68cca6986f9904d423c49e5c

SHA512
bf9caecedb4d83da490eebf541118ce93ff7fd15e5ceb7ef911ecf68fba43bd849d9bc098a5934042bd8eace6dc3864a81d285af98a9fe244695e8938e6e8161

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
c546d7c49982b7f47924fc5dc9ff02ec

SHA1
e9c88831b4ba8f33b1556ee57e5425326d16829e

SHA256
fc82f3332e0889fdfc3fc94d7d65a396334d3e14b28e72c1065b9629880dc6e7

SHA512
4f66591e8c804ffcb8443bf9c9578ecbf8dd348e6c5e9be0b8c1333bce96a3fa539db818df8b66c8524e17e3d1eab371630f62fb3e70dba16ad2fc0eefb08871

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
88b9a826f8447bca21adab7439ffc40d

SHA1
0280c9ee60ed747c78f2c691699aa782ea673e5f

SHA256
fe7081c6871eab85329ef89bf45e542a333d63c70dbe2d9fed27809c79e2da4f

SHA512
084cded3e2210117ce66ae498d16dbb36adc3b043f78a0aa07a84a2811a7452452c964208418883ba9b68a8c3e223eb27dab5977ec048dc84f3f94e56bbda0e1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
45563d89d5848be686653be1ef31b82e

SHA1
4112630cf9a18822a6d66801a1edb13d828e49c9

SHA256
08298a375e7610927185ca652849520a69c4894f4fbff787ef7e1a36573a32ba

SHA512
5731c5e8cbea222f57d913f681cb8debb70188b3f91389baf2f6ced793b0f282b935a982f88b19c447b14d46312cec254d17eedf174eb8a1adfaca0c4d193181

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
a1dd3e1e8442b24f0156a38585bf1a97

SHA1
92be7d83dc8c34146eb78cd62a8eeaaa7210a793

SHA256
c0ed13961bcc8e5713d3b65a5a9de7e1a547d9cbd0cc11204982fe9b22ee2141

SHA512
ee2c469a706046052555ba44ff99f2b51b073a167a100c96adf94f6b11554122cc5d321cfad9bfbad55e0c7b10576573dd30f2f21d0c2e4dc9940979e468abd0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
687281da9c55576539bc91bc837c321f

SHA1
098f721958d9516635d76d61e087dca6bf56fa21

SHA256
9d238c4355181e71e738f5e41831f3c25e16b659dd9907f467d63c969937c096

SHA512
704130ffae717234c4ef884ce1e740a8d20c20953c603689025a40b6dff375025b5dbd5a4ff367146093b0a01aa2c0f3d2203da056fbbcf7f13962ffa151c913

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
b48333385f8ac45c9819ffdb783f0297

SHA1
045fb999be3116dc4d218a02085362b2b5c61af6

SHA256
ddda9ac8a8afc195501ed90b82af416f5a8648066a2e30bac6f544af72d1e323

SHA512
536f2dfd11f19be48cd74a6469a44b5e4089e34e5fe9f711bc8c0a680d4da4e8e61bad4282b59df18a770f1cc6602bc560ced41e208f4ff5546e9e0024664253

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
f9161070ee1e77d89fa1bbe7b98ca6c4

SHA1
072c1aea003f9efafca5e902f731689b48e03f45

SHA256
f4857445751987f42ce2d6c5ae3c66362228d357f5685920d2c4aaac7b9dde2c

SHA512
0d3c091d4429025bcf962a2a8dd3d3a377bcb47bfd30913a4725b5e03cf10242b7e117c080df7d3a3ebb6fb48c8e2b19a6c3e74daebf26604b01c98b9e4e4f0e

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1_none_233543e4fce957ae\Disk Cleanup.lnk

Filesize
1KB

MD5
f1d22ba294ae6ba201253ef09a5b1aef

SHA1
0eb4e0145c36e919c0499825e7480bfa3b48fb79

SHA256
82541f766cf3cd90867232de303e7c2a7def369a40e098f02191aa736a143224

SHA512
f595591e652d45f0e8c3f7efd1ce1c1c3a41cb2c955a8a13c060857076d893a4d52552b2893d363693f1e1a3ede04d04dc3df39ef1ce21d22246e75e9c18d1f8

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_61cd745a990bcfb3\System Information.lnk

Filesize
1KB

MD5
6626fef62e96788593d293f29a5abe4a

SHA1
9936a56003912d100863316d3c02f5ceab95f22f

SHA256
c3fdd6c86893442f3842c291fb81e49b6dd790ad662756b76a9347acd7776dcc

SHA512
b973c2180de897871730ff2fe7f5b976edf5edca2c917ad10f0f241b8da9074a0696e025eb70b7fe84658ecf575230e9933503bfd6be87766b49911d590ee24a

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
ed4f746a18820305fc3a537f0334f165

SHA1
5de2fd0b18255fbec1b0a19e8b98a5f5f96da391

SHA256
7ffe5061d2165e18b45a4261bf3f776fe43626282fbd21c8f2a0a4a0d3b35816

SHA512
185b11aaff1546d3de76c2272bb2d4e6a84be35650b7f9dc3e792794722ebf7c017b8dd1c1647de8dcdf597d2ac840fb01d6a5843a1c85fb9b5c27901a415582

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
0067a1222258691350fe253084324327

SHA1
6e89ecce6819838ecfae07339e0d556a4d6e0a97

SHA256
3592ee2b65a421d0ddb1fa76b6b89002205cd28d3d369842049a4432d363bd1e

SHA512
251df85d3b57978aa6d08bb9695754bedd2a845756ff34711493495ac51a63f40e0211ac2c2f9bcb6230e465c752200bbc37c0433ce0d6675055ed3c2251ad24

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\squaretile-sdk.png

Filesize
501B

MD5
16fb9f46a20cc18aebb8c9ca743fd987

SHA1
508dffdd128972a4240fbf840fe828450400d6c0

SHA256
a97e428907cbe9644a0dc60fb33789165c68b8bf97c3e3de8d705697069e7e8b

SHA512
675d180067525a3e2d67c9444d7aedbddb92bcd80e3f322641101ecd0f01ece96cc2acc988d4a2f24faa951f659327ff9800413d96ff1856440721305e676230

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
55c082e5c753a3be7704ddf066d0e895

SHA1
ced13c44a19f82b143b033378d601f93b1de3388

SHA256
e45f697a81e1cbd46046a50597ba9af08e1d8311647d62a17402cc418b0f63e8

SHA512
8a7dff042cf53601adb5212f9bc6a21e48de61faf38096def0a733188e22b57d0141a7b2885ab426f76c40c73ed92fb0ef80abf0e469c83a7c14166a6830a0eb

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
c4be1ce9dc39fb83fd5a2d617c2a4837

SHA1
eca34cd429eaf350804bce704d19ea61c74fd54a

SHA256
403a36ada7f7579d09670f9b98e7dafec1c2e1beecc5fd26ee6b5fd0b4f2505c

SHA512
3e736e36954c970143a82baa806fa88a36db812d09c08a6ab4d19a78e6d0fd2c42c6b8e59b62f7f4c3fc7806f5b1d9f30e934b404de6465e9280300b034fd64e

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\squaretile-sdk.png

Filesize
501B

MD5
cc732d0bd874a5559714f32366affe1a

SHA1
b1b7b5585059d53f44d8e0dbfc260472ab658c71

SHA256
a836ae986ad1fdf66b57b8f55eac652b146a474835c2c0ee3a6afc945bd60bed

SHA512
3d9324b6ff7f7db2248f609f2364c515e39985e7db154df70926194ea141cc67a8283b8ec91b0c0f71b97476755cd272ab6af1d5b44c37f1b5821c91d18d4890

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
7207c5208fdb1ca4af6c22eaedbe533c

SHA1
ed8011e313846ff7f3cf3587b3783e088a4bdbd1

SHA256
2ccefb147874012327df0878c7de9987c0daebd0cfca882c9287cd34a09d04a3

SHA512
37449d0ab381bb4a13c3968f1ab5a7805ba04f893098a7ef065c592434bdcddec1d0463abc0ae6e570d872cc7ed86b1f1686c576532a286099a2625dc0c91ee1

Download Submit
C:\vcredist2010_x86.log.html

Filesize
81KB

MD5
6d39a8fdc5a8313ed27072eb0ad2b65a

SHA1
9e089f39bee069f61da7376f0815ac86359b0a3e

SHA256
e8da7398bafec2232a6ba4cf7822b7c491502bcd3cf39aa0c019df22fa1fd794

SHA512
e19baf0b15742976538310d757bbc9e6a610ee216520e6b3bf20dcd19880eac49700d54405db4bc364ba7bd82c9af8eaade3170e34bf63421685ec14013cb913

Download Submit
memory/5044-10861-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5044-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5044-11292-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads