asyncrat | dc1c36296633b9850a0d4298082721fa13d8da3216c4c3b6ed98fa724effdef7

Analysis

max time kernel
248s
max time network
255s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-08-2024 11:37

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Shellbag analyzer.exe
Size

237KB
MD5

08c6f0c11bb897315729fb8ae967dfbd
SHA1

98e123459209064dacec489ef24a5eec1392a78d
SHA256

dc1c36296633b9850a0d4298082721fa13d8da3216c4c3b6ed98fa724effdef7
SHA512

52f931501a4e2db2c2a28b22d271032540eb425a7ea1532731bda694e947360d9452ac186cfdd6b0ed21e21adf54ef7dac80504d257df17300337ae349e4c4b8
SSDEEP

6144:PJLbEwF9kfK8rpClz0KBb6o589GHWHWujiSPbQ:PJMgBuj/Ps

Score

10^/10

asyncrat stealerium default bootkit collection credential_access discovery execution persistence privilege_escalation ransomware rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

Attributes

delay
1
install
true
install_file
update.exe
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/m5mgzzdQ

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x00050000000004e7-11.dat	family_asyncrat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Renames multiple (3248) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	Shellbag analyzer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	update.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 2 IoCs

pid	Process
2940	update.exe
4696	DECRYPT.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	update.exe
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	update.exe
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	update.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
23	pastebin.com
24	pastebin.com
25	2.tcp.eu.ngrok.io

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	icanhazip.com
39	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	DECRYPT.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
5108	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oVcBLd9.png"	update.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-80_altform-unplated_contrast-black.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-48_altform-unplated.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-16.png	update.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Light.scale-250.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\CT_ROOTS.XML	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1850_24x24x32.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7739_36x36x32.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20_altform-fullcolor.png	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-48_altform-lightunplated.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlOuterCircleHover.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\WideTile.scale-100.png	update.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125_contrast-white.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.targetsize-256.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-100_contrast-black.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-24.png	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-lightunplated.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteWideTile.scale-400.png	update.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_DiningReservation_Light.png	update.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Dark.scale-250.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-32_altform-lightunplated.png	update.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.tree.dat	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\THMBNAIL.PNG	update.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-125.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\virtualAgentSmall.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLargeTile.contrast-black_scale-200.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72_altform-unplated_contrast-high.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookSmallTile.scale-200.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-400.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\HoloAssets\HoloLens_HandTracking.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp7.scale-200.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionLargeTile.scale-150.png	update.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSmallTile.scale-400.png	update.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_scale-100.png	update.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\SmallTile.scale-125.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_SplashScreen.scale-200.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hu-HU\View3d\3DViewerProductDescription-universal.xml	update.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-32.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_altform-unplated_contrast-black.png	update.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif	update.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare71x71Logo.scale-125.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png	update.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-250.png	update.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCacheMini.scale-100.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\WideTile.scale-200.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_contrast-white.png	update.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Sun.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-100_contrast-black.png	update.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-400.png	update.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml	update.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-20_contrast-black.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-150_contrast-black.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\video_offline_demo_page2.jpg	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-400_contrast-black.png	update.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png	update.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WideTile.scale-125_contrast-black.png	update.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DECRYPT.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2672	netsh.exe
4952	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	update.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
848	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
888	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1140	vlc.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2352	Shellbag analyzer.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
2940	update.exe
5108	powershell.exe
5108	powershell.exe
2940	update.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1140	vlc.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	Shellbag analyzer.exe
Token: SeDebugPrivilege	2352	Shellbag analyzer.exe
Token: SeDebugPrivilege	2940	update.exe
Token: SeDebugPrivilege	2940	update.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: 33	4848	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4848	AUDIODG.EXE
Token: 33	1140	vlc.exe
Token: SeIncBasePriorityPrivilege	1140	vlc.exe
Token: SeBackupPrivilege	1224	vssvc.exe
Token: SeRestorePrivilege	1224	vssvc.exe
Token: SeAuditPrivilege	1224	vssvc.exe
Token: SeShutdownPrivilege	4696	DECRYPT.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe
1140	vlc.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 3528	2352	Shellbag analyzer.exe	93
PID 2352 wrote to memory of 3528	2352	Shellbag analyzer.exe	93
PID 2352 wrote to memory of 1992	2352	Shellbag analyzer.exe	95
PID 2352 wrote to memory of 1992	2352	Shellbag analyzer.exe	95
PID 1992 wrote to memory of 848	1992	cmd.exe	97
PID 1992 wrote to memory of 848	1992	cmd.exe	97
PID 3528 wrote to memory of 888	3528	cmd.exe	98
PID 3528 wrote to memory of 888	3528	cmd.exe	98
PID 1992 wrote to memory of 2940	1992	cmd.exe	101
PID 1992 wrote to memory of 2940	1992	cmd.exe	101
PID 2940 wrote to memory of 4952	2940	update.exe	103
PID 2940 wrote to memory of 4952	2940	update.exe	103
PID 4952 wrote to memory of 1776	4952	cmd.exe	105
PID 4952 wrote to memory of 1776	4952	cmd.exe	105
PID 4952 wrote to memory of 2672	4952	cmd.exe	106
PID 4952 wrote to memory of 2672	4952	cmd.exe	106
PID 4952 wrote to memory of 848	4952	cmd.exe	107
PID 4952 wrote to memory of 848	4952	cmd.exe	107
PID 2940 wrote to memory of 5040	2940	update.exe	109
PID 2940 wrote to memory of 5040	2940	update.exe	109
PID 5040 wrote to memory of 4476	5040	cmd.exe	111
PID 5040 wrote to memory of 4476	5040	cmd.exe	111
PID 5040 wrote to memory of 1692	5040	cmd.exe	112
PID 5040 wrote to memory of 1692	5040	cmd.exe	112
PID 2940 wrote to memory of 4524	2940	update.exe	114
PID 2940 wrote to memory of 4524	2940	update.exe	114
PID 4524 wrote to memory of 5108	4524	cmd.exe	116
PID 4524 wrote to memory of 5108	4524	cmd.exe	116
PID 5108 wrote to memory of 1140	5108	powershell.exe	117
PID 5108 wrote to memory of 1140	5108	powershell.exe	117
PID 2940 wrote to memory of 4696	2940	update.exe	127
PID 2940 wrote to memory of 4696	2940	update.exe	127
PID 2940 wrote to memory of 4696	2940	update.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	update.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	update.exe

C:\Users\Admin\AppData\Local\Temp\Shellbag analyzer.exe
"C:\Users\Admin\AppData\Local\Temp\Shellbag analyzer.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "update" /tr '"C:\Users\Admin\AppData\Roaming\update.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6C23.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:848
- - C:\Users\Admin\AppData\Roaming\update.exe
    "C:\Users\Admin\AppData\Roaming\update.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Sets desktop wallpaper using registry
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:2940
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:4952
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1776
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2672
    - - C:\Windows\system32\findstr.exe
        
        findstr All
        5⤵
        
        PID:848
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5040
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4476
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1692
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\bcomms.mkv"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\bcomms.mkv"'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5108
      - C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\bcomms.mkv"
        6⤵
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1140
  - - C:\Users\Admin\Desktop\DECRYPT.exe
      "C:\Users\Admin\Desktop\DECRYPT.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4392,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=1016 /prefetch:8
1⤵
PID:2536

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
f1a895abf33b8438c2e9100841574c35

SHA1
62cced175ab48d28896c55c3d4724a5209fc8e5d

SHA256
d797e2cb6a46e84a1d270cb0e024710c75deaceeb0734c8fbce5d2bdcce1aefe

SHA512
c78648b452d39d8f7c28f72f450e47b9d0ecd24edd2876394fd935eb4d34af11b5e39acfab556169dc7bdb31756f3ea8a6097c1876a83936663211b4d7ca3a54

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png

Filesize
1KB

MD5
04a0a24e26d96a30a132f4cb946d35b1

SHA1
e373a6d318c013e13f07ac1ce39e78fd687214bf

SHA256
2a867ee8199472b874375ff43e1bcc72766a306625951f309fe1806d900a5190

SHA512
0f96fb7af718916a74a3985be0a64d8a0eda2a9d2c5c7d96ad1a831982daf7d200ba75d3482bfed1e106b741428f086ee3fcf77ec5f0205033c84d4c7b836f16

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png

Filesize
3KB

MD5
516b94ac4adba3db4a622aa4bebb43ca

SHA1
6aa8cd6062c7018505b03be986c9d9de1306ce8a

SHA256
a9337435b21b04e539e47b7840c312c27dcb64534e31460e96433b09a8104470

SHA512
31aed9491353df5dee23d07baf8bbb421a2a9cf5a27c5f2956936f0882c935f7f0afaf84db8d3cfef70269076be99e0a97f1f48b0ee4c1057798b732c5918289

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
688B

MD5
cb03c856b03030d4df4bae19bdf023d2

SHA1
8d2d60cf04c5b4d2330b8ea224c034ac042b3972

SHA256
69ccbe0b7ac4ab921053314aa259fc74f9db571088c169e335a589d5049bb629

SHA512
a4847dfd1aee97f9bf1bc02f42a5a6c7e0caa9a5d634ff7985098e0c8ddd7953cc08471d59339deca46dfa62024209c1d52478804c805a4cb855433c9900530b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
c8d31f20246aad58fd4909fd21360cce

SHA1
d6e5855e605a19f49273a486f39798fa2025532f

SHA256
75306b5852f915e792742b468c7abf17de5ef3a217909fb8e631639b80a957b4

SHA512
e4ee75938b7c7d920f92f6d38bc006f5a0ccc860930f2b3eee6c63c957fd5104ceef319c4a61f2019d12e372a0353e259034100ccf142169c3497c968a30d3ed

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
448B

MD5
e184fda9262d25087d493656e7f77ab5

SHA1
9180239abf5e175f6d4ce170e569a08eaf2d8c14

SHA256
c7d70d6ea5c8768ed6744e5ba68a9e83455eaef9e71bc87b8a35ecb7eabee7e4

SHA512
dcdbb3bd1e92b057a34553cff9d2f3eae3b0d6925d9aacefb684a1922403ab50a865aef680ea3be96bbdc742bbd2e469b850bef9d34658ff6008abd71eb40e60

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
624B

MD5
2fcf4458541760b3404eeb246c4177e1

SHA1
d4f8958179f0a42daebdbb6d558f9db2109e054c

SHA256
920274768a9f8d5d50e5edb6d755e399ec670f951579533b5eb1ad813d694cec

SHA512
96eed193b99bd789ef16139e730e58961eb68b2da76154e5cc3329a274effd3c397c369d2396f6b2236e7fd1cbf09cd7c7cc57e0d6cc4239796644405e8fec49

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
400B

MD5
da0634010ee14108bc7ec23ed53bbd8b

SHA1
3fe2dba215b7ad8807c6dbc0857b974903c56660

SHA256
e2d67acf044d4414e708fa9d898cf4dccf098ad10b22bd2e95c3a16bbde8a951

SHA512
1a838d50d32b729ff20db182ea08c3d9848711c46bc8b1baf282ebe2f59c4ad9cdd73fab9c965b8a727f459a614d60095db397e0c93af60ff0d57e10150bf430

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
560B

MD5
375d9dfdc389bc7e5a1c844f42333b93

SHA1
c57f76704863de90e65bff6ba97b9923fca6560f

SHA256
baf9b0ff3e2c6a80dcafa5dd031633b789e30f835234b73f8c88ae89426f15f3

SHA512
b5dc7264cb0e82ad392f0117e6d42eb182e6c0bb798e6ef19eb2bca9d216070636f6f64dcf63eb8885abc9394ca5aaff2890ae051dc5ea8123cdc29ff99036e0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
400B

MD5
fd934f5af4977b0d408a52d6f5dc87e2

SHA1
cc8d6473d80086670af1ed26bc42a440a2be0329

SHA256
9e018aa67b3aafb1da9587526dfd9c1acf17d45d1c2353571dee2e8506251111

SHA512
a3cd35404d8527f5bc4fad207083f7b7bf9fe12ca636949f65b7e2efbb3b71249f75f12976baef63f4bb836726e82babedd84566e99801222d1421f7dca30532

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
560B

MD5
29f7a65958f299c2793d68fc64d788a9

SHA1
0f698e663d43d46fd3d9f51c4203a16a2d301190

SHA256
856c7342d47dafc851f75ba4da0291978d33e33f93c696c28c3501178a596e39

SHA512
e043595e4a0959424d7fd092bd01a53699c1ba3faf996a66140cb952dd3a9cb857635b534d8b0fe1bd8af45a3251b5ccb2fac5b568cfb530f258b4ec9927551a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
400B

MD5
142653cc19a8108f670c5eae30ec4139

SHA1
97ac4f174335fc640027c5b7f5456d14b5c79d5e

SHA256
79343820ef2ba426d5a4d3b7e5e56b173707c3ba644b198ce3a278bc027c11eb

SHA512
08c786b0e640e0e50df28cb6d91b82b4c43911beb54e513c6a17b024f2390bd1317552075f57f7ab3052128223e5c8d0993bb35369c06bb73606f4c2f00b1f5d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
560B

MD5
8b0a4aed0af3894906368aa91b1cd550

SHA1
a2fb7690ba7995c9fe2b7c5e4415fe9875afcc36

SHA256
583b993249e1c5d5f36cda33573e2ea751ea376b9fe9ddb84bf6bea74d0fda72

SHA512
6609f46f84d101349e5a4643eca1ade201783cc2f5673f0845d33bae0fe18a6c024474ae4ce486ab0052caf6f3b2e2ee21973788e33b5f5789573e630feac313

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
488c4cbe1cbd32363000ac437e2586b4

SHA1
4cdfab956712d1ee3dade1568b1b599704bb40b8

SHA256
e266f7c0a9bac87d1cfdb4b8b4225a3e7a6cc9ac8122e67a4c188015273163ba

SHA512
88e696a344d0115db40c7acff8bf1c88bdb984154626a34daa7e702affc6e2de8624d09a0aaa40a7d6124ed565661a33710a550cfe97c465b9a1a55d88684b70

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
e32eaad06c948e0aae1b737c8b827c1e

SHA1
c68d226efb3c9a14b4e7ba760158ef222f935328

SHA256
212e7cb7a439965f9d795f7ec4a918134d4ce4436610fd84e3443b078ce00936

SHA512
6de7b88c9fef80f19c131ae55affe4569e0a0fd88c0396b8672a123772b919b63bf6c50f6e4c20ec75c8a70ee442ba3b293f6cb6f4ab18e25e2c688b9c4f061f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
6d94e4273aa2efba4b9618f06548f5b2

SHA1
1306140c82224927f31032d4e5d8df44ffb19f86

SHA256
d5b35319332cabee4b7c57d558ac12fe7259e5db349cd68c6ebc709cbe1b4bf3

SHA512
6fdf8d7b6cd30826d8ec5da116c5d8b8f6882fbac82a9053cb8ddb536c65ac8d4de7beb6f4a125b9c5879f296a1276c492ab6ec4c6eb45ca5871931269c8fbb5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
8d571208521b2c1d6b9409db8ff4a757

SHA1
927adcf392517de58f77654bde27d7053a8d14b7

SHA256
846dfb8e5638ceab57398a59065e270cad4360ddf53614bda1454f5da0af927e

SHA512
63914bdc3d3771118d5f5fd7243ccb88090d5388ac06a151dcec237c56426b485957b6944b622f9990d21d6136a236274ef5b493f803f4c8508cdb4ab73543c0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
ef1ace4f26adf4c07f5fcff043d005ac

SHA1
091dec7f6da00d48000f2d350ad35af9e9bac053

SHA256
6070a57636f813ea6e761223ca0ae8670f0639758260151c5d1977151628caae

SHA512
cb02328678793a82fec91f594517639b5de8cceae23dab6d8e22e62931cca97810374b69ce53cd8960ded995c2ba2b35b18e6a94a56d47df0e30830efcdf8661

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
192B

MD5
be690e7e6b951d7a29173ee7739acf11

SHA1
a1287dc4e42d57d8e8795871e1da72f9e83a6d9c

SHA256
78ad90d615d010e5ac13e4ccb639fb046862233a20d9a3b9e7bd422108a4dd2d

SHA512
baa446c3f9f9d835ce6dfbf685b53a899ef9e26fc41d4c8960bcf1ef89b6c1754d82307d9ccb9f42faaa0b76091fa8d23285253ee54b9a3d1c4e42ab62f1aabc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
704B

MD5
585ef6d2c5d8ce0726e9c1df1f3cfe17

SHA1
94cff9538f721e3abf348db7bd23614c23148e48

SHA256
53393c320ce11382ca108b1e0829667d5c9fcaa2b58773dde711af5ae0127a0f

SHA512
729c95a976d3214bb26b68ae7487bd1e36cf8975dd9084fd80404476bd324525a71cbffb44c47a23095320f6130e1692964583057cbd24868c2e27401040589c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
4ec68786832947219aa6e096cbd6b68f

SHA1
2a48f280ba3dea0d98a0a5189644fec50cede865

SHA256
0162a6a82ad87baa7bbbc21cbe1665791c745434ecc40b4578a71f40c69b02e4

SHA512
6de01bcc9c35939abd687401941c152e105003decb220c307aae1a090b182d7bd8eb69e95c2c522017b098af994e09c772cb11a139a1035bbdcc7d3e2b58710a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
5363b0a69a84c4ec210d5aad3f9bfe33

SHA1
19fad6337788a14f3fdff1a46b4d629a46fa40a6

SHA256
1454e0ea5c1c7c29eb2a309d0e176931a1c019ff84508808ea1531c682bbd9d3

SHA512
a50a2f2a718e96d96ab532a537401783804483af6a7cf2ce15246a3087baa30e9ef968305912cf159306523f9ccdb3e9a8bf993bf176390c214bd3d165d214b4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif

Filesize
19KB

MD5
e3c9399a73ee8a753d6c2e2c1a2aa083

SHA1
c6ab77c85fbd5762ebe12fab95d4761717065d25

SHA256
eb6497f8b706cdbf1175eb0439218c5910bed8d4ad74e95afeaabf0241f792cc

SHA512
720e740095e736b016ca2f5043efcee12179d58b03dbeda269a3abd5db10edf34635dc15a581defe171725ef25a94f926366411c865b606a503aa15e48e81e24

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
bc9d06259987488d71d532105b28674f

SHA1
1caa4399b87e42a5b6f3fe1d70d8e31a6717bcbb

SHA256
cabc621e3252836aee8a991c6763508bb3ad5307ef4cba032e5c47b80b071bf4

SHA512
9a1e2a425cffbd18268d07d7a047301d42cb2f05bd2619ab2535c4974bc014c27c39b9e334d15a572c2d1b794fdd86f55f06bafa3d1049f83f402168daa8838a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
f398dbaa7aa20ba0828d03e04a3fb72c

SHA1
a1ae62abb248e1378e350bf0f8bbfcec5f853c2e

SHA256
03292f8f0ffd0bb67c5fcdacd2fc3b65b0d104e2ad13ea4685f7971da0e25813

SHA512
c90155b7355825e339ce8b45d0198e5097ee3fe792f7ca2ea6034b8238c9d52e33d0574bd70c26e43f98d00858ec4febe5c0f1a0a5fec049916a8a0c7d33b581

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
b47f0bda60874f27e6717ee4e1c12efc

SHA1
4a24bc9d734049bcb5f7617b9926394add75e736

SHA256
db870b780d462e80613b97df1eec6a746f21001159b8f2a1c5262f2f826bd858

SHA512
9aab3a487e247ee2b6b7b90909bc5370b5ac63fdb15d5c29e085b901c9c496815eb19002828a400a71ae1e29f6e67905595bbfae38cf122cb37d728f0099c703

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
c59d9fbfd0b97c2a47655c85f5a5e279

SHA1
3222266e1faaa31a18354db8746e3cfd04a32f51

SHA256
883b94976ff8246180a840d14b71247bd7362e73feaa4e4146d1a2639defd097

SHA512
967a5909c1746337eb20ea6fd9d6eb354068adccf63a0e99d7fab737656a275e3158e534665c88e8eca19e61ab0f1c222b2c871c4d437546f453a94b475989d6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
304B

MD5
7c390f5ab021410ccf10411728d68da2

SHA1
46949a1bd6e57fcc836732dd4840ad815500f538

SHA256
88e77202c497d0d9d387c2f1ed5b83e44703689d8d6b7c8d46a289deead77e14

SHA512
9b116e5218fce6e83aa404517121bb455996fb88369cfdc11a64f3594580dcaf858637c5e5ebc6cb5b617d3b7eeeb1a9b918ec5e2d9dcb859cfb425519746896

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
400B

MD5
75d1173926eda21490839b315f881bb5

SHA1
9e0c7938e417056d0012257db50566e7516d2077

SHA256
860ce42b4b40ca694624931c5ac20a1cc51d0918e91c54663986ef05b6a3891d

SHA512
458e124c343ee0f36f04e872ef9c532679ab45bc6c6ab11093d0d1bf9f16ad9b3ba5ad16908f5003867d3f14236f7520858bd97799a39091d9ed251c2f6b2731

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
09ce69041ae37d041e538cac9953c623

SHA1
cb1e8d0bd62218d5d5416da4938892bb8562b425

SHA256
ac9825968fb02b2d431ca2b7e202492b2c3b0ab62597d995b2034d3f791b847b

SHA512
1efee76319621bba7f7f4cc989974a25346398eb794135b983c19a4512b34d8327626b80c18dc138f0257f11579bcbb48c96b1a7f2440a1e93ba4eb15b55b9a0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1008B

MD5
18180fe8a4a17952a6301faef11ec6a2

SHA1
282f4c2ffeeec947c98e16e7bf4f8867999e595f

SHA256
7fd4db743279bb55a21e466eed840537ea085f5356311206d5491aeeb5567b71

SHA512
4ca45b98153852205e63594ce5454edbc598477e9476f61655468f62d725a6faf0edff109bfb33381c017e5a5acf3c71753309c71499cb61e8fee4549ccbf62d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
8fc0c905d8ffe1e5a2c655bde2e80b87

SHA1
98ea142ff94be53cf89b873f9c7d4059955449d8

SHA256
3f74cc44a0c370818a3973bda16d89a4812cd5b541c66435d5c3d0248db6257c

SHA512
af28f2bc81bd3623ca38d9e0dd41b92cf7c2535353203b39b3195ae6e220076ecb3a67b014f8e71f4dbd85464b920f4f9586540ed3bb3d9db786333d9c43cbd3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
f0a2dcaa0d33490580d58df423dcd920

SHA1
26e053e23a79a78198bb513749cfd0005996706c

SHA256
c87b6df546ed8525f87d359458ffcd786eadf3631a91a0585ace41d03592997a

SHA512
1e492310148cd8bc60bb6ea96beaafeee5221313dd9292a84e0ec96e1661852fd1cceda55c5497f95420c15f80c4b4895d5fb2323dfb031f6f516c1d9375b8d9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
85ba507103a6e5615cd21c78edabb265

SHA1
1f6a1722574b789721eb74fa74e577a26cb49aeb

SHA256
2cb331dec7a9a3b3f7438f1f96c5eb656a822424f9171fdefbc5971fb307049f

SHA512
ded6cdb87da0e2002d15ddc8f9f97c1f356f56c008f8ae32f908ac68ad209881a12f7131572e68a20ded939099f6aae82d675fb2ae94c43286163229bee3e8a4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
560B

MD5
2df245f2f5f6ff2e8d45ddb3f005cd54

SHA1
a4a9dc2fce024de5235bbe7a8ad1d190b6b2bb1a

SHA256
febd3926e25bbaa52440e7bed8455032adea6f1f9ae8eacdd1546257ecd71449

SHA512
bb7171d9c67330de8ff86f4c70f3116b5da6acbf60738b0eab9ea46711c0bb912c811b8109bcec905166b4c70b8038eb64da608043d7cc11a638654f94fde25a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
9fe054382cac99ec0d0fc06ef54991d1

SHA1
fd2ac999a16a0cd9a99a8bd0ccfd0e1d71d5561c

SHA256
ca7464a64e26162c36b5efc614ed92d3b1ce6d816610ed586474fcce440ed53a

SHA512
297567c4bc936aa7a33dcc3700ddcc43d8604a4947ef484a7108e0d00b874e925e22719be5a6f65021611b5348af71bab1c3c818db6d6d28dac82819cbd07e99

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
832B

MD5
3aa232e3b557dd7478c57f492e2f0ad9

SHA1
7b27896234a3d7408146c01deca60e73bce4faae

SHA256
18aab27f1ff6aa05fbefaca4208f9182bb778173d465d5a8ebdbfc9351b96ee9

SHA512
3108430a592df7ce360ae761093d19cccddd83e26aa944c0793f3a7dff11126048d780f31a6c15c691bc5eff427bf7ef37390f314f8840a9c8dd9022e66bfb7a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
4f72ab79abf20b1e7ccc524af7b20acb

SHA1
4944ac7e5357c2e70984550bc875bcafcbfd89fa

SHA256
9f504d1f29437ca6ee5b19c577a0b5cf571c343492bdea827849a286baa08c9c

SHA512
452e0ef4b6bfc9293de6e6ae6fb35b2218a027ebc0880ca763a3ff4b1cb8fafc097e5b2b0951091947adf81d685906c6f429032f542db8fdc240f11ffd1d5664

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
c186b69e7c77348ee21a1c32745e1724

SHA1
9ecc421516ca7ce0503195e83cb6a8c8c45a80f5

SHA256
ffbac7f6df3969e2e930f271724f0fff8508e618c5a9db0289889953758c4dd9

SHA512
22afda27eee233a093ec321996864c9ccd81ecd5dc3229845bb65ffa0c5eb2b6190dec70b99a5e1b1df30b8fd35f5833eb7f8dd21274c6e454df10ea07bb8a91

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
34a6bef235bb18f701c0db66d7e5e75c

SHA1
f7afda42fe3cf5e5ca88fc1e29b1b019c223be14

SHA256
35fa7788bf5f67cf88c1be33c9165c2b290981d47b789f5edb333d583c9a712c

SHA512
ea6cc50c145d71c0770e05f9f439766a4103121ac82fc0a625ff90895727c9347dc2bbb064c0c5bb72c9f596d07baf6fe6f9366f7d602c032605262e08da65e9

Download Submit
C:\Program Files\Java\jre-1.8\COPYRIGHT

Filesize
3KB

MD5
c136fad7846847547bb8ef94c46a4e47

SHA1
b16995f6ba7822c08c4e8741d78fe6bcbc25065c

SHA256
6f89341a3f601c847abcb3882323ce0d7c30927f5cf77c85b4343b98d64a177f

SHA512
a6af79dd8c35adc650be359c7d1eeb54cbba9d2f0c32b84c0ce9e8ed6a46ecc43375f3797d67d169f84f6dd1064f8af812a09523e08a7bd4c941d4567512c469

Download Submit
C:\Program Files\Java\jre-1.8\LICENSE

Filesize
48B

MD5
cf99d77749e6e4bb010e4869cc657491

SHA1
fbcca0bbcaa4ed1358f08691d6ebc98e964df9e6

SHA256
338fbe18c60fe5c13051f23144ed7520302dcb96cb980096024ad46ef006d802

SHA512
3e7986cb3152237753f8632f763b4587e6385268ffcc059134607646e48af5d4c3eed621f2a4b6b5744aff5a8d304bea2fdc6af7e4b3e75050fd49d8d2d59a27

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
192B

MD5
7eb6991577eaccf0ba8895697e99b362

SHA1
e644617bc9f2cadffec9f4c4e66d8cfd3a0cd74a

SHA256
985d9ffe16b6b9b9a8a1a812c574069eb2be8890adbb453ee8a72a9b30f55319

SHA512
7a986c57f0ecb1aaf361bd65b49046389733abc7475fd7f5d8e4806afbb884790ff72eebee91822c4e5c28b273d6ba8b70a81fd137665bf0ec88be65e7493745

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
192B

MD5
52fd018f04faa9055e1d3b51f5934eac

SHA1
665f5d25ad5d078f368cd0af3b8f3c349f48731d

SHA256
984ae816e2904204f2c25848a7074b25a340a725a497f50272a05827ad2db7ac

SHA512
c2942bc9912a5acb2fae2c7e4cd323bba2ad0461c18facb23fe520f1eff88b76a84dc4f4964a94506f4a2cb35b4837df397f28ab01cc144df68eac7bd707cf37

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
f1f8d0f5c0541169c96574d7b8ad3ee1

SHA1
db7fba3641f165894a4b82aae7bb15a367a406ff

SHA256
121151d2a949dec6521e35be75ff915c0366ec3acf66eb8a627cf2f31ea49602

SHA512
be996e001bdd354f6371ddd0b1691c665421c10c2002320d5e1f8e1273285e39cdce8d8658e57e102611612f00238cfa84253550738dbeb8d65a58c65faa2c15

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
8429263602a8d99224f164bd761e90c7

SHA1
456f22bc6f63ec815252e4c64993972800769de3

SHA256
6935dd376cc0ca34763830a6c10385fccf5e827ed30b258b5c7ed0ac2b4f9ed4

SHA512
1678f200975e8a18f965a321e8971eda119e1e4866f10f63778ec8536bd4435888f681a86468b881541104a27683f1114c0d9801efffbb650fdbb7985ecc66fe

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
e5fd64cf5f5d67e2d4d58d62be4f8463

SHA1
1c7d7dbc359c2c590c40afea58fdef059be36324

SHA256
872032fa335c86e0827be9eeac3144dba83d8ea82b66849b1e75cfd80f046189

SHA512
f4dbf6e679c69f44c64cc51d35d3ba2f4fd4b67b786020e787f26e3b100942ba281f752f2cfc21ba515e1070d8713e38d292950854738a4edb898b06429073e0

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
b40f6d5ce3f908583e9b15f4497e8ab2

SHA1
2154835e3cca12dd7e715319096a9a602fa659de

SHA256
f4a8f5395cf1ba6594707294568408c0bc28e958d8cf047671f669a84751c9d2

SHA512
286fc1109ee0ae0130ca78f40d118bc9f3096cf94fc2b17da69f1c1ae82f4a706aa3ba7b6c78c1ff0d607392103e0c486e79a89d37b3d16830d27b71b39ce2d9

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
b869bca9cef73e2d9787ff40c1e9938a

SHA1
91255ea97dc074d31f476042ba941171a6a6d364

SHA256
c5434b1b6bf6ac1fdb9c04abab54f8e00a2f20dc72d44c8ae0ffd9fe4fb7550e

SHA512
39dd36247f5da930b8368bf0b1574670dbf8337bd20b1b99b1c4b1cd40a5fbda4ac16451f943a26c1caa679fb5d307155b3b8f4f0d2d108721515e043270b206

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
8df5542b4438961dc8c6b2e38263fb10

SHA1
1d4e0bc89f8e472eb2d0cc9becef3b439243c3d2

SHA256
4ccaae6a36b02a14627f3ead71bdb9b665e906d22f1086f4abca1763163f1653

SHA512
bfb6dece110eeeae11b72762dab1ab16ce822a7703ca668d6f34779334cb1f2d6ce9047cadb0170ca0d67c3d1493f5561199889fe7ca6429f50c7ab61ae522a8

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
d52d4152bfbcfd45d19e86d41da5b050

SHA1
7531829143fd20b5e1708c029afb2a1793422443

SHA256
dc5fdf4fcb0bfce98903aa3c7e61bf513281328cc070507c7307acf2b4a50f4b

SHA512
2b80d839c063c1d1bedb47873663d507c3caf2f739205ac31b8abc950d4d960770800a78b860cc9e970479a3bdf6d9ec6afec08f9150603d3a906f72472e774e

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
0264027c3a98dbac8d6c5e3f41468b0b

SHA1
7825df01672104759ef14ad81c69b04eaf468d85

SHA256
cf921400124b04879a650a1fbfa55240a0597def87f9ed20f13849893f36984c

SHA512
9af03fc2ae49a4a58fa1ac02f3ba5675dca068a5cb90d5752ec52886875d784285bbc854a47b423da83186ada0e3a5f703e9fbc50c5b3e4f7de2ffefd77e81dc

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
039ea34f54229db3d17b96f166f79c4b

SHA1
3420de9325bb50bb09bf84c2452fe19ee4840a70

SHA256
e7fecae09516e0539253f291efbec262a3bd8f8a32fd1628f71a8366bd1d7d4c

SHA512
07195a4ba4a81e15fcb9d9cd9b9ba7402d2a92daf2966d6390869fbb56fb67023e01cf7e8dfba2ec6df47c5f194deaa06f05daeec72b58f2019b78d15207a4a2

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
f1db15f2fb98e8c4b6174eef65c56691

SHA1
34b39243083d4ee676e105fa4ee3780e3176bb8d

SHA256
7e3c11ff4d35633d3de4086cb5d462e3f5b3beb19f88687be7a04eee29e41d74

SHA512
c4df9c2b693c0cee090aea3489860bbe8ae70601367e04eca98a41e168636045d7b238c2badf7c541ff618bb6ceb87f443483c9733dd2fa95bf3bf4738b87d63

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
57213a1223e1a5286354643f54e6314d

SHA1
3f61679eead32cbbec297b9eafa39cd50c3e227f

SHA256
eb9b9550f21851c161b72f320b4a84063b267288035111129f7b667b904f38e1

SHA512
a3e64b9a2a33490fe6becf613bb01410d29789ec5ee2c11205daa988922a41d254f1654fb05c47d7f971b18d80164204bc9faa0631f6479a1398371b40ea1ecc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
d1769dd091fa3f2ec7342919f27d1296

SHA1
f5bd98207940274a94ced586874232936c83da14

SHA256
8ad42eb6dfeea7d871114de1d583d114b9813cb87b25b524b1f3c547006cface

SHA512
4e2895c01838ed6fd89a90415d850a2bd6032b244c9434b7ec6e3782697f174b66a5196c24a4873e5ae78fba67586102cdeb7f0c7518a3207f1d8fcc1ef58fdc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
ef74f1cf60497c2acef508a3205ff48f

SHA1
d1ecd0f6e017d2b6b42b072c5de45198e4019b0d

SHA256
b58a6007a814dd4f5994d6cf3b693245779686ea34590dcc1d8f1ff5577a2978

SHA512
7b778a1d4219c305a65d3d5b3f4789ebda70d3bd0fd9796693e791f3e322f839f7d066ca1cf6632ce3122534fceb5120915806ffc39eb7a6c7cd8af7e59b3fc6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
d31c2ef5dc1dda4b34c8633060aa5b44

SHA1
7c88fc9aab7274b8cb07f53dd652cd3f466caa5a

SHA256
161cb7b9886e6afa3836d447199f9fd3bdc69b259304216a8a81c490bf0a077e

SHA512
daf42323290fd48d4364d4bbb846165b78afaefb464b9ed2f704ae7e4cf0af37a42b4eaa989f03a5b45cc121686f9da0bac0bb0dce868627e4335afd0e3ed5f4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
176B

MD5
1a8aa13836ab703a93a5fd768c1a3dc7

SHA1
0cd6c4875a9be388aa7765b94c650097b2e68574

SHA256
8d3add06b0691227068485f652de0bfe2edc3ace809df9e6f84b44d91d2424ff

SHA512
1eca02839dbe214863b3136b70cada6712b873bf1c82e42445568cefb4410b97beb414106cd466e131dcd3421135d582d6d9192f92c05dafd1aa01417c05acf4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
587cd392579d5161596cfdf07ed92cb0

SHA1
b259b47ed452085b5b98ca088a3085f811ecca67

SHA256
36fdd3e717a661838c03c4eae3dfc03985adf93d1271d01dd1a1da86aac6fd97

SHA512
b9afbf32de068b6df932a0d0e229845da981a52571c79666222949751a5c2d69e81c19d4a2d36b716093fa61e94067e404b2b719861453ce6f4b7edf89a27559

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
0d9180fce43395efde198e9608e14c22

SHA1
cc20ab52a5de34957766445392dd390c0a30beb0

SHA256
556a39ab43d3ff657fee8274fe0a3076f2e22232fff3077b0685367b8dd7b1ff

SHA512
7b38dc80e689bf8573e5c46445def9899e0287ad1d6b556bf40185aa21e5ad6ed6ad4e6ca633e5b219f50e17608666c5e11cbe6dceb45ec0d396cc00ea2c6ff8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
6355523cfedbc3c5cc84fdacad9ba4b5

SHA1
535d610f4172813386e64cc6da4c258710f951de

SHA256
b8e1c8eda53a7cd9d4bbf989c4bcf89ed20fda270619fc02f78810c254463921

SHA512
c155af3c021af067b21062a4b2795bec633b725d90bd2357831ebe8acc5bfcfec21b352cdb9beb4f29b229d1b0a767e8ec0bfcd75fc96ebad9ffb729129082c2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
9aa56183aae1468677465fa7457a2e7e

SHA1
ef3839df697124b44047587ada0012c61ead0f62

SHA256
d2e4fdc94df1deb0c133688f4e85e23cb575366d441942e2c173876897138e48

SHA512
e9dee74e1eb6c17241392a0b8d8b436417a7b8db4fd70c38a4882fc65061ded11e09c0b8eedacbbde048acf3311a1f22ad979667f744d2f14f5d4acc4f5131c2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
9d6e1cd3f43cf1d527dc9bc73d4eae32

SHA1
b5146380c2d4b2abc8c2bbed0866142d44ccf254

SHA256
def4340de424e55e34161c94943f83b220c1f38267881c0435f408cbe81f83f6

SHA512
a58ee085f16006a2cff9f057672e883ca406d12f45c7c15f06e610064e755ba599f98b0afb5f0d7760a5b75c449a084f14b6fca3f949f7afa2c6f801a07c8842

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
37a7a220fa11d8a53ee873b442b45470

SHA1
74423fa983c1ddc179ab47b348d8e4e918c57e7e

SHA256
0c8fa3facf03913eab247384afd2463adc4fe8f97327e9eca39040f8792ee651

SHA512
dcc1ef7637bff1d0223076863c9d6e12a72738e9baf5c7d4d7520ef8810d52809a78e8efadb8d5d84ad7191a2f7b1dd3f31d7ec522e8f3e60364bbdfcb5878b9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
44d52621ea225c8203df121e04179480

SHA1
bb9f6a259dd2430fab727d3ca92ad8b43425b334

SHA256
c239ddc3792c315854921f55993c8c3cf6f4b91359ddfcbda305bc9c1d1a858e

SHA512
af464f1b38b8d799d7a36f72cd257a0e4151ba34a084316116f1d59bb68736d235bdee99813025c9d56569fbcfcf79e30b50516e740f60c7dc3fe74d202bf409

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
ba04878917717c3cfff9c6f82db6d526

SHA1
8269c51bf81d8caf0b094c294169ccd2fa41a36a

SHA256
3e0bcd87bfbf2feee1e900e390c3bee11cc74c8dd5726fbf691e39c76f57bb5d

SHA512
35e57e1c22aa8e73e11f1c04b1ea789d8217164b136d10db1b85927ddad44da326f02d1ebcd5b88a85a9112ca0ad8aa5d44396790097d2dd467a163657b69455

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
3da6440c39fd03beadd75eced5ba8a02

SHA1
508c7291dee3ed11c81238fb4a92b61a2f7bb2bb

SHA256
9c21f0cd33bb3fcd2ab9cc6dba313628c699b467b9fbc4dc8c519c9ece3a91da

SHA512
d381984aaf9276e2150a0f4549b9ecb37a6096b3031d790179dbc18241f07247ba05d46fd271ecfa741fcf959b3955856d836df23a6432c620002a85c99a00da

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
3e1f32007b71a9c15140243f63e3f4bb

SHA1
db0eea227607c85391fac10d64b5064fd68d6a69

SHA256
f08586a8be230de5fc924d8b35389d41f96865f8ff62ef0064950ddcfcd9df9f

SHA512
660aae9be39ac4e6f564e77f730f5f3e17c44dd50ff035539e92cd4354fa97b0690bef0ad446a2332c8f2f73cfe4aa93edeead363f284032b56f4d41d67c9c05

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
a4d07ddbbf925d8f45f30600a4560d95

SHA1
3fec226ad557b44cf5a775f5f33b0dc837ac0741

SHA256
070a8181d176e4f0465c994cad156b3799fe6cac604156eca81fc3e4a36eec58

SHA512
f51075fa2f4a3461f144b4308db80a5e922c697883e9aeef4fe58521c76e127f714635a7d8937d23a42a97756613b5af91e5359b0a6149bd230d87282ef5ddca

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
8f940519159915a881d67eb1d966fd4d

SHA1
c4af1a7cb6874d60412a476b8d0d36d7c9c8ad5a

SHA256
828682ccf68055cd9428571b8674daeb9af4fb0b7144cd57248157d84e71a642

SHA512
c401b93cbfa59f589c4edc05b0f437c95c0cd8bdba6e116416ab54e499a2904f805f301ad3cc1a1119af4813b1cc379f06fc2a70b2b0660d8ff4109c0e7e3f67

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
88ed90f249fdd64a258e7a1f7e080150

SHA1
a502a280441372842fdd98b5ea5e9ee7331efc4e

SHA256
a5b92e12df253ff92e6374baa3eb81475ad5a9694a12ecd49ce90f6f2b5c7284

SHA512
6d0595f34f4253166c5e7fba37cac108c04c960692b7d50b51cae7dd077711eedda5164e2ed3518a865875a24d0c16bc1f44a6edaefaa75b9e40e63c5b18bf22

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
07355570b0147e28cbe12f626b36686e

SHA1
2704c823d1a482e1c5826c8049db00ff78f4cb46

SHA256
e072c6297d9c349f102af7afa3965733348c1330011a888683fed858c09d889d

SHA512
8e6262b74190f782f427f97fb66c60624c16fc69c6cffdbd67ad57ff9df9fefed64e92e757d45bc1664465f1ca6315bdfe72461ab9a60aabbd57596a0b194239

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
2b292d2f3b202d56f411c321a947b82e

SHA1
98a47db9fb421dc23d7b6ab1eeca64392f1d6fdf

SHA256
580709f66682fc2f67938af2dd65f465e9625f3855e981c60f8fbefc45a404e1

SHA512
1ca8e2f32e9d25f65302c600ac44fae4875753aef6b7e14e130db413e047035f02de174c1ffda4e49521396dc098fa66924f9025b1887a5907f18ad8b1537a40

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
14ce960594273dadf2924dd66dcd5108

SHA1
7f77dac6d9b6b2c0d70c768288f2ac1c36d56e25

SHA256
2f725090ad3d3d4a2699b2b393821d9d76dee9c8b3889bc3a690ed88d91aa783

SHA512
759397527982d15dcb9a6c944a563e894f56831504a1d5ff5c4497ec80cbc0c31d1dcd0af56d7e2021836ca946a4f146d1a44c851201c6178fe681d5c3785512

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
983f0921eb5e02510eafe42bda89106e

SHA1
163bfdd347a2d941150e1062a4a542c79386e134

SHA256
7fd255aeb5ce3ded1ace71d2787173a7ff37affc522afe780308c38c143434cc

SHA512
dec99156aadac3f2249958927158554bc9c19efe884b9b297e0321ee896f170b8bf34fc6aa0e2c74bddca104656a30681aaba21ef2307b680e834bfe7acaaa6e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
2c30b003aedc56756cd466d00509b806

SHA1
d795a5ae14677de9c41269e62b07c5d77d0f8983

SHA256
0778c095d725fed3e88bbb726b277d186c85bafb75aa45ae545855fff6d6c7a1

SHA512
188f07cbe3ad0a8d7edcb2d27a0e0b08adaec2557e5d0badb8fd32dd2f704a536bb54c49f8778ba89d67fb1acb1b4621aa6253e2ba00e45c1d438f4eb1b979dd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
cd43bf3188cb61d3a609edf62e20ec65

SHA1
148f51ce0294d35c1b46d658c846ff86f03eee88

SHA256
b7c25b845e2ef5a4df67c26e7215353777e61bc685ceb11f56532ad51b7b294c

SHA512
5372a38a79682271c18876008ac11a52ca363eb382069273a5c54724939f82e64d7aaa5fe43c5f4a0381483ae37fe7a4c6b968161ea18cd4e270fc27bdaf0962

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
e512183486ff4c88daac2f3754991de3

SHA1
e1580083bb9d21262b9b6d9dcf2f4b7fcf53db96

SHA256
83e16a8202d0155ca9c0a2ce5e138c573c964d0fa06ea02b51602421a5b1eec7

SHA512
c9ddd3bf23277f22339cdcf73c2d6fe98314b2134d4e938dc551fb1a349c837fdf27fb05be7819bf584be57ecf41ebd7186743b31b809ecc50f90fbfd5616dc4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
84e0cc5959c25b612756a3a0f18f7d15

SHA1
ef20875091e9f7cf8c74f411144a5ed29174dcd6

SHA256
de89a8abf70e3bdabd7739b175b0eb2781fc92a30910fa3b42492fea985f707b

SHA512
4e70e717a8f077f6708313c2079704e0af24176faa4467d2c90957c8a8d614985b86f4b00ce80622bb690ddec5debac4127c9dbc1fabe1e0fda52ccd4c55f4ab

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
588f2642a16a9e8958b56a568ea732a7

SHA1
e553efd0bc5315ff041d108d28453cc5051db366

SHA256
0e9f46cda164456d51d5ca1ff4180337c21eb55bb94d19d7e73271ca052aab8e

SHA512
11436082adf749c788e59ad621a26117945987976f0a3b7a4e72aae9702be6097acd05e6570df668995791eb1da2f60fc7ecda6025b835699ea601c2ddc10253

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
263497b7b1fd0ed91dba8473ff1f57f6

SHA1
54b57a41fb4bbeac9fa25c1c9dda773d4e802279

SHA256
e497b8a4fa3bbc5abadb1234fb11f6dceadae69f2e680b59121930f78362f4f5

SHA512
03d130f4f28f332a51b09c18abe706ea8bbf0ab5fd81b318f2ca52912218684f38dd4cc861bbcc1221a7dd1b71cad1a7a6a5e659d9e83f309a0db763829f8f9e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
4d80691c29b73b2e8c4d8bc092414a5b

SHA1
be4aaf3ba2456a5b6ee9f183e62da9d37bf92131

SHA256
9fb16dbe9d0d0e62a58429fd7b221587d5b68f711b69f76230e3a09d9e23dc80

SHA512
95f745d3c9ee4bdf81eb032f134cca503e2c2543f9fb112fdeb79cb7860a9b5af7e02171055282cd2dadc5f9b28c44f9fdfd338ae0f276632be49768634547f5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
8282eff6c1862d125322ebed7b1eab79

SHA1
81de0abb184144ce27260012892772a8d00b80b4

SHA256
f0da8eefceea048369f281c5ecf40687b1c8b0066e934f4c95a44bb0eb93821a

SHA512
568eda37da43d199179332e18790f24fe130e74ad1d6924f5b578b40648ee2d34ff589e021cd203cf8b3b5dd5b0ed9556837e4fbafc8b6bc6fd72b6dcb657bc9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1024B

MD5
0dfe67f69ee63704bee3d05051d9df42

SHA1
c3721979c66aa2ae7121ccda424b1e3c781a73fe

SHA256
23f337a663bb21c7400fb8e76256b331811b55ec56611afc42794fe1c1d40e73

SHA512
44218d6a7d26eb2c28d05f1fce25d15fd68af9d3b79e0d42885cec5765a5fc5b081e6990a251ac1b9f81b227b6158881e3182fbe65513559af40d6e6884769dc

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
48B

MD5
0084f0c41188aba08048c26260a9976e

SHA1
5da51a7f73dbc4678531f8cac780196a4498ab66

SHA256
efe66fb6715fdb462996c5f46e9d79655f9b0cf489d0607d64accb4cd2b7b38e

SHA512
c0d5140e4230b1343a1c2228637c866576aad104871c9ea9cdac032de63abfe990fa856054f7b2c04fd7a863da3ef9eac5c29fb99539cdd37fa5b23b5dab522d

Download Submit
C:\Program Files\MsEdgeCrashpad\metadata

Filesize
16B

MD5
d6251bf8a7dcbccac3c1e5eed46ff27d

SHA1
8f845f3538d89c92582aec00ec45f40aa0ce5be5

SHA256
01af7b0aa9c41dfa8a1c4829a611853ea43615c71030d89e47a51ce0bcb8efb7

SHA512
8bf93c6a4e81e12e7e18ba62038eca0183e3d069528d0aa50cd2e8bb44599c1068e9f95ddf8a7a7da81e4eb4d185224eaffa8d89c7619daf02ecb48d41828b48

Download Submit
C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

Filesize
584KB

MD5
c572718b8c117c13dcd6a3ebbda506e1

SHA1
089889c6ee564eff2a15bbddc670f4c04e4ba473

SHA256
40c0e20df94ce48ababdfcbdc15f02c0e792f9ad844de4f6e551d652902ed7e5

SHA512
d2d47740c8affb129d7538aa973d53ae9c0f50f7cef2318c47dfd72cea480b7b1395f785382ff849e08ea3b7adc4129f0d7d861f6946eed48e0a84bc7980d8e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\CURRENT

Filesize
32B

MD5
10826fd2ca5a12130a6e4cacbf93f19b

SHA1
abd7d5f952bf2b0e9abec2d99b34b6f08ebe1b03

SHA256
d53b2782f462f4076b16397915168dc163a9719a98046894a208f55c55d347eb

SHA512
62dd96f19e4b3485d05ee71bfdfc4024356d781d7fe20a0384ee6aeba92205c8dd701daa9f0b21156d3ef9d1879a0e27a1b1fc187fdd1b9f4f7bbb5b3607c7d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001

Filesize
48B

MD5
d95615fefc28d2918e90018fafa6a8fe

SHA1
0132c058117ba50dc5ca96354c627af1a8559128

SHA256
38fe45a0faf5ad3a68a308902adf114e67ee1983a00902869d39421f293b9c6a

SHA512
d1003d0584338c1772fb04e3a6cb33b4e8ce31d30542f233bacf821d396fd43f750c089837ad77434dec9ed4e307a88935dac1cfa9933ef2e9fbfabd82d286b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2

Filesize
8KB

MD5
edd1a0453b26c323f8bdd8b5547e65db

SHA1
c2c0f3c4fc7a429066baf463da49562a428bd592

SHA256
2db8b16b7924104b93bba203e00646bc36daa8e5fed62380070996c56a1ca4eb

SHA512
d40884aa0e7c00d685b0f2ecb621a1badc22ba93eb702dda4a6a2169edea4b2847e251665a8a6ac7615ed034201f795e058dd47aec83e1dac39bc4d07f431c6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index

Filesize
32B

MD5
1ba58d44b68ac29df06b09bbd95a8a75

SHA1
b2d6ba585e3c699c6270f5786828cc28f1d30d3c

SHA256
46a202661c736d7698f2fc78015e3e6c59740f5b14e90308fa42d8a5d2f30016

SHA512
f598c4fffc1a1d058aa82aa6c9f743beb7ec896f35727203f2cbe60949dfb4647fba36219d07a2935c6af891ce651187ddc733baeefb81ae1efa093cd2bdf6cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_0

Filesize
8KB

MD5
dcda11636a15dff015bfa494c778c19e

SHA1
5a4ee7b45c4e99e31d134f8a74f938c58246e198

SHA256
dd7a71a6ab3b8533fb1b8a2614a4e36ae3bf9275ced4339d7fcc57e4abdec179

SHA512
19fa39062b778836fd26816e6a512c0d13ce9eb54665377496e9627612a8583c52ef3cccfb163e7cda94548df62438b20bce74b80609fe4f26c05078127a420f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_1

Filesize
264KB

MD5
c87d9f38c60484859e95f4cb9297df55

SHA1
94708a71570f988b533edb721f560c60b56a8ced

SHA256
16dd1b96bb66c605e266cac6ce2ac6c5830730bdab663628fca80423ab6cf877

SHA512
6300c63bd09b708e3d221bcf190a4f866a143186c2d2d51a14805d5d7ec3a9a9d0f83f47cd3cfe8c0169d0a48fe21b0a90b1f5e4cbcb984101c1f3262cb2acd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_3

Filesize
8KB

MD5
b99db17d623d692059adfc9200b5be4a

SHA1
e92f2a1a43d2849a9dbc504b39c56c777d53486c

SHA256
27d5b6abf256ef85b23ac37fab720a9e8f14f1c9cf5412891befbc76d85e26e8

SHA512
14b6aa5625cdacd521f1c176c0efa9d7607f2408915a5817272dd7e4271bfd8e34871006e7beed8f2f8f775f0f0a5fcc7536a4fd1a5b17a9bd3feb1f73ae28ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index

Filesize
256KB

MD5
e4d368ea8afeda6d2bc0ae560f411021

SHA1
2eb8ca96c7add1afbee5593ca875e56f7f68d45a

SHA256
1b142c8e078b59b4072510b049793432ae9311171985502a8809c1c27f70c7e6

SHA512
1e71da0858c69ed904eea469b05418688d6326526d2724d3385c34dfa2574c8406a2217c3a6dbb48b95352876d60290b0b03bd425c756ee24bd0ffa09539ebc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
16B

MD5
9ef1ba39786f5ed7a15fa426e646c903

SHA1
f8bbba504b5633ea1bdeafbbe96a805e28057f50

SHA256
bd60261fba1dae770741f7ba931cbc7d759fd6b89fa03d15459eff775d3fee32

SHA512
9ea60c9718d3c75205624b8cc063e79316fdd2ab550fc1dad76b37ae44b30e002cd4befb04a6b8cf479fa5a29f5e113810f61c39926e62b251cc0295d59ba7c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml

Filesize
333KB

MD5
f54f572ec181ce00514d8a531be96eb4

SHA1
5da70b017c7bf58a0bfb19c07cdd40d09e054ed1

SHA256
ca6b759f3f611fbb1c6fb33fee9d83ac512e86791396523486bcc517c26049bb

SHA512
efccfebc5321eb4d761eeba4f18988c1f2b4730a78169d77c36f243892046138d062a32ebcabf7b43045d0a4e8ab21a85e2ba2ba2863a2ab7299fadcec96a908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\onenote.exe.db

Filesize
24KB

MD5
4db3fb6f5d919f1493028ce0e7211fe6

SHA1
3ac4fc0b4885cb4278860dfd963f6ede764e40d8

SHA256
239b31e23f83883a553537a6947e992032565b4ea6f467b62ab99c6dc3b114ef

SHA512
69b4f2124e0a70fcb6790667cc1c43b4adb5e327a38f92f5a0e97a714994e4315fd21997c039caa0a066ac6e7e940bbf03b9c8d35552f4b410594e212918e176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
80B

MD5
86320b7c93904440a38e089bd238e206

SHA1
c74cc414e6ccea652d8882c1a880408b19310a4a

SHA256
fd7e84acca687ce9c369a3a3d682159f58cc614267ce88bbf337a6ae4ca7d2ec

SHA512
e8e5d2906aba53486b71670d70a4a9cfdb3101390dc35fbd7bd3ef4030626503edf36f75ea2c6c4ed4b26a99e7f618551a3cabe984852e06e7ebeeb2dcaeb84e

Download Submit
C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

Filesize
8KB

MD5
d2f71f7b7872fcdaef6a0753409c4023

SHA1
e88ecf879608c6226b1bbd2890a881454815c9f9

SHA256
17d4e9b8285da71908cff1f6a1cf4858773bae0ce3307bc1fa506b46b1cb3174

SHA512
ebb39069dc674f951c1dc9973d0ec1628081ef6e26952bb51050c3f6198a43def0866824dadfc12fd39d777db6813c18cf63ca840c7237686f288ea80d7d8942

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help

Filesize
36KB

MD5
79b47ed430db88834bd8c709e724b839

SHA1
9637fdbbfe63753cfbe3d1bb7f4aa22eca4bf2a0

SHA256
f561c150d154c24107868eacbae209cf116dfdabf1300f5a52c869262051c2fd

SHA512
92e1335bd3eb39d66d65f29a803f3bb72a66e85ce146fd7b2de2e0538f2acca5001669f234b3102b2addb5d8c93f9fb9529aa212538c1570bc2f5fd7f8435ef2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe

Filesize
36KB

MD5
4e738f6b5150e291f83d03aa9b1da27b

SHA1
7e265008d18254f61c128861bdfc3969d433a862

SHA256
3329ebbdeee68859447cf84822fc0d60ef1762739f2539faeb3daa76f02c4421

SHA512
5d79c26f900ac5edc32c97952e094c81e1105e23acf49b6c69d004425dcf003ab36684ddf1bc0cc1ebfc25d27003bac67dbdc3eb8099445184103222269c8b69

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_VideoLAN Website_url

Filesize
36KB

MD5
43c28182e68cc2bcdd5bf289f50e16a9

SHA1
5c29b48bb954e25c865e95b8d402a196dc84e1fa

SHA256
830da7f6230968276a884b1a582634c6f6e3c77aa5fc009eef1377b3c78cacd7

SHA512
bc04893f0bac73c44e1cded2395163fcf8793a8206d4981892f85979104667fc98c2114d5fc58b5c09552059ffb413c131a0bb4d4859ce7d9d8157dd7b937a8c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_vlc_exe

Filesize
36KB

MD5
4f6a18175344670a0e1f48ee0ca438e7

SHA1
39832a05083fcc95fd1ac1f08b4abed40f3ba235

SHA256
28e709820c33cab8ead4e0919839d40de397b49f759a708a51bd144ae076ebeb

SHA512
c2568fc93d202591533e555b7eccfafe77a2685be16929777307d87ce5f05153f17265310252dbf5d190954b89e4574e051df3e5dde8d10222e73c586f2b9aca

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{7915eeef-e35c-4b44-87de-cce1fd389aaf}\0.1.filtertrie.intermediate.txt

Filesize
16B

MD5
1aa75c1daf35ef70b2f7e355a8c101c4

SHA1
d5ec7317fcff287083dc431c7f6e49d498dadbb1

SHA256
5376d4a5e4e1e98f7f8095560beee5eaaf0305f83acc8ebfa020514c2572f298

SHA512
d4847db284361dbffe68b9ab3fdbad8384c70ba3c8705c64fc60d10d9728c465c45b4b4fa78c915eabbfab647ae98186a4a3a164eb9ffff8b0fb30659284a8e3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{7915eeef-e35c-4b44-87de-cce1fd389aaf}\0.2.filtertrie.intermediate.txt

Filesize
16B

MD5
02d0e73fe74bcb46cb437cd72ff37710

SHA1
91b0a5b7fef848fae361b8934f37d27ae9e795a6

SHA256
dd6b2e145eb076d139b6f7de955c4bec9d929e98ad2b6de97e679b797015b51d

SHA512
a54449097059a3ba28d17b8529d373e070c45aad5fb79fb3f635bf308b137f923b494a21ae66bc66a71d40f01081316311b96cf46ee8feed1e324e0dbd1c8e6e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754239318725.txt

Filesize
77KB

MD5
a929525974568fc635839b555aaff0b6

SHA1
5f9fa20cd6662990d8ff1b5f8bbb01bb9344b651

SHA256
314fc36f63e7da792065a4d7573dd07d4673172a278797e8f47cf70bccaef0c6

SHA512
5918072f0366cb233017c4c5a05991fe1ed6094b19b4f467c3812f02070f829cdebdafcfb1c0bb65c80aaecd4750a3dec9477f27e4f26eed09e201c402b730be

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754839716209.txt

Filesize
48KB

MD5
fc97e37beb79ab9276444ad3f69b2669

SHA1
7a5c2ac5a3b543fcd8cf093333413d2966df2cbf

SHA256
aeb5cc551aac04e87240a3425adeb3bbcc3083c22ec2a13aaeecef518aaac492

SHA512
daa2c7386957f586ee572cfddfdc603fdab4c04b9f9f62e213fb43d321170a7adae617ce55afe5430581228c49871a4c00c82bd599e4e1cd99f65f04d806f50c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670762722977757.txt

Filesize
64KB

MD5
291c109ed86eda195847db909231e2f4

SHA1
f6202946188bfb4c779078b66f39ac688a35a52e

SHA256
f5d07904bf349f9e8e5f2cd854fec02f3c752be881657f2301ae26a87b088e23

SHA512
da6e227062a2c780b739b476b876da077c182fb46339590a2746c65e8a4c08d3528ccd1597ce1b0d665ca1882bb6a1d6abd42e886b1c6ebbb8a67e87aac92874

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670765474574461.txt

Filesize
75KB

MD5
09b1d886c0fdd6d34386938776c74dca

SHA1
bed9d9166e67ad1f10a0ffd87d87119fc8182ef8

SHA256
5d793244c33f358d1f2f5e605c6e4ebd964b18de4ca86ab5932d654ccd19fbd2

SHA512
88b2de11755f09e2edf583a50feb455df0d900573446bf44ba141934d118ce73f74d745802573671cb804537313d7b8b8e53ccc485c1c5835478d5d58b3f7c1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240802_123722268.html

Filesize
93KB

MD5
cd021dc6af61af74b5e28fa6804c61d8

SHA1
f531331711aec288ad3ffccc85689f5d404ff377

SHA256
8865bd49b0f258b71a5560d597b92ab3416b28563e4ebdc56cf3a55440c5bfc4

SHA512
6a3dc56af47742fcfb40a0fc3e097ad19f76d5f77b5c8fa816b7eeb220d61299d42d6f062868b7189c372bcba97dbcb436cf68a3764f903c6fd9b70fdb496999

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0yv0tbuh.juq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bcomms.mkv

Filesize
503KB

MD5
8b47198def8ce8468ad229cd47f3af3d

SHA1
ed24a9b69c061b207a6b3212830a027f46b46eb0

SHA256
585eb9aae8a49dc1a326c13f388dedb63b0620308eef41d69c9023321c4b7c77

SHA512
72f0bccaf24de75ec1247a16028906d58196a5a93bb70b88bc50f042fb03d52580e4170f0fbf901dd11227b159dd3dda64a222ec837c19b621e48a097cbef8c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6C23.tmp.bat

Filesize
150B

MD5
fcbf8d1dddafc1ce532e4f0c19c53031

SHA1
644c11da6af99db2507013ef525e729b21e931b1

SHA256
c8a7cbaab6a403caa275df48d3cc70a86ccb0e8242a4e12a3607c69a94f5ab6d

SHA512
529ad6ab63ba22b212d37befa39b53127792e1da176a7abfec403f2f17ee70e7f5967ad606e457a30b007d6f94f077e56876771f29dc2a0764dab033d5f28fe4

Download Submit
C:\Users\Admin\AppData\Local\a27e3b0c7a6fb5d8312bb2e636d0d6c6\Admin@SYMRKCCU_en-US\Browsers\Mozilla\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\a27e3b0c7a6fb5d8312bb2e636d0d6c6\Admin@SYMRKCCU_en-US\System\Process.txt

Filesize
3KB

MD5
a0422300c9c5093c8feca5c79f199bad

SHA1
770e80fa881a7575a8c93f77cca09d2fbcc3e412

SHA256
058e98cbec4c2cf0c3b3be80f38ea7419c5027dc2d6e10b9b2e75b0842093369

SHA512
3130cb06163701d707fa5152a9c5970b3264629dac8c680e796071eae930aeb6bf1d46e8e6627309dbc1679c1b888ce36f7df5642ecf6221f51eca868d94377b

Download Submit
C:\Users\Admin\AppData\Local\a27e3b0c7a6fb5d8312bb2e636d0d6c6\Admin@SYMRKCCU_en-US\System\Process.txt

Filesize
4KB

MD5
eff00fecf4f080669059f1234be28a73

SHA1
d5c91318888bc523acd844ce3087b0509dcca23c

SHA256
6e82f287ce4ee5469b6460188383b8b479a52da52c9cc6419fdc0f555235fe49

SHA512
ece1d3111ab749d5591a546974c4157877f0ef71762eafb8adbe779d733cb571476dd10b4ec3dd6fb18dd47ac586617ef27a2d78f86739b061ea6aec145e1e32

Download Submit
C:\Users\Admin\AppData\Roaming\update.exe

Filesize
237KB

MD5
08c6f0c11bb897315729fb8ae967dfbd

SHA1
98e123459209064dacec489ef24a5eec1392a78d

SHA256
dc1c36296633b9850a0d4298082721fa13d8da3216c4c3b6ed98fa724effdef7

SHA512
52f931501a4e2db2c2a28b22d271032540eb425a7ea1532731bda694e947360d9452ac186cfdd6b0ed21e21adf54ef7dac80504d257df17300337ae349e4c4b8

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlcrc

Filesize
94KB

MD5
109c14fb2983970c7b799c9a39e14f73

SHA1
ff25e9548ac7ceb554372ae16159a247489cc10b

SHA256
47b3a89bb9ff1888b266e28e82302b15747fc89de5a047bc63b990eef9d2204a

SHA512
810de6b5ce8896bfbe82c02ffbd9a3744b840b611bcfb33098baf2a0d1f23afd1da9575299f4aad5db782c935d38da6ab53f488b92abc89b51a1373b6a651c07

Download Submit
C:\Users\Admin\Desktop\DECRYPT.exe

Filesize
13KB

MD5
778435dbc0ea22f9d5b60b06b1dc5b27

SHA1
ac6ded9656495cfdb701e66e3654bf161c3c38ed

SHA256
2d39bdd50f2fbb072d5c4c71ccbb18b3de6f57b73254ef44650f564b49eb47b6

SHA512
1027e8b0fbe6892eb74ab999cbb4a23ce7429febb3558978eaf373669798361340b7e492ba40a14ac68c50990b0187acffd4bafaacebe40c9677aa41145a9651

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
416B

MD5
15b7806bfc7d17af5bd1faae15fe0904

SHA1
597121474446a90b75e8f38f16c66b64a943a4e4

SHA256
3b0e62df91c58a8e488f03367b8d070478dadaf9576f4b165191ee88cc860748

SHA512
1af5622c862c36ca693f521da181abaa29b49475fc371e3a079aa9f1a72a2f571d8129c2d45acb78be6ca7835e42e995769a5cca018b89b100423ce9877d8fbd

Download Submit
memory/1140-251-0x00007FFD15270000-0x00007FFD15281000-memory.dmp

Filesize
68KB

Download
memory/1140-253-0x00007FFCFC370000-0x00007FFCFC4F0000-memory.dmp

Filesize
1.5MB

Download
memory/1140-265-0x00007FFCF2CA0000-0x00007FFCF3D50000-memory.dmp

Filesize
16.7MB

Download
memory/1140-246-0x00007FFCF2CA0000-0x00007FFCF3D50000-memory.dmp

Filesize
16.7MB

Download
memory/1140-247-0x00007FFD11380000-0x00007FFD113C1000-memory.dmp

Filesize
260KB

Download
memory/1140-248-0x00007FFD19320000-0x00007FFD19341000-memory.dmp

Filesize
132KB

Download
memory/1140-250-0x00007FFD15290000-0x00007FFD152A1000-memory.dmp

Filesize
68KB

Download
memory/1140-509-0x00007FFCF2CA0000-0x00007FFCF3D50000-memory.dmp

Filesize
16.7MB

Download
memory/1140-252-0x00007FFD11360000-0x00007FFD11371000-memory.dmp

Filesize
68KB

Download
memory/1140-249-0x00007FFD18600000-0x00007FFD18618000-memory.dmp

Filesize
96KB

Download
memory/1140-238-0x00007FFD19410000-0x00007FFD19428000-memory.dmp

Filesize
96KB

Download
memory/1140-242-0x00007FFD19390000-0x00007FFD193A1000-memory.dmp

Filesize
68KB

Download
memory/1140-237-0x00007FFCF8970000-0x00007FFCF8C26000-memory.dmp

Filesize
2.7MB

Download
memory/1140-236-0x00007FFD153A0000-0x00007FFD153D4000-memory.dmp

Filesize
208KB

Download
memory/1140-235-0x00007FF62BB30000-0x00007FF62BC28000-memory.dmp

Filesize
992KB

Download
memory/1140-239-0x00007FFD193F0000-0x00007FFD19407000-memory.dmp

Filesize
92KB

Download
memory/1140-244-0x00007FFD19350000-0x00007FFD19361000-memory.dmp

Filesize
68KB

Download
memory/1140-243-0x00007FFD19370000-0x00007FFD1938D000-memory.dmp

Filesize
116KB

Download
memory/1140-241-0x00007FFD193B0000-0x00007FFD193C7000-memory.dmp

Filesize
92KB

Download
memory/1140-245-0x00007FFD109C0000-0x00007FFD10BCB000-memory.dmp

Filesize
2.0MB

Download
memory/1140-240-0x00007FFD193D0000-0x00007FFD193E1000-memory.dmp

Filesize
68KB

Download
memory/2352-8-0x00007FFD01A50000-0x00007FFD02511000-memory.dmp

Filesize
10.8MB

Download
memory/2352-7-0x00007FFD01A50000-0x00007FFD02511000-memory.dmp

Filesize
10.8MB

Download
memory/2352-0-0x0000000000F50000-0x0000000000F92000-memory.dmp

Filesize
264KB

Download
memory/2352-2-0x00007FFD01A50000-0x00007FFD02511000-memory.dmp

Filesize
10.8MB

Download
memory/2352-1-0x00007FFD01A53000-0x00007FFD01A55000-memory.dmp

Filesize
8KB

Download
memory/2940-20-0x0000000002690000-0x000000000269A000-memory.dmp

Filesize
40KB

Download
memory/2940-213-0x0000000000CB0000-0x0000000000CE2000-memory.dmp

Filesize
200KB

Download
memory/2940-13-0x000000001B280000-0x000000001B2F6000-memory.dmp

Filesize
472KB

Download
memory/2940-15-0x000000001AFE0000-0x000000001AFFE000-memory.dmp

Filesize
120KB

Download
memory/2940-177-0x000000001D450000-0x000000001D4CA000-memory.dmp

Filesize
488KB

Download
memory/2940-14-0x000000001D650000-0x000000001D7D8000-memory.dmp

Filesize
1.5MB

Download
memory/2940-212-0x000000001E010000-0x000000001E0C2000-memory.dmp

Filesize
712KB

Download
memory/2940-273-0x000000001E360000-0x000000001E768000-memory.dmp

Filesize
4.0MB

Download
memory/5108-215-0x00000241562E0000-0x0000024156302000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads