50b9d2d51d7b6a9d840553ed57d62b5275fc634678fbf5c18ca325c40e498d89

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
Size

1.0MB
MD5

ab3efab870ac3028150e09bad29d3915
SHA1

b2da017a75500314b9f58aa08efbc50144bbc28f
SHA256

5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6
SHA512

49c2002a2d3377a74f2524c534110eaff870078ed983e53b5d3ecd987636f0af80de5033994435da93ca257347826101dc45c4910b0d74a0e5315841458a51c0
SSDEEP

12288:ifleEcqyvTszMbQw+WL/k6ewli/Knnat93Rq:wl5cHbu4L/jlJnaXRq

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2445) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

Processes:

5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

Drops startup file 1 IoCs

Processes:

5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ksB5mD97EDyA2F0.exe"	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

Drops file in System32 directory 64 IoCs

Processes:

5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\FileRepository\eaphost.inf_amd64_d37080dfb66d830b\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlucnt.inf_amd64_f4769cb994ece833\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\de\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\es-ES\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa3.inf_amd64_ff37da248ddd748a\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\de\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_swcomponent.inf_amd64_f378d70fa39d3577\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\Netwfw04.dat	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMEJP\APPLETS\IMJPCLST.XML	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\disk.inf_amd64_cc4dba2066ccf53c\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_101a408e6cb1d8f8\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\license.rtf	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\ja-JP\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\it-IT\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\es-ES\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_sslaccel.inf_amd64_ed6849ad81a24c48\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp_snk.inf_amd64_213eeba98cc6f2f4\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\en-US\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Diagnostics\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\F12\de-DE\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\F12\it-IT\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\ja-JP\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidir.inf_amd64_7bf4a320e4ec8b3d\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj7.inf_amd64_161e1375bcff85d9\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\smartsamd.inf_amd64_2238284d493e89f4\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\oobe\es-ES\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\en-US\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl006.inf_amd64_130cd40b355024c9\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic_guestinterface.inf_amd64_192114845ec44b66\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0804\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_floppydisk.inf_amd64_bc7bd9dca28933ec\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgcs.inf_amd64_e47e06e16f2aad12\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_73adce5afe861093\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\de-DE\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\oobe\fr-FR\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\Speech\Common\it-IT\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\cs-CZ\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_9ab9cf10857f7349\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa.inf_amd64_7cfab61cbab23e11\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmti.inf_amd64_bcde2913bb6ccf3d\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_d6132e4c7fe2fac6\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\en\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_ce12c614d182f4f9\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\Licenses\_Default\Professional\license.rtf	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_be4ba6237d385e2e\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\SysWOW64\Licenses\neutral\Volume\Professional\license.rtf	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\de-DE\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nnacffikknaacfff.bmp"	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

Drops file in Program Files directory 64 IoCs

Processes:

5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-40.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-200.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64_altform-lightunplated.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.scale-100.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\word_art\sticker8.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\AddressBook.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\large_trefoil_2x.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-100_contrast-white.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-125.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-white_scale-125.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-64.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-60.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-GB\View3d\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsStoreLogo.contrast-black_scale-200.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MicrosoftLogo.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\bun.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\82.jpg	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionWideTile.scale-400.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-100.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-96.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\_Resources\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-100.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_Package.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\63.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nl-NL\View3d\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-16.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.pdf	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-150.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\MedTile.scale-100.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20_altform-lightunplated.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\MedTile.scale-125.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Microsoft.Support.SDK\Assets\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\PaintApplist.scale-150.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\LargeTile.scale-125.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-32_contrast-white.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_contrast-white.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_contrast-high.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-80_altform-unplated_contrast-white.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionWideTile.scale-150.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreWideTile.scale-200.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Tented\TentDialogDesktop_456x100.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-32_altform-unplated.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-256.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GameBar_AppList.scale-125.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

Drops file in Windows directory 64 IoCs

Processes:

5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

description	ioc	process
File created	C:\Windows\WinSxS\wow64_microsoft-windows-autoplay_31bf3856ad364e35_10.0.19041.423_none_8f030a1a80df637f\f\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-hbaapi_31bf3856ad364e35_10.0.19041.1_none_095964b946de1bf9\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-f..-core-cpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_b92556210f3ca005\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.19041.1_it-it_ad9e9ef8adfd68d5\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediapolicy_31bf3856ad364e35_10.0.19041.746_none_2b52281297de22ce\r\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.resources\v4.0_4.0.0.0_it_b77a5c561934e089\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lxss-manager_31bf3856ad364e35_10.0.19041.1202_none_f31e7d867ff69c65\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\infoButton.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft.packagema..iprovider.resources_31bf3856ad364e35_10.0.19041.1_en-us_4413c095d47562c5\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..-hologramcompositor_31bf3856ad364e35_10.0.19041.746_none_d4ac604bb087a5b5\r\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_remoteposdrv.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_da6ec3d599075c6b\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\WinSxS\amd64_systemresource-wind..-ui-accountscontrol_31bf3856ad364e35_10.0.19041.1_none_8805ef3af31f4b8c\Outlook.Theme-Light_Scale-400.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-nwifi.resources_31bf3856ad364e35_10.0.19041.1_it-it_54b1cd5e6c507e52\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\msil_system.management.automation_31bf3856ad364e35_10.0.19041.1237_none_3a0926dcdd286ac8\r\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-dot3gpui_31bf3856ad364e35_10.0.19041.746_none_7dd5922827f647c9\f\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-u..-socialrtcomponents_31bf3856ad364e35_10.0.19041.746_none_c3d092cb5e78a6ff\f\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-atl_31bf3856ad364e35_10.0.19041.746_none_89198a92b881b1ac\f\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-branding-shell-client_31bf3856ad364e35_10.0.19041.1_none_e760ef0fa6b01397\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-drvstore_31bf3856ad364e35_10.0.19041.1081_none_65d23b04f8a3fe59\f\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-n..rity-domain-clients_31bf3856ad364e35_10.0.19041.746_none_032870f78565c3a7\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-r..ping-resourcemapper_31bf3856ad364e35_10.0.19041.1_none_dcd46257fe4d9b7b\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ifests-onecoreadmin_31bf3856ad364e35_10.0.19041.1_none_0ce12f17e92dd275\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\Logo.scale-100.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_c_netclient.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_192c24674bd0910e\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_c_scmdisk.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_d9fa9148ff129027\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ie-f12script_31bf3856ad364e35_11.0.19041.1_none_fb5567da482af6d1\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mmres.resources_31bf3856ad364e35_10.0.19041.1_en-us_ae1a7112a4007fbe\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-themeui_31bf3856ad364e35_10.0.19041.1_none_45444e48ef3f71b1\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\Square71x71Logo.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\INF\Windows Workflow Foundation 3.0.0.0\0410\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-compact.resources_31bf3856ad364e35_10.0.19041.1_it-it_105ebd31e4c7b44c\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..extension.resources_31bf3856ad364e35_10.0.19041.1_de-de_5854a3d50c6bb542\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Drawing.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.19041.867_none_f01b2255d690daa4\r\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\msil_inspectvhddialog6.2_31bf3856ad364e35_10.0.19041.1_none_7dc923aebe8d0c7f\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft-onecore-a..ecore-onecore-other_31bf3856ad364e35_10.0.19041.1_none_704b28689b3b56b4\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_5b8b70e2e95b5320\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lxss-manager_31bf3856ad364e35_10.0.19041.1202_none_f31e7d867ff69c65\f\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\tree_icons.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-offlinefiles-core_31bf3856ad364e35_10.0.19041.1202_none_130875d1111da1b1\f\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_system.web.datavisualization.resources_31bf3856ad364e35_4.0.15805.0_fr-fr_683bb69edc62e810\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.19041.1266_none_d615a46735302b29\f\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-n..vicediscovery-dnssd_31bf3856ad364e35_10.0.19041.746_none_0c5f36e68a5527e9\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c...appxmain.resources_31bf3856ad364e35_10.0.19041.1_it-it_751bd8256a373683\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-l..ostic-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_7c9d72f3b8d1a3ba\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..pc-tabbtn.resources_31bf3856ad364e35_10.0.19041.1_de-de_cc2aa3699ef8659a\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-c..urces-applicability_31bf3856ad364e35_10.0.19041.1_none_f4d32023b58d3ba5\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-taskscheduler-client_31bf3856ad364e35_10.0.19041.1_none_043fffea720e2a06\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wlanui.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_1149f50ae45fde74\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ger-redir.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_c29db332ceaf1ae5\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\unpin.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_windows-media-speech-winrt.resources_31bf3856ad364e35_10.0.19041.789_zh-tw_a566087bd822eb2a\f\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_wvms_pp.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_86d5eacbb47bfc29\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\images\colorPicker\alphaColorBar.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-directui-resourcesrs3_31bf3856ad364e35_10.0.19041.1_none_11f4e387011f6d3e\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ets.icons.searchapp_31bf3856ad364e35_10.0.19041.1_none_ceba36fd1b479c4c\MediumTile.scale-150.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\wow64_microsoft.powershell.psget.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_ecdcc747b573f191\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\SquareTile71x71.scale-400.png	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack-onecore_31bf3856ad364e35_10.0.19041.262_none_1c3096a87e30bd82\HOW TO DECRYPT FILES.txt	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

Modifies registry class 10 IoCs

Processes:

5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TPCDTLRUMKWPUNA\DefaultIcon	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TPCDTLRUMKWPUNA\shell	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TPCDTLRUMKWPUNA\shell\open	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.shadaloo	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TPCDTLRUMKWPUNA	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TPCDTLRUMKWPUNA\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ksB5mD97EDyA2F0.exe,0"	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TPCDTLRUMKWPUNA\shell\open\command	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TPCDTLRUMKWPUNA\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ksB5mD97EDyA2F0.exe"	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.shadaloo\ = "TPCDTLRUMKWPUNA"	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TPCDTLRUMKWPUNA\ = "CRYPTED!"	5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe

C:\Users\Admin\AppData\Local\Temp\5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe
"C:\Users\Admin\AppData\Local\Temp\5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
a6237d2b023e93682b8ac7ecee70f833

SHA1
2519ec18ec3c92b0a1e1315afd9e040cf33e3fb3

SHA256
07863aea092d59f2dda3a5279c39ebfdecd5dbc176e80fbcf1b5d46ff33907bd

SHA512
3b22bbecf35c3e17e49df796a72843000c3f599489b7e9a15996779af21c2d96746b373de318ac79fdf5ddcca0e7d506e9997d148a2917707daa73e0ed119de2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
6d3d058b8033c6b43565ac159ac395e0

SHA1
9bf123f258b2d29d847122881eba2c59de3ef7d8

SHA256
1a3a209135f620d8024fc3dba1bbeceeb9347d2c96d0bf86e0f8e5d08de138b8

SHA512
34a5332aa67afa498c5e0630fa0e45aeb7b894aef9902d7dd2a3fd685960d24cc5ef4b93f024e8253362744bcd5bf05c5eea7714f60b5aa847e93bae61bcca5c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
4cd148e0729cf7b4c7303a93e3172752

SHA1
2bac778b87c3f07071c2726490a771d3dc0b6994

SHA256
107b85ce669cc3ae1a3dac800db3089e125f65a6803fff8c5857f7b5e697aa99

SHA512
41ff9cbc1af5c1e710871b8146a506090eff73d744858e98d0b72c1320fcb881379b62421737a9db6e78588eb1d94690469b5d11c4d20d9c80e557460068ad42

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
ebc907d66f01365a79d84b4cc96eb7d6

SHA1
4ac9d435e722d4babafca652aa164ec04dca620e

SHA256
de4ca2e12f59f9dd2fb6d3aadbea2c293cd0cff4905c315051cf119cbdcda49c

SHA512
98b81f6b0d17448c2690ccf2da90bcac6b8bf8750fc670b8aa756611ef12552efc07ff8408597846ad430a27d28a016be4b4cb8df35b5e8c728e301cf968a7c8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
acdc9908858b7db54f76ee55593e1692

SHA1
56d70bac0bdd0005757e6a75124442e9dcc100ce

SHA256
e058146324a2304512d84f0474e0575faa8c1a266338857099adb7eccd6087eb

SHA512
b8ec73bc3d63a3bd8a72e36d2a41606cb94f3f9668a1ebd1195c7a9587a69df54362470587b059c2fca6d6146446e34121f8c533ed9c47d985cfe0ba8893d157

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
199909b668e5293d1f9ecf884be14bcd

SHA1
105abadc585bea5d863458d2e8c6128a5d3b620c

SHA256
35bd2e3f6db8a5ffb9c34442f7fb315e2a92aa5db82fbdf726cf38fce45b9b34

SHA512
eb6dc9ca5b3fb294fb404cff325f294e7d93dbaf50a696df35cab066bee4a6af4569f5e0113660b5127d430ead245e7f2c363c3c52de64d838be8c9c99bedd6f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
636f0adc9d6f9443322fa8e2fbc1da0a

SHA1
03703d5c78c771dcab2f09e86cb92cbff53517c5

SHA256
0cb8615dbf91bd556d4c2324bef179543546dd8b0d97dedd352a35627f104cbd

SHA512
7ca4e28a2da69828d07cd84d6621e2daecb46457b47d7927e4164fa2f8c0a0e48e7b43a807b8b2f7aebb638851c2e7133d9c514b5c111dbb2e8a5f2c7699f867

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
ea9f13e1e5475cea6b67032e04c61a37

SHA1
65f31d7a8d7b29cc88b9568b1cd4ff46610566d4

SHA256
35a682d4191a8c120bdefb41dfd622b352855d3663bc0b2e2f698e2918123e28

SHA512
2c7aad07cdbd955b8fd38fa54e2ace925f224798592a12e42a62d9ce33386eddabb14bd78208d08b738a5eed6824d11733b30bc2a0696a884578b5ccd977b5d2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
0fe696ab16a70c14a39b694f32bbef9c

SHA1
786cba25306fd8217123817431967c17287c0c6b

SHA256
198d47bfeda3a30b6c47527d12792ad75429d35f286b681fd0ffcd0d3a5eedfb

SHA512
52b86e0f7ba7c4b373dd1acb4c181e31873ff1daf656eeb326705ca00593fb3b9a52cb20a761bbe1443cd0eecf3ab7e72deffe8865918ecad4f42ef09475269c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
4012f03601530b7405b6906f27bf55e7

SHA1
b141386e1b4c22a15c00076abdbcc839ba5e1738

SHA256
9e8904f30e534df69e59a8be9f8c9e9d75b94d285f6828e7355a782cacac6418

SHA512
d2f623f0ce97f111090423efe08a6033e7eca35870baea0074abc49814cf51c20abe7c480160ace3f529a6f57dd0b50779b724ab042f557cef7cff52856b9ff4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
1801a701977723e5ba3db6af38ba8fb8

SHA1
7af5c052cd94d02385cceace93232cdba6b19633

SHA256
f64ba94f818d041e1f25f93f0135688cd8803e39ae38990c83f67ad31cca4739

SHA512
afd43b924ab1cebd8499d8e9f92b4bc577794effe8fe0e800b1de48cbb5e03b89252453b151c4402c10221347e807e411c2381b00e1c56b68daeb2844bb74b32

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
70748f15f8a90b6a65cc0b96f5b36779

SHA1
799b4631c9de7d687e7929f9a7b28b1d89ed1494

SHA256
868a5cd4ea0af0e11b17951514ce3e04399912e8fd726c71bea31fed1a044cc4

SHA512
2e8635103afd9bac657f6582492bd0db4ed23e9fb076d1a0abb46fbcd163aa3a127dbfc4629cf4fbf430e3c3b5732089ac344dd12870a2feb4d05e120bedd54f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
abbaff34576078d006ad715462e1e25b

SHA1
56fdcda9df37b75f42bebec2d9f37150d1dec3f4

SHA256
339ff3d8d3cff1577858c6f6fb3e7ac045ee8ea2c5fad4b2632fc310a75d6508

SHA512
9142e81247233dc7f0d0f5d4a6d506fc8489738d2096e81a4847fedd7dabfd93c8878d3ae85d2702a3e6c23bd2293c361fb1f8574d0ffd0cd454475db9ea9ea1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
a92f2d2b9e8e1bf2d1f875896f0a29b4

SHA1
73f430735065a962efa9b9121e303f6aa2ac3b99

SHA256
0d05a595b060674a64b16a02039dff9af90e97ab19444ddd138e4d6fee186196

SHA512
58ca4bd5f1a7a2a66c61605e2274ca8153bce2a7f22970816a3225491296d6c120977cbf8da48d1aaf739d4b8859df6eb4c97aca2bd410f608c255732e433b6a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
19561a1526beb4900356713f0b1a81fb

SHA1
8bbf4860ee06e8d8afdc46a69e9e255cf707dcde

SHA256
9c465f41cd528d596a489cd1eb6f41e511cf1d97d138b57fc5c2e73f030d0b57

SHA512
64670ce5def8f6cc3444d4f7f74f251ef14cd503046fac21345b10c8e123f2f782491b800330206304987a33d78967e5e93c129eaadae100b044b505c0c7e1dd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
c029e70d81347913a46fc08c49bafa29

SHA1
3333469d336fb24c6b579b61ca1002c6ffaacc58

SHA256
bce1129962e6f6fa07c86b71a01726aa618c7e948883e610099adf1c02196fd2

SHA512
faa8c16e798b30f128d8535b32348676744fc6b23bf3f67ad50de88a23f46ba3a44796e7061b0b7829136a1f17e7706478a2f9c69fb1de983b7a79b735913c4e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
aba71536cd419d5a167f2e44c9c9ffb4

SHA1
0ad32a817ed9d96af4968d621f049d03ea78dc79

SHA256
ae676f1d11e25500a7dd1d94ffb7a23c384f249bc3e0bd190acfb40df5a87ca1

SHA512
022ece816d3c740135ec30eb4ee52f4ffb44b90e2ed11c4a295e5ab1e972a30979173c503b2d33ba9dd9aa6fa9b3396ed2dcb938843b534d408463f5fbed97d4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
b78cb74bfdde1d844fb97baa06940c04

SHA1
afcf17920a38bae34d5dd219cec4759487a82414

SHA256
5f5514287aa6be37134cbb81c7a8b34897ea1f8e874925168d22de1e87aebd18

SHA512
4731d27f1981e396bdf25d5ac0c51a6a7243ef4de9d078ba08964d6bcf65c8c9e85b00b88ee7342c098e9cf967ddcd3b8cd0610c40068a4c3a53012165f46764

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
614a8ebaa18f1eaa092e422f4d0daaf1

SHA1
3ff7f118198bde493edea8d389e83e092484d8f8

SHA256
b3cd4cb1517afd2dbdc5a8241e6b4aee1dd65745efea81aaad921f302871171b

SHA512
b984f9fd655b99e1eeedc59e1a1f097489a4b08e91ac734b211b9b0609c770c61511b7625d85ad3fee1415379b0c7c211354a5b6bc7b8f18edd0da19708bd1cb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
e649e8e7aa68800b66832891ff947b81

SHA1
a09b1c4ce9cb9e4a13ee26c7bce315758e8272a8

SHA256
ba67098b7fe3f6a7ad00c43350d43dc20af41ccad0a6a03e56858bfa34ace7a8

SHA512
196877cb10a1e1bf9b5fde6bd776fc6eeebc17124579597ae07c837e339722fce0e1cc199e3ada53a9efdc995abeb5fd46ba0a444869152f27ad5653bb1984df

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
ba3dc0da2869c9ceb49f372d064075f7

SHA1
03e945bfd7e150da3f3f406d55629b18d3815ad9

SHA256
7695e5fba55fa33928251575ca30f95f8260f0b2fd58a4175dc04efbbbbfc440

SHA512
d5d1ce29f2d4b502d2cd5b016a7e1b54a4fccb680644853349cb9a7ab8be36e4f9d761bb864d78f4d3c42051d2e934beffa5b9a967737bb05a3dbe7902ad6d0a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
15308489d463af550af19cf7adc295dc

SHA1
a6c455b735e3e312c0e2ae91034185a8d2e2c76f

SHA256
ee9d56595500fdd8f95dccc5eb606fdab04761ee6a6a516be281bd98dcf83479

SHA512
d1dee6592095f4699257971ad80b976d8a5af7573b2e026ba4ab7c9c5b9d0608deaf92b27cc21f31c3b4b3dfe60762b0b03a7e429f69cdcebbc827b6863ebee1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
78575fa4ca539d7d9832ae164d82f243

SHA1
4b2d31a0bf20fe953a0e30f13598e246f428bcfd

SHA256
617270526069cbf710bf0923579219b26158eeca6c0d4573e0a77f0be5b73621

SHA512
475066cbd45984916c0acc2442dc714837041a0238c0c0f0838b5e9ee784056ae19e188eff10ed5e1e6a5579679e262f575689e06b857c8315c246fb063c1897

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
7f1f3e11ffebca7b450233c7f6755f91

SHA1
9ca5fa915c3354d3b95c8768ffc7883ed3bc9373

SHA256
2c389b2fe245b7fe132adf9825ec5527321620b84e1c5a0cf0e4f24cfc23e381

SHA512
4babff88cd59197648c5de7b24b4c15b958653cb744d028cb0e8dec7124aeae06ee409220d48c5bf7e5cc0f718034824867f33b8b4d87c5bc8c684c63dc76dcf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
6a4627dcb9454699c1bae78545046e4b

SHA1
3b0b042a3cf2352497d6f94d59b3d23cbfcc2d20

SHA256
92de3125b1b9a47daa8a96b5fc1788a6c2bee46a395a34c009d661e4de844cfc

SHA512
45c09d9ec4363ac42ddb5234f5e5fc61e285356934dda8e8dc83badf93154050735fdc48efe29c3b8ee3b673ecc11a21161e30488e251ea1f4a9595397e11057

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
46df7b7b691f76854cee9f2dd57e637e

SHA1
de5c04a0970a289dba83d710875fd9c0318e5585

SHA256
fa1884be733c1ffe71308536c320464344a2a983c0ee8f2f237f67202046875e

SHA512
d4fedaca44fa7b612c2dee15cb5962c560bf047a49ff1d63a0cfdea2699eb6df64f6235fa52807e97ef674b332d30b0f717e090e5f50a4f3fb7c9512a0e36d48

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
6d5a0d0aae05c12523781ff7035a3bf9

SHA1
38d6f0861862a2797fe82eb3f68735401cbce0a7

SHA256
e34ffc870c5f08dfb2660e39548ce8afde50fe0b9fb46760dcfae06ddad999f8

SHA512
33859ad3a8a41cc63e310dd97e0e19b4f60f3a5d3041ae3bfdb3541467fddede388d7240090c3691856a856f26c49e0057d9a6b8975526bf50e6f3eb40b347c1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
b12ed95e8d51dbd8a78adf64108f06d2

SHA1
db35ae9ba278ab9d013859e13de72882d969ddbe

SHA256
2f7c63c1f9cfefc117c69bc251135666fee4268bc46b750162d9f658fd25f100

SHA512
e4e96a641865b9c33587aa004b5d90e0affba8a901473442e3ad23a1cc7cd40585866aa33e07502e88282a0613e112fa76b97ed217b2d67b91e7dc7a64cacceb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
5b84577029c816722c31a4426fc6492d

SHA1
dd6477db2d449a2f9c0b1a4256dcf94e9333776d

SHA256
24fd0981ff1a0a84949950d0e7f80420cc3a5a6091ad23204cd6c90383dc1e73

SHA512
840df42038c25d30c2f2d719fccb6eb69e5741239d33d1de3b293e9b505c8ed5d1803d1ab39416113abf8256c7a90d7536ea06f5bfdcbd5da87379c920f2a673

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
16ca4851d5d94d956496c7e6ad7709d1

SHA1
af1ff8d362f4583962295afea2a29d629f9479d8

SHA256
de71cd0301a466b1c1e06169f3db3e01f99ceb23ecd0fbefe915f8214c4cc28f

SHA512
84005c56b2f124e4bb607591dadd984d2191754d9a20f2400b6a2dcd8c180ae27e7ecc74a68b9e69222a0b62e7806273ccd12d4fb77d1ab9dc5c4eb60576eaa1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
af50ff8377a8ff478ec90e5c3125630a

SHA1
36d18e0b42f7edfe1b48ca81d5830b72044852bc

SHA256
a75d8f0b764293089a633749b2e1210abbcb6ff67bf1f9db82f84039bde3f5ad

SHA512
c1ecfd81895060e4c26a992893e5a28562c2f9462eaa8da7b611bfc6f9e79e52c2b923f46ce1fe5ed041b4e8943ebb09313775d0fd4d6286d0488c4884593a9d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
df6f26d86ef20b5b2f486005e0aaff5b

SHA1
414806c8b503c56787705718cd36f9fbce1a228b

SHA256
ac29608754963039b44f89d1674af3bd17c0e59079a777835c9b19c75a4d4ecf

SHA512
82ae5c12592695dfae33cf53c2e14d2325e256f7e91a18bc6ac283bfd5df4d4a229ab542be75cf43bc2dee5160b6e6dad0b99a7764d66b18dd1200fc4f542e3a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
0365c6527f9f7eda5f4b5f2bfaa73136

SHA1
5c1797efa0b7ba31545ef823390cb3d365bab429

SHA256
61f85834fba54f207ab1090cdb2bebf4980deefef94da2343417fb25bda85a12

SHA512
a1df17c4f91a10b422e5ee123720dbc50f3be41728d9d7dc3cff72fe47e472550d942679b93e21260c235a3b6d2a6e45ad0fae0b90fab12c3b34c7b30f81edac

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
64be0c6fb9f961f5f49e6de498ebaac3

SHA1
555daa767052422a90f2964bf2ce23dd3703fba8

SHA256
74d974240d185fea32fef31f48a4dc4daf52edd13f81ffac3e2ee42a99c3a844

SHA512
ec44cc132bc8a7c2c53912785b7e7ee42716d00e76d2c20d4f5d9bdfcd51c50b3b6b803961380ef8ac8ac122e5cb0982241cdda611a33d75022b21dd0bf47fcc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
5844e4bc0c835c764b9c3f742bc2b677

SHA1
0e09b38ae537befced2eba2a2b77abd9896b7873

SHA256
5c2a6132d33d64565adffabd4cbdaed93dd3a9bac958cfd1e172afd9993efbce

SHA512
75cde3228f0f431ac6affedbebac6d39059985d306b3eccc43d0bd33978096fddfb15addb7539652ff27fdec3cc86a5775f8936325f0f9b3854e01a9cdcb5d5f

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
ac1de3b7ba0c27d84522cb9561e28316

SHA1
2b61c3fa0df95a3bdfb3d31ff757f80967e40977

SHA256
1c22c63cff0f11b7f0831363a3952a6220d46385488845d8ccb19d5475445274

SHA512
045ce38ef12642a5939091fd43c362e6c5e4920ea353498c1230db1600933ccb0f427190869eb6bcc02362368f75fcee91c4e269dbf76eb65de44d88f82edeae

Download Submit
C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

Filesize
383B

MD5
eca1b2db16019e4cd5ffb7bdfca70551

SHA1
719412e310b24357626c64247bd984c9830a24ce

SHA256
580d3b111bf25c4db730da0274d08f90c104a4061c0a255a70c4f7a1ab2571a5

SHA512
821314a4c2e3dd02a55b72519018cbc9e4268e0ba046b8aa1ac0f8fcd2fa2a270a8a5173263eae090c74db31e81248b207bd80fe0ee487deb2a66d6d792e8759

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
fb1a20d387981f42ee7c185b2afeab32

SHA1
c79d8381c5d4a877885c92130fb4527fee33ac24

SHA256
31e51edc38a6c0fd70bae1f596da2dbaa48524a02036c82ea06e650e1ca5943b

SHA512
afa4dd8316e9ad15dd3757061f5779e01a7ae5f92102eda0299aea7d015782977bf7238c44041c3771801719d41f9c2a0f59edc3e85952484f2f687465dfc207

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
319140e81e66c570ce62379384061f8e

SHA1
14cb95620439a8fa248ae4740efed134034dd87e

SHA256
f2e211123d096b7d4e7679ef35992a876aca07da617284cae7ab43260b3f0b07

SHA512
e4a68d1c25784721d76ac8a47872bbb8d57953728c0c892065e9b02cef93503c7f1622a370a34f3f91187b2e9cd291879001306bb9e17e50bb98889eb80e3d27

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
311d4a404cf206a8d46d12695e54567e

SHA1
f4889b3a92cfbba71eea9f2f32e8d6675b5622fc

SHA256
c0a7a594c6e386f9e3e1089d4c6f2e8c870c28afd0ad877955dbf63e63b1b391

SHA512
30b8e444ae22dd5fb0ed7afa64e3a8c9cc1b23caf2aa1840188989b8f6f1fb20624fc8df02c46f847793236690c600b166ede48cd6e00f1464a1d022ce2133d9

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
6af0004e29870a08808df08de46b2bc2

SHA1
b22570f0a0b97cb136ff9cdb5e3bd53bf30243f8

SHA256
fbff75cdfb4b4620b87ae87277f11baea0aaf63fc6b47f8dbb86b570b4bf8d6c

SHA512
1d1b8cfc8df0def55745a0f26a5073166b33a100785762ca6722f94dd48516a371883fb2c70ed247d2a3feb6ab4d561e25b814cead6fb90117985fd953acebc6

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
a1d640c275f09af2bd82e95b5632aa99

SHA1
a9acc584d86546690f4bb6f0307ea49e74c4a5ef

SHA256
aabaa128c45db1fe957e8ed40abe3556ba20cfe429167ad360f6870123fa3200

SHA512
a9181aee3209da4a7285b7e2becfc050e19e03084a9f128ecd681875087fb10244a7ff206ad84540ef18f204cb8c5c31ba5cd88226899d9ea2f47ab072aa971d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
be4ddebdc42a8d64ba2d470f5dec154f

SHA1
f72d8de4b5e059742c8f9e39c8279273f3e9cde2

SHA256
39eb4f8464edcc2b102ed1090ac05778b02d4a0c7356239603a48d48034ee951

SHA512
ed86cfc22860ad9521d49b1ef39a5764c922e6c6f94d475afc4e322aba4b66cf7fff6ef803490759a2f7dea63f6277c92ddeaaceca538478199d4c8f50c9280d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
62e4ca0aa674a94e16e6c0bc663a8234

SHA1
1600bdd048be881e3516a37d700a93911e139156

SHA256
73fa40424322e11061dfdcc54edf222b41612595bbd3a8dd0c590e5030311f27

SHA512
65d6c9428fd74593368adb5cee9b052d96d2e3333f4e335ea61e7868615ed60b59f74e74155e0f37ae25ea9db3ac5362cb704e604dff60e767a8ec7a36681e47

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
981f53a06f76bf4fc22b9d8b3fbc0f4c

SHA1
e2f253bb5aeb826e55d2d2086791404be323bbb8

SHA256
4423bc9e62093326308869720bd877a164f888287b109df2bd88060393e7f9c3

SHA512
57addef797ab12d1223982ef39e5b82fa18fc9225a922d014c6e89a14285c875d5fda3796de5192d6237bef8c9c7bec934dae4562b52ed2b798f667568ad23bb

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
e9b09b43d8eb9869dcc4bfab0701db46

SHA1
a1a2dd6c3b28f3009bc771071782c5a16a85b04c

SHA256
8246a0d15fb42dec422a70fd5658c6cd36e00628a969c28dc4d1e664d68e33aa

SHA512
11999842665c87d37fea016c953b4651dab58fa86b99b0fd7504590c23523336cf4af60e16a53194f4480412fef7189b3db258a911f38c0ccc13653d29f3ede6

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
49a860c94fa3f8fc4b230f94800ba495

SHA1
41d2560be0a28955a8680a0b89aa4760490a7b09

SHA256
0a03bd510a980590db1dd65c8594f8ce9d1679c0016f44875cb810966fb15823

SHA512
ffc32cbeaca1acd13979fe2c5411100294cb59ad41b5c9eaba2625bd8e183da3e1355e75d565fa45badd2bd9c2083529e897c2cf6dffa1f3505bfd291355ccc7

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
b1a37c6be85346e499974b3163981fdf

SHA1
de5e3f4f641c514dd11f2df5cfc0b6c600470567

SHA256
eed77d24942e4c87a087ed2d7bc11071bc074d0339a6296af422d209f7bc969c

SHA512
eb0b13e0d662377e73aa7878d18443a2a3f5600989a4d6f3f4169b36b73c755ad6864287220f0bdb61597b2c729d998227db89b78904e7c8a84942b7bd27f9e8

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
5397bd92210d8c7f2bb6e4354c767ef1

SHA1
cb181d4ecfda6d16a38e22aeeafb53dfc4882334

SHA256
252d0ab9c9b8cd08379a57114599a88fec956063268ab060b65b45d1bfecbb9b

SHA512
bc7ec0c3b6b7d9cf330361d9299fdff0d9f4e66d3b13bb463a9ffbcc714e94be1e99eca7b46544000c755ed4ad9c5c5cc4cb8f7b0de6ec87f0bd3d61f824c6e2

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
af613c8a1d9892aecd432c53ecf66048

SHA1
92d4b1e363d8d56a9ac06d191f3042f4dd73147c

SHA256
525fe0a8e4bac786085bdb9a1f13524fbda6138917bc3d966795a7ba30e956b1

SHA512
98a5c8b5bbd6df5ec0168cf48f4d8a7cd66514239ee325d6eed4637e2ab60bdc0ea0371fb31718523b158ec78fdf5fd5fa95a3fc437c1811223b6565696942a8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
d62284c2911fb6311d7cf406a725f989

SHA1
2e63ae0c3743740c18ee85d70eced5a29f93cc05

SHA256
5c8b3bd397eed93992810ab7a61443c13ffa9ad6422560db006c9e2dbb95babf

SHA512
465467fc139583f57cd657af1341efadee90b8b677aef1863d7982c8f63ae71a6aab58467c62b18b5154a07dd1921fad6617b10f0ac8b828613dfcad2f3a4725

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
59ae05d7b5a98e60d8c66de667fe76df

SHA1
0f5c6ece337b027a65b2022c76106b597d48f9b9

SHA256
70ee4ec0592d164530b4dc168fe0daee020c412a5dace9343e1d16c34dccebd2

SHA512
be14e3699100a75e297028245c3dea7f82e07f7523fb786ab3f1fc61672115c5e0edd76bb82286c49ea481a4c4cdb10beca9eebe9f243f0f116e734081a48af8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
b4d1878050d5934b7aeb4e8bde1929aa

SHA1
535acf4669b1225d3e417aa58f789917456d33e9

SHA256
44cc441169dc563553c8380be158e881b2068f34d096e652e31b1fd20c5c388b

SHA512
c9857e720f020cd05fce164f6fa353b49f11ea1ac6f6584689087638c39ea0a9f55fdc099c99288ab1c2c5b085a527f990506facec1272ea830fd273ba2d2676

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
02229aec089980060add6f87f8979371

SHA1
1a8b2346bf038d034f755dcd3ea7af3d4bc066ea

SHA256
fbed51970ef910418e6e12399ad1b44c15afe460f69c51cba3787fa597161799

SHA512
68c0a845a47daa36e4c21c9f1543eab9a7550aebaea085f59cbef8712fe99de83da4611475e5107cecf032e1afaf11c99ffd8f98a46bebdf35fc8bc6c08acd70

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
873df355827e1a9ba058ecd28ecbd96e

SHA1
53051348e7b32088bd2c34ab37b65a34c9669023

SHA256
da21aeb86c9cc708d948e6df476b83a1a7d71a5542e4ab7c1a2856c882a1fc7b

SHA512
d40ef3bf5a6ce1e389ad6eca19ff9868aad33b7fa8a0147e07eb2733eefaf3ace5d030c54c8d89e005654b6b62fe84b01d79b79c9957be31573130a0fc808927

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
01b4ed57234389d9023ea6e22f1217c7

SHA1
f0d2566ffada37aa6045cec8d5a39f7ee4e97431

SHA256
96f20e55b3f7a664cfa4c1443bf2bd5ae991617c8e3b8b70c09a9d271e5c3afa

SHA512
494789f389eb187fbc6cdd29c9d85c838e60f5586cf59e3dbaabdea8bec0e66b049413417398d550470e8fb7892f4add3114dbf88beca78a5ae92c35f267ca30

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
4ce6f5dadad48033e62047c1305dc778

SHA1
2c303d49e4095954175c5fa85118e243be2cf5c1

SHA256
520a7283ed66c42489f1d945470185616e3da395f486f5c25ffde8b751baafa3

SHA512
3566ccd807b3c26e1f66a20c57df3cf4208f2f3ae3e6f636245b1436fa1875c18f1e357789f7d1357ff084b0082daa3bcbdfbd1e2bb79ecca6d4eec14f340cfc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
e99becad19fddbdcf6efa2598bff1266

SHA1
732606b01b1ab714f15b12c457a71a038e95b24e

SHA256
fa830271b5f7cc31697ca223f830673005db76e0584552b654b61deb9c6a0c99

SHA512
f04d70e0b3d713965266b8d91174e826e6850ccdc071ad68ae3c8d2bb78dd1124bf79fb0fc63220be941e246bcb51144a4906b18c42fc24d774a06506cdeb3e5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
737d059cc439c6655d912018d783e7d4

SHA1
22d004d385be20c5d97492d28807f249ba779e77

SHA256
2292543f62ba18d4a63c253414eb700a11fbe950343d319695e8539cb7212cd3

SHA512
7fdd60b00ac52bbb43ca4061c93eb07dc1b080fc0b3fc567aac245667b66541a9ae73dbfbf6faeceb640d9483610d16d4772ee9ee83b396bedf7b5005a7fc64f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
d109005ef850d09195ad52c33839f52b

SHA1
4e1482fb608a367b301c58e4a51201a6a58d7e34

SHA256
14d1bb99df20491faaf91ef59b78044ed84b57f11cd84e705c1a056bb2c7f3f4

SHA512
02257847a0f2e4b37c91137b573403c6d51642ed21d7ec50d08006ff82c6d4bafea27ae40c5128d070dd7e415881634e101b997b4884fa5f05f6b1f9d45ec563

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
c7cf00f489707aee49e0633e0ba30c28

SHA1
ea7303bc51cc38ec96bfc94edf3e7eedb61927c2

SHA256
8b317f09732ee8ebe754f5e7519331bf7d1cc2c9b85a6d7a5d7402c98923b1c7

SHA512
f7c5cb109eb6fdd6e6d85fd2d7178331d9275b7546233eb30b085420a3b38b3a9b8a7211d5e0db29d95bb5c6327744b78a61a7c75ddc8b9c82093054654bb649

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
da3f1ccfed984202097b5e2f33d43a12

SHA1
999bfb77ad8fc4dc6c9502210ecdf7f8dc0b59f9

SHA256
65d867ab46f3a4193a458da0c40ad75207d3fb318b270905f39b9c4da9267712

SHA512
4d1c85872e71ccd32d30194bb8a972257446c7b96a9e5e8093b165508b4b253fc8d4461757f3d3780a71a8bcb9437024ba669caf9984093101aa7d813e57e0dd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
0a0b64eeaa79b93874b8c2866c9159a1

SHA1
f374f24933212374ca683d4812572699cbe33374

SHA256
98fcf4f455029f0e11a02e52b5dd8d048fcc86c53ac7dba9ea55f80e81181c2c

SHA512
216581e18352bc876a0bd09e24204eec43fed29a661c1a70c3f5b0e837abef7f5918ec7cf1d27f03cf2225bcf4e9aeb851776edb4b67211ca3861dd0e09824de

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
42a1d03e2964dcbeac32df435c542d60

SHA1
e2841823a195c1e5a6bd2ef4484fc357f4468996

SHA256
ec285d7a2b7188cd8a2062747954b3d9a170d01a69bedb1f5e53f03be908236d

SHA512
b6b33039f9a4634aa3314e0d66aed3c7597cdd7e527965830eb3d867b7beb7e0d908d27504fa587ff902af9395847dc395b46354cfe1446e52de0dfb7d6082e0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
cf66d25594e342255e8a49ca6f05f235

SHA1
a62905d77c3771473c59eba722c88ff9770ccf44

SHA256
0916dd9e8637039ad893b43e0a230dfb7a158380c8bc26334a6d25d604a1764f

SHA512
94094e4ee6d832ad2750bad6d6cf6ab5fca53bb7d740421f9208223771e8a281f931cf2ffea71dc128a68bfc44b0490931ec2588512b3f78a460171e5bd2b3f6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
9f94e1786f9476652aa9540e9920fb67

SHA1
8683e8fae2928f2b5f7e10e94d10c9fb594b11e7

SHA256
c6215fa52c5d16326352fdf638fa13c770365c78812adec39505e3b7a174de33

SHA512
20e2c3e8d698a0de3cf30e1bc878a171cde57bea2ece5857fe2907cbf908c8a783fcc5710e94b7436a0b790abf4616c37dbb6579259dd24d34d899469d07613c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
e93af450303d86bf884d82945c3babdf

SHA1
10a1b8dde99c1c803b85a402fc3c9645f498abc8

SHA256
cabba7f228ce67086d185c66d95111e9165163e18be6b7da84e26b6402109faa

SHA512
ed9e4ce2440a5f1bfcbb18df06a463bfe33ac26708131585e62407a11e5736117857e00ebd82a7c0eb7b5d60194eb581086106aa434003641bbf294a9003a3d7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
a94040f4359764bb2a7268c79d096cd6

SHA1
2844a1236659955f181784768eabab7dedf20463

SHA256
6009905a493889d61a5d541d51d372d066a65e89ae91ac99e18f88a7c0e3d9bf

SHA512
fa957c52849f9fe15122aa4782adafb1c35a5586d2480cfcbf7305999f4dae4a4116bfb19b9523d64ced6853c3f915e8135de16fcb903ce13ffad131a6e4a0b0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
43a26cf54ee2b74fecd81c01b1f6777e

SHA1
064f9d168a8f0fa27bfb98b0af71cef8cfb93b86

SHA256
88eda5ec4e507640e672bd7af234700d80e24df2179b4cb6da33cb883af21ac9

SHA512
d64ad33def11673961ccc38bb75e8e4e995b3b17edd576ead1bbcb6e93ee44a8262bf96b5495c73c2e09ec6a140990df950df45a2300b0575d1a9ff93b39a38d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
c14d220f6a9eb07194902ac29da65ab0

SHA1
4fc966a4292402979db225b7d1376cdef44b3360

SHA256
18daae2474a962685b66683bcd95ab18ef5a7219e8d94a7e8f152820e976e867

SHA512
951923fda464618bcc9a3caa56ffa7b5fc0e1ba1efa81595bbcce805cf66512467bbcadfc0b9ccdb9140886f2e1da8d6ea136f448ae99f5ead18de0f8f562162

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
8d6ac7f2b4214232b2d0bdb359837908

SHA1
a0a5e36d85489b5c13c8b280c27484fe2a44dcee

SHA256
43a969edd526860b3efd3e7212ecbe25cb22e03ad5869301a91cdfa88ffdfc9c

SHA512
af4e6ad4a28257470e82359eecf628c6797553462aa7021647de3275393171aa6ac20d815ab6d4843710ab4a93acaf862fa32d559931220e1b012226cf198eb1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
9e9fd2b8cf778994d991a86aa6ca17f9

SHA1
874bea3f075f768bf73023ed44c8aab761f6b2dc

SHA256
2b8e2bdd6797defd99576be12258e9cb3eb7b6b8d76e9de126972265b93c5d99

SHA512
359bc72892d27985ae2a1124345a2e8fac7739c154c38d28b6dd71311e4345517cfe68b39c95881c9e98d0493d062d81050a254d0bbe44dc7fa1ec0d472769af

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
4cc9628a7630fa40dc11b31a6086f052

SHA1
65c30879b332387e870b9dca7cfdb43feb0e2461

SHA256
cdc5bd46ee50b6ba346de9c7d2614b963be6c93e8370c79dad7907041847a71e

SHA512
0aa1c3fd06d0621f27f8efad316ccf085d52b698d2b5d3bc539fbda992d7d038fbb90aa6f67779ed569fc02b30120a5e803077c12522ca9a7b0f599332b4e0d0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
1718bebc550dfdba0b285a3802bd1253

SHA1
76fca7656f0301cba7df8e89618a5c03c83716c1

SHA256
1f0a78a5c87bee0fce46d81ad2f37d385b4d59f510aa6ea90f5db3ed0560bb3e

SHA512
d8bb6b192ba3a0cfbc26138b80233d126b4b6e1238c02d4ae8f00086e2efef2277401588dd1fa53f7e3c56bc693538b3d27a0a2a379e5f426b3151de8815d712

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
48243ce25758a8591173ef210bb38d3a

SHA1
66ec11915fe57710018f5c821a4a9c52e6241431

SHA256
575afd33a33f65afd0a8dfa973800ace029fff508f61cba04d93d7b3d643d2d7

SHA512
3699d752a83f13eff4d90f9b9101e01254548439ccf25ceccec35de34ddb3dcd1f34433364bcb9ad3b4e7ec40c39c507e16e3edd4d59bf3e4b67e23e9c1a1550

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
21468542d0d77476295c7b76d8a57546

SHA1
ac7e407700ebe8db03c1e23f9b27622dcacde200

SHA256
54b7a8ac5904fcb945addcee7897582e3d28016a20764e3d55bf5480b8ce4411

SHA512
04bf01f2e5488dd63c9b3c95216792218ce6e36b2635051f42505bb3384c5a1d02e4acaa82745b7de7a5eb9848162a1901577c0433376c62d86bac43896caaec

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
0d5adb2da754bab20ea35f99e5a732e2

SHA1
4445e497e40966ceac8737d4683e25c098c9f7dc

SHA256
9f51c8f046475f7bb730337ae53b4dfd7949197f26bded5f8f3304c7c139f26a

SHA512
6337372363a8c1097459479d5f913656ecdea6d8df4a7726e27a05fbd7b802e2b33bb88964cc2d84d97963da2956d65b50ad4ae24c6d652a47b8a8946ce0121e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
45712c2ea86d3a090b246edb50c0c89f

SHA1
aa82af96e1a2be0f08b6860d8a73990e911d9212

SHA256
f11ff00bc2be98cf4500c722e9ee10777b051c301aed796b4ddfae71fcef1873

SHA512
c5cab4aa4be576e24d0a228b58393d93dd85cdedc24722ce58fc43a4edf5422e146c40c1beee32deff6639ef67193629eb5102a8da6ca3c48faef04f168e2087

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
47183377a3e3d8d34791e8c64e5b6791

SHA1
095a49f0eacec0beee4db5c17e055f8ee1aefa6d

SHA256
09c85a231d7df460358846072f6ca8130f561145d01abaddc67593426befc64d

SHA512
0ec0e9fdb3cb68c09719d553a6d23a914c5d7b067df23efc6e02b10139d9af993591ed095b049208d7558498c5a40a7269a6c5c1e931a7d7a5596f3a98357121

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
482e1c6f3e9d59c26fad4b9411a9e185

SHA1
2eb47a5796d645db0e89e765a9261b666f1d18e2

SHA256
d54500626912caad3bd3f4d3b5021f663e568ff433b165f3de66277439fb8fe2

SHA512
61061f5229c538c4dcf3b4d1cf7b3480ef710368452c3198edd829fc7150453cfbbf2dc9385283fb29d15e418c222d007731408329f34487c638c03994fe2026

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
42B

MD5
7bd7b4c8f02dcd6f91a191a5b699d799

SHA1
9ae2f013fec259b95c0840a67bbd5ec5cd5e026f

SHA256
77c1a96a1a156693e5e7b805c2b5d0f48d010c1972fbe9895d5a29e54785523a

SHA512
dbb0d9c087860e39229ed92daf5e3c638ad7eeda9ecc59afd88255c044f04b005f3694c7384ce0e008810b48451085c43d836daec6ba52991f8a12511dbb3533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml

Filesize
333KB

MD5
9d0824485d649f1937f08b4a366915f2

SHA1
7c9a8a7a2e806b0bfecb1727d9932dd3cbfa33c3

SHA256
02281ef001f5f047e3d4cb68ced87a0e69a0428ef2a764e2c1a7f1ccd2387676

SHA512
1371e17e1bd1ba5b9e33bbf7e92400e367147fef6fb25482765fef63d3f3b2676201151e39614debf31761c6a641ee3ed168819effeaf8597695d44e2dfa556e

Download Submit
C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

Filesize
8KB

MD5
02355c117d7e11009e7b262e30f019f7

SHA1
d7112c4ea46482aa729c60cd8c2e3b63157978e9

SHA256
9de33e05dedd6fbaeaba2cd8e8d1b7d39e8ed17ff91df13ad6b5794f97c01adc

SHA512
1393142e65501954a04115223ba12ff68df3c30045c9bab9e74a9bd1aa95e222b8255d43cf74c029236f6d770b9924055d5625dfb30be3c8efe78bcf8c0f3ea4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670753988092688.txt

Filesize
77KB

MD5
4421acb1b3435da121c253f9b0c453d2

SHA1
e5f8433df53e85ef549a94ec18c6abe755bd6741

SHA256
22ff7ac847734e88f6776959422ee5ef5718ec562716a26a5ef389a68d66472b

SHA512
c0b05b820a7b7db41381e99683ffde4ca7456e18c79be8ccf1e4a3c66f5623712c43da73fec39d9d4e664efe255b06582326d4d9decc2fada234c8ac851cd74a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754513600213.txt.shadaloo

Filesize
48KB

MD5
342511b6d5443690d694f051b0ebfdbe

SHA1
e9a0bb0284729803a28a6298ac8dffe063999d77

SHA256
322e0c9567e67975b3c0a93bc522868e8fac5dd04a5d4156772492e9f2e28ad1

SHA512
a297cc2a8a934240219d855e491d9aacc9cca57ffd769d1b27165a998329ec2952139468522c2d0439f559e69b6cb02bff4b77b41f7cf79210a1220cde5dd019

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670761155176116.txt

Filesize
63KB

MD5
d64b6bffea9fae7813aa9b686da8b2ed

SHA1
dd95c5eef780c6dfe18e6c7ed0ec1981e44e3292

SHA256
565d7252987672b8074b4fb36641092b75497a756ead3e824b84855634a8bba9

SHA512
bb4ba7d00a4e1c7769fd8654f40dec511f3f83142399829813027f35d2dba13c7cfbf50bdb511f778b46ebe322a571ce7586d3d5307596fd75f674a649a68580

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670763712487382.txt

Filesize
74KB

MD5
366666f82156e968b70b4e25d934f69a

SHA1
0c74352362edeffd08ee1f52cf218eb28b7da697

SHA256
72190714abba2ebf0c2e86e0a809404ab2d55bd20dfa310e7d0ad4f710f99f20

SHA512
4a066191ff8fb127f940e2485c815e9cbf5b6b03ec7b9ba0f292477974e702b6ba8eff006ef11e925ead16fa4cab5619e3c0beedf5f0c9b51922252224c1bb90

Download Submit
C:\Users\Admin\AppData\Local\Temp\wctA042.tmp

Filesize
63KB

MD5
24d94fc4919cf59c25852058a6385d68

SHA1
ebef76db5e532b500c90914b025990d6f174e1ea

SHA256
a9b264e98b5f7379d7616b041172bb606e25552220f7bbc6cbe5a21ffb909835

SHA512
9edf5fa5c185568a19c9c200a5a28fd807fc67cb894bdc21f46f170584ee520c821cfd1b3a5da92154e93e4a754e1797d8db0bf30c8d1b67deff730aeb872429

Download Submit
C:\Windows\INF\PERFLIB\0409\perfc.dat

Filesize
32KB

MD5
f163169b9969768cbadf0c8ace716889

SHA1
476778dbf6b1dc5aa5d49d04c0eb9855e4809a6f

SHA256
8723aad09487c22c76d6cd4d9bb850ea0dbca10db5f0549e31568a6dffb1d606

SHA512
fd4fc9c692c10310c872d4c03dfd77c2cdc678e44c441cbd562db03b3a2e1bad38ba1c0384e7131df15e667e7da3993e9749c1fe5c34dfb9e084808387ee045a

Download Submit
C:\Windows\INF\PERFLIB\0409\perfh.dat

Filesize
290KB

MD5
3c129da40b17d6a442e90a9fc961c7c9

SHA1
54d9b65774c3ce270cf003e0ac4ce6ba3d011e1a

SHA256
87dbfba8abf0395641a1c26e7d1f34a54a2c036c7670fab35f6dd19b0cfd0897

SHA512
dcedae7cc205375a2ea722f6da405200603bb0a70984b7c2df30ea1be8e55cc04936d0e98df0f6532f6ecedbd7cc67f83428310f3b8cfa2d66a028a98a987a7c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml

Filesize
317B

MD5
61d91468d57b133322ec22a3d7a6c53b

SHA1
9eda1af48a20fd1c8cc8319c4c5ddb14fc8f712a

SHA256
2e6fd06706c5ca5fbb9f0a6abd88f623e5fce76eff022e2b9e75e46f3c4c4958

SHA512
5cb050217cb3ddb4e0598c23414e153f6e2ed2165218308fb0332bb3458ae68dc2f3a287f5e9a8d8137b505c63113c223aa86d1eeed165ab5dbcc0f177f6d21c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
922c7bea5874705ed8e89098ae5d7e74

SHA1
9db88e8e166a5c8d817cb5b55189125a2b8735ae

SHA256
ea90233a188ab4d37477531a598145f24ea570ac2c180466be3fc2de0f896b41

SHA512
83685184bc2f538329ec406d67726faa34457f31b99f74a49c06c5cec1cb304fa6867b2e7768824a22b6140a58ee95d1ef6d3fd2fb054eadf7dce4cc1174a07a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
8227121dcbc5e1ddf5d47052b65f1220

SHA1
19e9484c0a8c5a541609fcfaeabbb2784f47ce45

SHA256
1ac317d30a20f3f5061bd58ce3506b655babe2f56814b461208c36e8669d9e6d

SHA512
91cca6e53b083ed13f4f4789d761a93247ccea0052c61acedf840d01e69caf319cc8f2ef6a272fa7d74582b2603881be6d1106311b28c1ebb560201946fb7ceb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
93e68b969686cd076de3a1671941ad07

SHA1
645ad92abe3c305c5aec6096a6ec11574badaada

SHA256
850ccc5c56018a5a1fef700648a5e04cbee5d762f27b5fd17468909f65495383

SHA512
72e9c3e74339904c565617f47b473c79ee963adf5a90bbe50cabb1401a021fcfd909a977b14c1b77230ee81b8c0b90be41b109a26e4c07544030a2dc9eb89a69

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
0cd5ba23ad85a0482c0fa0aa23eb3344

SHA1
3d33eb77ae316c2195f80eecda7c5ba85c7271b0

SHA256
39538f4871e3cd7ecb7f3182ecd897c7effa83d8f9d70469cfe95316d33623b7

SHA512
6fa7fa8207d094aacb9b6cc943dfadc712e5f885e27fd5c0b5ef80152f0233b25d64c0b4d12de5c19c157d7d8f8a36de3102d1e7ed1ded7c09ea1c183a1ecb6c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
2d7d5dd04b70279017ced91e133527f3

SHA1
8bcbf37dd8c4afb0b4bd70de464469cad3da64cb

SHA256
6bae42430919ae65e3a2f78d9790456006fc2ad9d0c709f00552c35f28dc5692

SHA512
d913437213c2696b36b9e45835bb91cc710dcb0571f4b552c14ae3393f738fcfb9ac4ed268c6e8681043bab13862c29147d45d8fb4432ed150f129eade3095a5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql

Filesize
24KB

MD5
4dd53cb55fe13d8d1c6743574ccd5783

SHA1
27424043aa5ef66d9eccd4cd1175f38ce30c87a0

SHA256
ff496bc22c54e6ebc3f72d68ae67f3a41660f8800f65d0ae4478f7e9e2b9ce15

SHA512
ab64aca32efd66a0015e12652f62cce39d084ab4c3588916cbad6353159d7bb769a1edca4fbdf7cead2cfba6e69a3f8e18bc10db2d4243010cd409bfc7b0c721

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql

Filesize
54KB

MD5
a63e82304a46c04796926449bad31193

SHA1
4f5fc1a314ee61e4707060ee037088150baa96b0

SHA256
50b564bfe19c7df2286860f82588f475130d20ff3f4ace04c6f6eb6a2f3ec550

SHA512
4bd66085badf408564506a7e27b8b90b9e848582629ecfe245b4000edbf3c64e12f93d9a02dc5e3b2f30473caf488b2f5418a27ed82ea2f86b81e19a79c41d35

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql

Filesize
51KB

MD5
366c279c2c0fabb310a968bf76cdc111

SHA1
ae358ac293ffdda23df9edd7e4e0fdf0f9a03133

SHA256
ad6d523d3528798d462fb6c5f97d779a151b8b9cc62802da8b00d618b46f0c0e

SHA512
d4b3606de16e1f800c10a4be0f0cc40d75864eeba6633f379d900ccc6c2043a9feeaf5c4d0b16d1624a223efd8e17a5cd5da3a7c5283aaa0c938e62511bb1192

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql

Filesize
34KB

MD5
06196221b6505b871604cc8f302a1fc0

SHA1
27245213a1c999bcb28bca303cf025677d86c7c4

SHA256
74ff1076fcd1a8b8476a1f13070e7817ff334d2b25e1a6868641af7ea9c4a08c

SHA512
bac576245114df5fecd894ce1128e60caa23e14be1905d6b68534c65fc291ec4dbe455a2be9a7a0acae12ecaa3ebbe41982b1cf911ebff2bf17614e531bad245

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallProfile.SQL

Filesize
20KB

MD5
6b83cd6d797616760aaebc659bae0443

SHA1
e1156d5ddbde08390dbd4ce72210c1628d4e8248

SHA256
204fec6ebd0e220df9f3d9f7bec657a01fcf51df924993de158e81c8ee79e971

SHA512
9f7a27d582dece660fecb252b4ac66b9978bd54b8e9db1c052cf3194f6a866cbf8113236701d857ffa5685ca6db1b0b9605f226b597ebea7d18e1634a0ac5a44

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql

Filesize
33KB

MD5
5f66fb5a252ba49ad11310b3e6d1b357

SHA1
3106ea8a4624de4a0eb035d3a456a27e08890889

SHA256
2f78f7bcccee1a276b410eca21a593d22eec006ea13e47cf59db7f9f63c854f0

SHA512
54fff7097ef521d03d15f7e43c0b76fdee644d14033d5cecff97fdc6ae8e855aee7dbb05c3e7a28a884b03b91de682e8555d3e41de221a2eb6761180ece27b8d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql

Filesize
50KB

MD5
22118987f2973103c6e78878d009c3d4

SHA1
eae4d033a97aa128593447c05f894a795973301a

SHA256
08e5cb0e5bec175f816a32ea3862bc9043bf284c7681ddcd1cca9fa1179e111f

SHA512
2a166cdc8e1b76a3cd0d40fca0515895fc1ca971bb56e1d8b7fae5318c1a9ac2f4f7544c8ed0f9f2315747953906cdfcec2b68acf05b29ede3fe316d5eb23a27

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

Filesize
52KB

MD5
151aae80ff39cdaa4514a4862445e4fb

SHA1
24a9521a2ae3568c27fde417d6f1dd59904a03c4

SHA256
10ac8dabf03816be414d141fcb9e75d71580f9dd575e4e033b3e59161674fec1

SHA512
20460f9b81fb48ca6b8d80351852bd0fa3f85616967a76dfa6ab1d2c570076c24d573548f3a81b8bb1400eaa7eead526b52e18c7a2d554d2b100770452ddbdc1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql

Filesize
6KB

MD5
fc2f31fcdeda9cadc2ffedcf47d855a1

SHA1
ec585446a107db9939323b3b3e52105a5999a656

SHA256
6b26fac9a73519b18920488e0b7e7909c4b6eb387dcb3fa275676ab6c42a7fca

SHA512
01ab20a6399cc6216cf0d1e30ae28043f600eb539d70fbec4ba702acecaf389d2e66ca536ae7402b5a361ce83c84c5c026150e05c6c2528de953c7c7033bf060

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UnInstallProfile.SQL

Filesize
4KB

MD5
f94b30baf031ebcee20ac6f48d2ffe2b

SHA1
ad46981775cd4c7bd01c484faf4e164e5cffc5dc

SHA256
b9d00c30c3b4bbd1f952d4b4b6574085f4e4a3d67236eb351850eef98a9c28ac

SHA512
ffd567a8fc309c6223f22a780b54c357d6c1dd0ce0de160cbbb5d9e7bfe69f85a1bbc9b81c5b72b9da44e9400974253a37e600d02e071d326a9a9bd57f90bd33

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql

Filesize
3KB

MD5
084758d2d5c5ed3f81a389c684b065a6

SHA1
73c5c0afdce7bdbefedc23853f837fcc0344d0b7

SHA256
95c3d02aededf12b2d0229dd55553b5cbad396183ceff7f7944354bf3bdfcdd6

SHA512
ccaa2159ea83745ef4ad7cb5ba264acc068fdd25b555bede84c6fcaf16a91a0e0921546670ce541225a3c48a73dff1471a067504d1a93b127831a47ef72b15bf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql

Filesize
6KB

MD5
fa7e4b90f1f5d15d95146b1a00389694

SHA1
d99081f794b0c36307fa3cbf96acaefeb0c41ec9

SHA256
d7498f008ddd33800e9a4f14547ce2b31c5340bff25a9c1bb1f74592dd44831b

SHA512
ce94ed75a8fed62a198af49b95ff470326ac5e3858b81c796d94f5a48061bbb37c6d2f1a937304e57062b24f394a903da8209132a8c76686fbb838919743cf05

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql

Filesize
9KB

MD5
b89eac036d23cea360d624ea591b6121

SHA1
aaab6cbf8441867ed66f21cd33407b09486d133d

SHA256
46fabd750553fbabf06e1ddbc4976efbd9e39a317febefb139b5802d2da71133

SHA512
c5bc92b677feef84de317ba2f2ad7d15dfc88459914fab67294178e7ed621e7f52966b21d74c665eba3043d6e7659c440915d6dddde4b00c9525567d87f7e99e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql

Filesize
7KB

MD5
e5fdc04998ac9ef69f0284d3489a619e

SHA1
2b2297ff17c4d0961575a88a3a1e36a435894f0d

SHA256
955c95e0493566cb097e081cb953e1b784e8d8283315e971022675c760541310

SHA512
b37334310f5dfee050164e7928c8c49448c3ca6e86e2755dbb6e5474d449398d7650ad229af642c7b082dcf5805521495373358f7e255699c1cca0cedcf5109c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql

Filesize
5KB

MD5
dbb0e01aa70bf7de5ede14f7c4d6b4fc

SHA1
c1c4337a601813a309b083039b670a168b6e2fa7

SHA256
15e42e7186ff390339c1ecdbee72fd9fdf39b36785eff1ca69d4c3e3ccf5d99f

SHA512
6e4fdfdf4012b3e5dabbb288f9ad374019c4d659c8706ca7c45e56a202fb52ba6a7f976c77182ec5563a91a06189f027db961f27b6f8926c868a1c681a02052b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql

Filesize
9KB

MD5
f9da1d48b3483e223b99f368f51c679f

SHA1
29b5b9a66d8002d96b9d4fccb5aa285b8648c7e8

SHA256
7180dac99042c78ea9bfc23be611ce3bc45f726ce451f0b8fdcfdb87689d39d9

SHA512
f0691f73655afdb2022ff70ed64f76fc2ad033b9ae8d1c097732efc03a9af8e7eea73c26bcde526480b4d00d0e4cd4bc89b9f66045125e63ec56978d190cae7e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql

Filesize
11KB

MD5
0e8a3d0d4237d692fbd1429008504039

SHA1
ad27dadab414a26c1db355bcdee8988512fcc6a8

SHA256
4232c6b6326ab7e408da40d67066a342291c12c91a8c9ba9cb19b747e78bc0dd

SHA512
41643a8291f3ef8c8a38f5d62f1d3c8ad6ba1fe9fe1a5e37cc55b8aaeff6d7ebbf1595b59ba618dec41251b71b123f6913293371eced9e907da45cb432418284

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql

Filesize
2KB

MD5
11d07cbe377fa778925216d2c682645f

SHA1
71905d2fa2658161d1c50fe3486dcbe03df7a49e

SHA256
c07564676173ae41970f8dd4c291f6422ab59f85ea0317c69cdf235782432981

SHA512
acbe5e306e521ffc9b3035044bfbfddd54ba567df9ff9bb29572a8e9dfa24d3f6698242e9a7aa4d392a43844ea7430133505b66902c0fcddf8df4d33add6bdc4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql

Filesize
23KB

MD5
7d7c66bb5e11db3ba465fc8fb0ff879e

SHA1
7c6912b67d0689dd42783987d63c3fa071c24573

SHA256
742e61cf37e5729a46211447916ec6f9cdda93f71e65868b62e26e1f222c19de

SHA512
478a1268d1414d57f96eedfc77b61b5bb5f60250ec3e17f125b98fef8c1f68a1cc5d771a974872781b217615779d7f216108dec3e6d0cef6c63c24b53c25bbed

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql

Filesize
4KB

MD5
1225e4f96d1f3fd90dcc51f65dfa36fc

SHA1
e6c0d768209acd00334550426b44b71b6d9797c6

SHA256
d3e499f8a004ecdaa0fcdc6543de9c931e0ed048973cd2a8a59f2c6711255029

SHA512
693e617139e523d612f9c2a9c752a6458c1ad81430171f24980e97622e57c4ee1e8593509b0e68f806f15ea8b1abc37f956f19a28500a5d92ad9abbf09fe851e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

Filesize
372KB

MD5
e6cf8085b994c768ea860b24f347d2ae

SHA1
669ba93cc0820027808e031210fdf4c9e55cc09b

SHA256
93ba662fe55070de01d92b65b9e616d6de49898165e3b191005d61d0c41af7fb

SHA512
2e25cb7ef95befcde05ece27b7c5ca2fa98d6470fc0ae1706c0845ea8361d366e7c7ad5e110546abafebc41b64b335b1b6bd2c8ce2084c0f0dc444d8e4bb42a9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql

Filesize
49KB

MD5
368edd9c24aa1bc5a73e0938fcb531ba

SHA1
69ccdd9041c73b6b9032ef722f9b4c3498df8e04

SHA256
f7122371d4e721077f399701f725f48c9faaa1ef586b5e312589a470fa7c21a4

SHA512
f2fd15b82199e7410cd47e332530452ba3e292ea4627560e84b95268cdee410e6aeba28668b8bd698def49b9078821ebe3bce2d535129e95f66e962ce019ae07

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

Filesize
2KB

MD5
5b50f4529d4e2a977b817de39d3fc2ce

SHA1
780478de6f1e2aea1ac95be5dac5cf4a19159d0d

SHA256
0169a00b318ab5da82f566488661eba0e5a5f63c37ce2d82a50e387d30b6f8c0

SHA512
950732376be1390e261a87b6bb2ccb918540a03f040d95e50e88e5cf048b5fe22431d833d9b1156ff3d1efaa560686a64d404341a51f071d6e4b82df42499711

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

Filesize
13KB

MD5
0a7e98647872381e83f99420004df3ba

SHA1
1d27dfa2a29f239f7479057d0370ebe1e204df53

SHA256
b5c8d2c030e6e6e4ed96109d360861cb6bb6c77759ff0b7cb04609cf47b4617a

SHA512
df1a7bdd4b5b46d4ea0d193a00f6e09d970c64dc062b04a9872b26ee5580be703d2760cb8035655af7b636d970650bd93e96e929221852bc0fa7633a6085b02b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml

Filesize
62KB

MD5
1c148fb3bf88f0b88f25d974828572b5

SHA1
23bb8251c5eda799490c4ad332bdfa1765d92448

SHA256
efe0fd1f4c8d9a3c9ca1422416c4102ef093b351a7fe5270a7aaff311292781e

SHA512
32e6e52559eb4c228be3fbfdea77155587a8b1766bd406dbc5aff5d4b3d507f0b13f0999895796ca1780ec224a95a8f32c8e7a1ccf08ea0ca26aa6cd21417b19

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
c71ca04764deb2b886f5c3867898e354

SHA1
946bb5b017f39e6efc8e23d38626906a28104bbe

SHA256
a09695181fe307606993a1c1802f8ed3c2a3f2c6c874d2b6ad66c640b7ac97e2

SHA512
0b728d61ff1798163d5e30b5784641a5594ae5d053d168e0cbe3b589e6e203edb6f0e8ade8fd57f297208be7e2657017a230869065709b285e7821f7e9867de7

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
dae83ed0187ed5f27c36d4efa039e996

SHA1
a675326c0bac9f0fe57dc6b0cd206d299f97cea7

SHA256
69fdc95d0aa243a02b2e8ca2bcf756bc7185c5eeb38ed9f7c45a4671deaec7ea

SHA512
4056ed2407f29a0b55b388f3149426794c9e2241bacbea999ebd79cbe16443d4e850c7b5d941ef7471adf6fb856da443ed7dc1b39df16f15cfbb1566817216b8

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\squaretile-sdk.png

Filesize
501B

MD5
5e9175d3b3c78e0f81d4d13829f9f63f

SHA1
b2c94720569f452708e23a0db735a2e130827a93

SHA256
35e68178a8260d4578ae792ec8ed681767bd95f446030abfc0f840e3222563e8

SHA512
2ee299bd52cb1162597e3c594b52d2270555290c59db35ec98a8c626f0267d8c1bcba9633b7d1c2e85d32552e4cbeaffe169738375ace7e5872b0280e91da4d1

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
55c082e5c753a3be7704ddf066d0e895

SHA1
ced13c44a19f82b143b033378d601f93b1de3388

SHA256
e45f697a81e1cbd46046a50597ba9af08e1d8311647d62a17402cc418b0f63e8

SHA512
8a7dff042cf53601adb5212f9bc6a21e48de61faf38096def0a733188e22b57d0141a7b2885ab426f76c40c73ed92fb0ef80abf0e469c83a7c14166a6830a0eb

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
c4be1ce9dc39fb83fd5a2d617c2a4837

SHA1
eca34cd429eaf350804bce704d19ea61c74fd54a

SHA256
403a36ada7f7579d09670f9b98e7dafec1c2e1beecc5fd26ee6b5fd0b4f2505c

SHA512
3e736e36954c970143a82baa806fa88a36db812d09c08a6ab4d19a78e6d0fd2c42c6b8e59b62f7f4c3fc7806f5b1d9f30e934b404de6465e9280300b034fd64e

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\squaretile-sdk.png

Filesize
501B

MD5
cc732d0bd874a5559714f32366affe1a

SHA1
b1b7b5585059d53f44d8e0dbfc260472ab658c71

SHA256
a836ae986ad1fdf66b57b8f55eac652b146a474835c2c0ee3a6afc945bd60bed

SHA512
3d9324b6ff7f7db2248f609f2364c515e39985e7db154df70926194ea141cc67a8283b8ec91b0c0f71b97476755cd272ab6af1d5b44c37f1b5821c91d18d4890

Download Submit