xorist | 66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
Size 7KB
Sample241005-pphbrsshqr
SHA256 66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62
MD5 0a85ea7926dbb0ea07c702d6894ca1d0
SHA1 a91d0e481699281efab888356ee718f6669659ab
SHA512 212612f6e9b3d2051551067675865f9172b9cf85fe911ca8a25cca454beb48bc8cc46c2d7afe12a4bad5b72eb967742226d574d2ac0b0fe52fb3f0c1f315f2e7
SSDEEP 192:Bzdrr1FG1WDCgmjPZxvdFeIyPQt90PMUA:Bprr1gkDCgSnt7qMB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 7 IoCs

resource	yara_rule
behavioral2/memory/3968-6100-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3968-6103-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3968-10607-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3968-10967-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3968-11296-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3968-11297-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3968-11302-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F1LgVty9W3N01xA.exe"	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_f83138380f5fb6ab\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wpdmtphw.inf_amd64_1aae998f86058cec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\sppui\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\Com\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdyna.inf_amd64_d89605b6b478d768\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_0e2452f597790e95\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\intelpmax.inf_amd64_2ddee95f7a5d85db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttte.inf_amd64_f017e7b18ec67a97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vdrvroot.inf_amd64_5dbe5e81fafe4636\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\migration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\Dism\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidbthle.inf_amd64_bfb3ee8e5a97c3be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\memory.inf_amd64_9af3a8a63d4cb5f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj3.inf_amd64_9658f2eb83f061c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\sk-SK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WinMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_camera.inf_amd64_7b52a9607d24ece6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\MUI\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Kds\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttd6.inf_amd64_28e2bee7229aaf9f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mssmbios.inf_amd64_9fc7fe03de136fc1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smrdisk.inf_amd64_bbef253cecafbb1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\MSDRM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa.inf_amd64_7cfab61cbab23e11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_5b6db32fd04403a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\umbus.inf_amd64_b78a9c5b6fd62c27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nulhpopr.inf_amd64_9839c838c72c0594\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pmem.inf_amd64_acec109593aed940\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sdbus.inf_amd64_55c0c78952233d0c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wudfusbcciddriver.inf_amd64_a084e687a06b255f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\040c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\AdvancedInstallers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_multifunction.inf_amd64_8bf0fd2423b20b97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis5t.inf_amd64_c6e181de81a59b54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_sslaccel.inf_amd64_ed6849ad81a24c48\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcpq2.inf_amd64_2115846fffc22bb2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\th-TH\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\tr-TR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ProcessSet\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\winrm\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fscopyprotection.inf_amd64_9c108d8ac558a80d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcodex.inf_amd64_f5594a2af66d11ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_101a408e6cb1d8f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpidev.inf_amd64_0f7f041f33bd01cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\SysWOW64\DriverStore\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3968-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3968-6100-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3968-6103-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3968-10607-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3968-10967-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3968-11296-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3968-11297-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3968-11302-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteSmallTile.scale-200.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-40_contrast-black.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\people\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-96.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeMediumTile.scale-100.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-150_contrast-white.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Dark\IsoLeft.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerSmallTile.contrast-white_scale-125.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\progress.gif	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-400_contrast-black.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\dd_arrow_small.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_altform-lightunplated.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PeopleMedTile.scale-100.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\LargeTile.scale-200.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_scale-125.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\5.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Marble.jpg	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-32.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_altform-unplated.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-125.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-32_altform-unplated.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\capture\shutter_button.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\MedTile.scale-125.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-black_scale-100.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Light.scale-100.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36_altform-unplated_contrast-high.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\add-comment.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files\Windows Mail\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_scale-200.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\MarkAsReadToastQuickAction.scale-80.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxBadge.scale-150.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-16.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosLargeTile.scale-100.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\150.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-125_contrast-black.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookSmallTile.scale-125.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-48.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Snooze.scale-64.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-250.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_retina.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-125.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\YellowAbstractNote.scale-100.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-100_contrast-black.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarMediumTile.scale-400.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..-unicode-components_31bf3856ad364e35_10.0.19041.1023_none_8d723d8c46de7ebb\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\i_show_pseudo_classes.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..t-services-unattend_31bf3856ad364e35_10.0.19041.1_none_7f0c674a44158439\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..derninjectionbroker_31bf3856ad364e35_10.0.19041.746_none_1e15455ff63524d9\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\domDeleteAllBreakpoints.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userinitext.resources_31bf3856ad364e35_10.0.19041.1_it-it_219f839b6e885d59\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-printing-xpsprint_31bf3856ad364e35_10.0.19041.1202_none_2ab7fa65fae268e6\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..ork-setup.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c1a630e9b03c73e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..ileserver.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_81c1aa0cd067ecf1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-96_altform-lightunplated.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\403-2.htm	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..verydrive.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3aace4b3d3fce1ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-twinapi_31bf3856ad364e35_10.0.19041.264_none_993ed006c57fc816\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_netfx4-aspnet_state_perf_h_b03f5f7f11d50a3a_4.0.15805.0_none_c4b0fb6e234fa51f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_de-de_7c55a85dce912c86\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.1202_none_dad675f788694b0e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.19041.1_none_597912734561c5f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..do-backcompat-tlb28_31bf3856ad364e35_10.0.19041.1_none_ab066468c614eefc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.19041.1_none_8a11dbe22c9bf6e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\square150x150logo.scale-400_contrast-black.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\msil_microsoft.web.manag..netclient.resources_31bf3856ad364e35_10.0.19041.1_it-it_7d0b8a910db5f574\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..ctionflow.resources_31bf3856ad364e35_10.0.19041.1_es-es_d33f4dc389e9456e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-aero.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_92ba62f3ec5ae25c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\BlockSite.htm	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mfmp4srcsnk_31bf3856ad364e35_10.0.19041.207_none_e4d578480cc35f5f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square71x71Logo.contrast-black_scale-125.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-local_31bf3856ad364e35_10.0.19041.1202_none_7dd671148082fed0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_hyperv-virtio_31bf3856ad364e35_10.0.19041.928_none_353d3d5427d43fb8\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..erver-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_29428b873452cb12\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-portabledevices-winrt_31bf3856ad364e35_10.0.19041.746_none_a2de9eddb7b517d7\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_43fe9f4e368e081f\24.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.153_none_580ef30a6bb05e53\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\i_clearOnNavigate.png	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..-brightnessoverride_31bf3856ad364e35_10.0.19041.746_none_6efacde02c8ff6d7\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000408_31bf3856ad364e35_10.0.19041.1_none_a04de41101965fb6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..sionagent.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3eacb1b41305eb5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-networkprofile_31bf3856ad364e35_10.0.19041.117_none_610aab23093ca52f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_es-es_a838a172670dc226\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_ialpss2i_gpio2_skl.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_36a0a55ab053aaa9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\msil_microsoft.web.manag..ftpclient.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_e02f8b2d2fc6f3d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\msil_system.printing.resources_31bf3856ad364e35_10.0.19041.1_it-it_77d2dcfcf086bca7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.19041.1_none_1b575ad951209106\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_bcmwdidhdpcie.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_6ebfdcd3741d9146\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dui70.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_ba3b9e31f5de5c7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..ation-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_9abc0d75ded24b94\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-o..e-plugins.resources_31bf3856ad364e35_10.0.19041.1_es-es_a6275b3c2e6092f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux.resources_31bf3856ad364e35_10.0.19041.1_es-es_9bf702b0c10fd8cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-eapteap_31bf3856ad364e35_10.0.19041.1081_none_a0e60ada431c2fad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-taskscheduler-client_31bf3856ad364e35_10.0.19041.1266_none_b8c01b9a538137b9\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\msil_uiautomationclients..providers.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ea518b275fb89dc5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\wow64_microsoft.packagema..agesource.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_428e7816fa93fc61\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ntication.resources_31bf3856ad364e35_10.0.19041.1_en-us_5963c7d706b09d96\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..do-backcompat-tlb20_31bf3856ad364e35_10.0.19041.1_none_ab5ce3c8c5d40f74\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wmpnssui.resources_31bf3856ad364e35_10.0.19041.1_es-es_fcfa0fa694159fac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.19041.906_fr-fr_6b9d8f66c195c032\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_msgpiowin32.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c09f50f80cddc86f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mfmkvsrcsnk_31bf3856ad364e35_10.0.19041.207_none_2f6aab86254052e1\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\500-13.htm	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.19041.746_none_e180169f2d62e633\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus.systemcopy_31bf3856ad364e35_10.0.19041.1288_none_5ba23d0eab3d4017\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-k..container.resources_31bf3856ad364e35_10.0.19041.1_es-es_6ade114ad4be602e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\shell\open	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "RQTLJTILBAITMBS"	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\DefaultIcon	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F1LgVty9W3N01xA.exe,0"	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F1LgVty9W3N01xA.exe"	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\ = "CRYPTED!"	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\shell\open\command	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\shell	66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe

C:\Users\Admin\AppData\Local\Temp\66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe
"C:\Users\Admin\AppData\Local\Temp\66d9d7b6ca08171b1f5abf90db9108a8d37e8c219f88d5184f0fa08868a69f62N.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aic_file_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Size 50KB
SHA256 48d682a30eb4eb2abf9cdfa45bddd4c680a28b434292d96c6d544a319550c7cb
MD5 ddb5ef0c7c647f02e67a01a294800ea6
SHA1 99be01698335112bc018a6ad10014284e9a56dff
SHA512 6c10a05f02e5ef9bd8b816e568e6fe021272e943738440977752572fe97589bec0ad16fb2a5cd31f8d68560eece14513a1a8888a4fe5b4776cc9204f61b5aeb4
SSDEEP 768:X0EtkIKTBH9O1ony2vuFavyyCGI0NyffTsgscpCTUJ35NFUGz+TvE8m8F/obCeG:DklTBHUonlv+aqaoTbs3QFfLcF/orG
MD5 SHA1 SHA512 SSDEEP

Submit Download

selection-actions.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Size 1KB
SHA256 a9dd4ee472e46faca24c0473f43c0813116200574e64146a37fde22a9d8749a2
MD5 7cc945264a83bc33bd0bc3856f20dea9
SHA1 28b017fbe2324a6571e9a16ec777dfe7996ea155
SHA512 5c63b6e3517442d25b6a164285d2210fdb628dc5d0180bbd7a7d54ba9c5a29b957ea3291fedeccb38f2578fff2f87d5cc4c7deecc3772f913593b0e60802c3db
MD5 SHA1 SHA512

Submit Download

selection-actions2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Size 3KB
SHA256 9dbe3b031309ab506aef88f958ae1f79a95c62ffe719713a32aed6ef492ab812
MD5 58895dc83d6ed9891288c09eea660fd8
SHA1 663d5e4eb52bd0ae23b33279cc20b54f9700d259
SHA512 b4dfff8c81ea6fad717121648fd2e676dfc1e58a6aba52377602252b7e14569fc44f4f662b7b3805d8cc36d2ad691030130de723aa71baacb5c1ed786372aea4
MD5 SHA1 SHA512

Submit Download

example_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Size 683B
SHA256 9f0cd4f02b0e587f43c4355b14316151d25a266dcabc7489d42eccb429d55fd1
MD5 cf0348c996f130a8ffbbd7094eb08691
SHA1 7d6b8b1a97e758311f9a4b488027d716d2c5a0bf
SHA512 90f7234bf73e1acf8929def052e1e556f6f0df4daf200b5468841dff4f543e22c63ad7b512801606efee66d42b1fda38a37ad15d6d5c548315f0c37469195acd
MD5 SHA1 SHA512

Submit Download

example_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Size 1KB
SHA256 17f842096a16d8e9e7e57e4a9f6fb1b321130a09f759440c08fdab4a6dacd9f2
MD5 db1829ed088fc537c04a6fc3742f1001
SHA1 b526becc049f6dfb61aaeeaa66557cbae6673e89
SHA512 fe2032e2f1bd54abb19fae8dc3b0b1cdeac67de8559a46b477445e8a0dbb7b229f534c9742d4315dc64f8a8895363d66d35378a1716e83a9cf0dee68d28a1a00
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Size 445B
SHA256 2daa1334242913d43a94056844661999ad8e5c5461ca664ef70ae6d200474ef6
MD5 2af1edb4c3c560ed987879ca506b2c2e
SHA1 e7975f3fecc9c309de94185dd6f52ab208ad10fc
SHA512 80396e00e7c2a0fee78de17f4ca604308cbf0140556ba2e74af55e2e8b4e721d88d56bfa5c1df5b2b9729ea8ececdea0c6bde16d7b80e101db781f9d5f3fc19c
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Size 611B
SHA256 2792c12f53eba1e1a89d38a2209c8d7f27fe1f3b2b87a39e3919edb1f0b83113
MD5 85b9477060c7f0330fd03df58b982ab2
SHA1 89c0f6beadbe8ae2c1f23f6f6997eff6d23767ff
SHA512 ab98518653dcb5ca8053f1829cec595f705e9790d89ca43fa476808a77b04854ac6ddf8d92f3c1824832da6944a34061386f8144e54490d5301d1cc29aed9071
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Size 388B
SHA256 565740374070f0850be2b7e7f51e7ddebf1b4e9d34109bdb1591520e4f872ce3
MD5 f0d19f9ad0f42f0852de499f1d393be3
SHA1 352e955d60e64d17538c01317e9754bab5f9564f
SHA512 132ac1664bb763b19c3ba2853496f6e934ba0551f4c25aa3c56450d0518d7362785cf4674e7244fe11630a0598542d7fef2ffea98ddbbeca4780f872c54f5d91
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Size 552B
SHA256 30946a641f16f2a0bf333b6111a87b0033734ba839144ec4267f68ea74cee846
MD5 1c610dd7c495f0ba38394b2e4a0ac008
SHA1 43152ff0107fcc479bdc4f7ac6337cafe0203b12
SHA512 f4c545e36af19cfd12eb7a9ccd6948ee4fb1b3389cf23748b0a7d10e7115f2e5422514112fdb88b923f00de048acb5d71068a1d4a6ec1909d9604e8da74efa49
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Size 388B
SHA256 01a0a31a8f739b62d058a92dbadadd2a65262bb83629f64eab766cebf1fb0d95
MD5 a5d84e2154520dd1dabf9ec4cc5f4929
SHA1 32092261e57cdad3551b28038eccc01cecc9893b
SHA512 13dc772586b4dd655ee394be6414e216883d044fc33414870bf181e02033593afb00206a3696d4bce5c753ae1ad8027b0310fa6899911f423b11a5693a41550a
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Size 552B
SHA256 77a55e29f3010dffe41e0dc576fd05ee83ef84f102d1b3b79a0becaaa51606cb
MD5 f91720eb91323966f1b93c3d48fa92fb
SHA1 924d0ff0ceb9af52891c306a3873dd9d030e3bec
SHA512 774c97c40de9bb96a5a4be4f278eca2ac132f3fc3a1fa255f0c821a4c45c4fff13739adb9e3a4499e03e2fdaceb08a16e5be71cb4d1db07cb15c76c45728562e
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Size 388B
SHA256 93fbba66ca81ca135548e92bfe13b4ffccc264ad52549ee891eaf9d954412abd
MD5 8567f0de7dc2d3355bbcb5fe046faf00
SHA1 d0bf91868147d7da75dbac8f43be4e950718f9f6
SHA512 e1a950b094a88d90247e8a1e4ed6b87af3750ce373350c7b4141413f4a9832b8ebb79c9540e231132f44a6d98ccc505901f8631aee0d52417cdfcbc4bdd4293a
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Size 552B
SHA256 07520cb758021e42b2dbbcdb044cf19c682e1775eb0772f373a07761e7717681
MD5 8177ea7bcc0a5c21f91e757d737ac2e5
SHA1 470039622b4fd612076e340e88ba70b4e0648819
SHA512 c900808fd9862dbf141e81e2991e581a1ac3990b9dee33878ec86539e8cccfcd0254993e1e4a83a09a7ddb042210e9e090fc92c39e0bf5bdcba9ce0edd15d2ab
MD5 SHA1 SHA512

Submit Download

icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Size 7KB
SHA256 e99b5ad8f28d0a9ff03c190ce1d56030a0410dd35ae89a84e97e112659c2d066
MD5 14483eadd12eab62d73abda8850f9789
SHA1 fab65332cd110c1166de4376c9d18b152e4dcad6
SHA512 cc09109620b4ef053e19f64614e81a17f1984cde12b574604e92381b0e2fa8ef97601b4aa704b0a373912575f4aaea6ad63409a7a5a916c241b97ff4fbf4ee2c
SSDEEP 192:DOAVt7eBwA22XNGcZJa4u7ZevpgwiUvhZeIxhSIrhjSa+gEZE:yAreBw7iNLZJiZevpg1UpZeIGz2EZE
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_ie8.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Size 7KB
SHA256 caf489eb52b80188594718ab78934e0ba8d0e5f23d9dd079e88bf2da3353a1b2
MD5 5eca98f4b70befb0cd9bc7c2fc159473
SHA1 c3218889622eb4e95ebc5c2059a55e00ffef0707
SHA512 31ad31ea40e629b87859f1d33e234dc6cd3a97ba03570e640ea5891810dea247b9df55e72614c94a7c26c192aaf381ec43385f81bf12dd83d8763e188a2b42cc
SSDEEP 192:IS2/R0rITtqZKBG584kDFhE0rxLuGwHT/5O6Tfo+wptQ:z8R8IBqZKU584kD7bxLuGcPfoZQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Size 15KB
SHA256 89c7453de99480e82bda6308c5a8493dc390f30416cc03e9ef231f551195a38f
MD5 5ce9b7046eb2d668461a470dc79f14b2
SHA1 571f1f3ede4492e8761db0fb4790e6a6ac7677bf
SHA512 3c1128f96ee3658f0bda26342096dbbc0bc303071b8a0a2cae4d575fbe8cb5b17e0485f54e1b3eb072f42553d09d6d7c66da5352ac704a6e6d0dbb2364fff4f1
SSDEEP 384:DVKPWB38A99IVGbm1NRW1xNP2E8XHb5Uzx0eH:DVKPg38ALI4bm1zW1xSizxL
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Size 8KB
SHA256 dd546f0ae498ae524ed41a83f749a5bc3731f447fe73e7a9b2988ab67ee56f8b
MD5 987ba581fc2f888b313c7b84be4c9d71
SHA1 8401f8a8749621dfdee7a25410cbf743e5c25e28
SHA512 ada47b45f39f9c5f063c229b0152e68631cddd611f7ba8d50bca3a70c9c2b16655584a1b2c1ee9758b3274a5864d6b934c7d57d8ebf2f7fc781c92ab78c6a4cc
SSDEEP 192:sfk+9HLX6EJ9Qn5CPnrUaXcQAQk0C32usMJDXdpqC8Le:G9rXJQ5CDUz2upJD/j8Le
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Size 17KB
SHA256 904a07800f16aed85d43cd65168bd12e3e02e83e65efd89dd8cc0d182f5d1ec7
MD5 0d2d0bb9b7a7f089af615f823169efb7
SHA1 92cfd11b0ab9b2a78ab1a45ddfe358c4c6c9dc2f
SHA512 58db6f853e540c05920675f3495f614b7ebd1e6da1b3dd93d322185c4c695e195a854a5d7253c889114dc089dc84398bfcc6293c1f942796ae6656a64dc29939
SSDEEP 384:yYrUOC3U/Ju/8Zn1h6LB8cdGdekUrBa7wVAeHRJaKSP:fULE/A/8Zn1cFpjkUrn3zaKy
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_pattern_RHP.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Size 179B
SHA256 82299e9dc2b2c43c53bc3d20236cb5078b4d476c9c777e95f039165e63e1cd11
MD5 81791d025e9ca09128392da81acad0a9
SHA1 4d2d941923abbcc17ac16e91af67e28f01005520
SHA512 2ed1ab259a88d1b5cafd735dbe88251700ac2a0abd067025a4e42296740b834906a66253fbd7fde1c8402299a3b352b57ccbc9b4b1fc3ac7f75a7c5256ef2e08
MD5 SHA1 SHA512

Submit Download

bg_patterns_header.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Size 703B
SHA256 041c2797cc56b6c7ea38f82a4687c68820e83c519cb650761c9e4af581fff6ad
MD5 0b9072cc376d450feaf54b3a1ae4a475
SHA1 be9497516e9974d033056ae4829eac1141dbb38f
SHA512 eca797c5fc96dbd5199f8413014c630404f3d5e21cfa90ba9c01c7bb998681c06b1339194978f86423b422f065b5c4a0abdeef545ee773f44e7d0dae7b3dbefa
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Size 8KB
SHA256 c5085e4d5a64b8e8be4cade7b3a848b2e31498de6b2a97ca470a67fe1ed6f171
MD5 bde868ff5f158463466c7afbf364597e
SHA1 31161e706f120c2ff605608a33d8ede19f99f6ee
SHA512 3fb08350c0f14a89d670c8c4eb038209c7f54e719ef1ee334dc023e94522b4f0d9b99dacc5c67bf7de292ab240a5b6738052a5f183d06c48e68dd3abd75c7a9d
SSDEEP 192:Tek1mWYo2fFDSqHz0i797CfOVjLfrtsBonochuRlBF+L4:6k1IfFD7HLEmVjvfno3RlBFa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Size 19KB
SHA256 d8eef3ff8ef8b9afc5ac0fc01ff0457489e5674c6da31d9aaf46dedab54461ce
MD5 317e5b92553e4200e175817487ee8ce4
SHA1 ecf47ce1dcc8f73111a4896fde3526fcea4bb005
SHA512 c0b80aa85632d8ba0ba2074a6b45d688e68fee8069badbdf8cb6f6272f10db398bb79a24ec451653991a567205c52c77b9a0960c4b11802df3f3b260765402b4
SSDEEP 384:7wZyH+XvzjA7ElvRmnd75dcSgBsp8rS5pB2eKgyQS5FY5h6jf4t74LSauaLMt6:/H+XvPEnd75U7S7yQ+FYb6jwtpauaLMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

faf_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Size 6KB
SHA256 c4595fe22c0f53d8923854545eae8dad10e1ef5dc36f0d871e221d6e1d190477
MD5 e29c16cc5be07dd700a04acd8fb9f3ed
SHA1 24acd3abe3dbd41157286114f36f6db621e84d80
SHA512 0a256aa1afcb75067bbc2a109dd7192eb3c52f2eeb71e31938db3c76a19e79776eb7f675316951fcfad3016bdbcaa9ddccfa7a020caca41b130432f07cafa644
SSDEEP 192:6kNADDO/eKF1JuMmDnZ22CDDDDDD2KvqVLjaS5ElDDDDDDF/bQZypk/EDDv:6kNADD5KF1QManZeDDDDDD2cQG/lDDD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

bun.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Size 2KB
SHA256 eefc0cb70fa30f8cce85ed5f63e146a89ac3e431a3a419396ba14f0028d4f62d
MD5 34b8736ebbd9825b8c6220db7b395e4c
SHA1 380111da7301ece2627f71a22aacadea7f95a656
SHA512 09b7b51522b54e03940cb51bd401157c6a008cd9106c7878cbf86c17005d2f0078c3113a71b2fe02823c21ad394463c529e157cb9665242040c7b4c34becda4e
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Size 2KB
SHA256 5ee7097861f85791f6e87d806073d1e57e65998fe55ebcc414ff7fec2791e305
MD5 4b8f14953f3630a9d0e75c7eba6813b8
SHA1 2dc07dbf8614b12c4fb46f3a76b4c8a6ed9cee49
SHA512 5fdb9dbaad43e4d8e511375c51d2e7e5751f3170f7217ac82ae42e8f123f26041e0931128709ebe4a1bf4c43546017c0c260d59d1bb7eb075f7220c363169c04
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Size 4KB
SHA256 54cd5bf0ba0363bfa839251147f1d5385fcd2d943d332a8008f3c099cbd21e59
MD5 6c0c7dd1a7ed7daaf310da4e6c93ba29
SHA1 88535f0db65bd7729ed359f493f23b4dd165a7f8
SHA512 e18144636c3bda383e20c71817ec222430cfe6642833698e0ac63828e3c52214733d91a61cf6e6e8f0d837ab30a6f68a368c35b39658a06a4c6d5d16a729bbb5
SSDEEP 96:Ku405xW0B4fZ1mvffikOROfUQ26e1xX/fHiddUtMLWysBEu4LUPTozCfj/ArGVUq:KFWPBImH6bQUQgPiOvymM+jYWH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_arrow_small.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Size 289B
SHA256 7d8fff95f7d42d6793824cec26787b7bf3d6c728ad55c297a2a0feab81b83654
MD5 608bda6c30c2cd990cfd2f16fde0192b
SHA1 8d9fd229f45be651fae084a55bc02b8c8cfea072
SHA512 c984777f2b653029446efd7c66d2f5f84a301ff2ef1038f3c0199c06a2cca0d0db0373c835474bf4a36e0f7a786433c7e1c98fd062460d20af031cfd03c8cce2
MD5 SHA1 SHA512

Submit Download

dd_arrow_small2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Size 385B
SHA256 d96df40e1a9c8fc676e4f5251f6f5ce3290035e088d5acf4a8b8770ad8916f05
MD5 c7adf8e2ec1fad0e46add952d229d20f
SHA1 c6314a8e0ac00164b1a23176261ce47e6f50f63d
SHA512 5c3e6e10e3c3c725a79889f6a7f238f585ffc89dc9488206c21d41d20e1bb6d0adc61cb7c644cd2b3ac1004cd57d2adbd835442d332edcb3614dc80dfe7ae66a
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Size 4KB
SHA256 e5a64426c3545c8ae3c51031978ad2d4d11be7043d9cc4f9f8fedae507f98b13
MD5 849e9e12ab6664592461383bd183437a
SHA1 a1b652a78cb7d8b9a071e3ccd6e4ebdd614e4438
SHA512 306da4b2b43b1da4627a20ade9c14568270b16625b04da4f9243771c60ab3c3f51d5487860c2e5d533e9e6f33307bb2808cf0340ffeaf43d84a2207faf977673
SSDEEP 96:frHNTkFKtj/OmWb3FfLhQ3Jj/UG5+u3fcweGKjLhwv:THhjsbVfLhUjMafcJjF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

nub.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Size 1003B
SHA256 a6b4f8cb17ed830e2a7a944f3de4dbbea35f2a5d7e4f9f36e0294f743d3660bf
MD5 9e42b563e64cc2d3d4d0c923ae527df3
SHA1 0a8ddbf1d361d5a3466d8af35847b4c2f04ea49f
SHA512 3efea50338d89b7fe661a2e7007f86d7c3b4800e149a244aeca17829d38d770ab0a42edd5fdb29719a79e669ce9cb17dcd664303329791e2f618bc5f4371491a
MD5 SHA1 SHA512

Submit Download

share_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Size 1KB
SHA256 5711d765175a8896bc254f4632115001fb63582b8af31d3868ac646bbef48aee
MD5 38d11fe090af45ad1bbbfddea85764ce
SHA1 fa6bee68384241222701c035ced6e2c805759e45
SHA512 d2b7e9016bca80215801bbbc24d4949eac92217397a24c15cb05f0ef96e35327de016d6d505feb4a72439aee8a2a02911aa3c4b6e2105d565a373d042d90cad4
MD5 SHA1 SHA512

Submit Download

share_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Size 2KB
SHA256 a4bab1f64cbdb4b32bb2191aeb3a9fd69a234fbb134f5f18bf0aa0b85195744e
MD5 de3e331a7a786f5746d71744f3025412
SHA1 a1f59193fb0077417b4d1498313f57f55a601a8f
SHA512 0aae59fe29a768e539329eec50aadd19d318560e7ac1267bb7b28fe9842e21db30bcfa0933ce60727deb11d60c702a03e7852896727445d5670e58f9fe987859
MD5 SHA1 SHA512

Submit Download

adc_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Size 3KB
SHA256 3402523df72ac0d2ca3f6f42ca09544415c232f413a59132e54a796ce17357cc
MD5 ee43aa5aff8da85881871fd4f682fc9c
SHA1 dada059492e1f5ffb31704ba6c86198af7e0c90f
SHA512 80ee61c190cc1bdf9dc733c39ab9f3e283a229996d280a8d2528fcd2779bc85e6f5aeba5f0fb84b6f08ba8c685067262ce9d3ab5619075483ec70b3273a79caa
MD5 SHA1 SHA512

Submit Download

adobe_spinner.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Size 556B
SHA256 3c309d428ae509132ff2edb3bb5ba66b9b94e73376606df577ecbf0c5d6fa742
MD5 d1476f23d2378f5ff04161d18d390972
SHA1 d2c6aa1e659542c52fbe208eff8fdf68c905603a
SHA512 a622271ff17d27082fea0b22c6184264ddbc3ea4ba208906195864d6d202fd0c44d7a7702e27c0196814231f9da745d6159c544bcf92b6486d56af714ba91f38
MD5 SHA1 SHA512

Submit Download

logo_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Size 6KB
SHA256 34059b32e73700fb18a6e290515e6fca4db434d903a7ea0a0abc28a0f453af9a
MD5 e8b678b6a91963e2d89a7ce87bb13074
SHA1 edb582920fa9e42a53c2eeaa6a53dbe837d16a07
SHA512 63c33ee1d3b7abf1c9c190a9bda54991f005d3ba98679d602212bebc521fcc4883089c8aca685c34777f301d0d96ab3a489d9cafc3e311b4fbabb976d2ce23b3
SSDEEP 96:lwYMkANyIfizOAs9MlxN953zKmlw6PEo9xEXax1i2oVQa2t+O2QP8eOJc1Gp1fX9:lwhkANNG5HF66LI2/2d7JcoplX9
MD5 SHA1 SHA512 SSDEEP

Submit Download

sat_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Size 826B
SHA256 c44b3ef68ef26a956199c8016f3d6357c379436a8ccf0100ad9797c6ae9ae873
MD5 25e27747adb1cbe8eede05739a2534e4
SHA1 c7a979737675f2511dc211937072f7de0baf41af
SHA512 0d24d79da6c7a91d22cb91e361df984a2fbafa9c3b9e318d9b195d29edadbc32df04d6581b90bf96c772df7d74b7df59cd0150b5e8f9348427b02685cc33418d
MD5 SHA1 SHA512

Submit Download

sat_logo_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Size 1KB
SHA256 af025edb4a67b4965fd416db5393f618ba5c55e38ebf9a107e964e12a7eec0cf
MD5 4e8f5852c6a8a481b36d17c48aa55224
SHA1 516c5122da5093fa3eada89acb1c445a74a6e050
SHA512 198c6ab8c8968abd3f090eb071babf48a8f2047edf7326193d060c3baab2d3b19c9d07f907cbb8a19420594adee363b5445d1b88993d7a57f8b952457505f2c5
MD5 SHA1 SHA512

Submit Download

DisplayLanguageNames.en_GB.txt.EnCiPhErEd

Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt.EnCiPhErEd
Size 32KB
SHA256 c1eb157b6305fe7e3265bca61e28234d8167da5cb9aac2dd6185dda720ba62fa
MD5 7c0aa0b15865e2e4ece181382438c407
SHA1 b744f79525874d2286ceb202f06d9184d12f3199
SHA512 310d49679b71af02d63b17a355e6480f0815543097de63ad03a06bb1ac0a42af53651a4ab7bd939f480cf8286a2175bf0443a56990710997d324b8ddf891edd3
SSDEEP 384:plVbZPsrP9dl9PTRLXGSyp+C/UnvaQ5xqPl6cbhkkiMIdPKp02gMLsdQWpjUcZP+:pZkrNvGNQaoNAxqJlYOd2ZfpiyoskLHC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Path C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt
Size 285B
SHA256 e950e0befb030c6adf6964abf1f3eb60ca7f133292392cb1f4b1de8eebb44786
MD5 a7a0e123294b9ac4a46d54bc73505430
SHA1 18ad826c381ed09c78662a651be6f5152c7951d9
SHA512 d4959701c26086cbd32b1a3f1d38622325dee4b9393d0ddeb2fb77eae402ce0f965a73c24ae344cd3b37a720dabc066e23fdb8ff5368cab59265bc6363cadea8
MD5 SHA1 SHA512

Submit Download

win32_MoveNoDrop32x32.gif

Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
Size 153B
SHA256 888051d99d198779a9cb19ecf4534fe2d7de8dce1e35e7ed7c4ab253314fffca
MD5 6132d8a462a751f83a15e2d5409d707d
SHA1 016484ae958fc9be1a0dd139b9086ba375eab217
SHA512 a3bcfc6e5975a5054d367b0418d788aef5f2e8fdadf32ed51153cea5bb225729d69a710e74629ab6d4dadf98f03487e48e7b7ca3a87c55aa7f1279fa525566c4
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 190B
SHA256 8987db3a9b78d14f946ae5cbe1ef004cd730023e7d7c3bd30745d6304d5b9f8f
MD5 d0faa7d4552a1a391f047fbe243dbdc5
SHA1 c643bb370f8bf2cc566cbf19237b45a1dd5e6e15
SHA512 a0fdaa28c95628f560962fc54ec7fd1fce0a7d2145b5dd97322b2b49336705aefcda0233adcfb72cefde7276ed97c67d4bd44ec8b079075a3692f22a9d0accf0
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 190B
SHA256 392fd1f058bd9afe450325a46a4bfcbddc1ae795997e54362935ff7b019b53f6
MD5 83375fb75517afbd53a3f8563afaa6ba
SHA1 c759ed4bf90e2aae9877d8ba5b064df737e6e7c1
SHA512 ace4725ae618484b73aa6a6b0e25b77e8ddea686facd496742cdf41f4516fdfb2ed336ce96c2c964a7f6ccdd3d7766063adb8b2c5de409ea946c92a38b7cdacf
MD5 SHA1 SHA512

Submit Download

directshow.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
Size 1KB
SHA256 9d300b33e879d8c6dceba39b8818a84e1122f485270ae11a0874f000d9b5fefd
MD5 458e8a0df2f0cdcfd7305966f25c0db4
SHA1 9d1e28983d329c0c973bc00b6b5fba906e788d2f
SHA512 bcd0c1c7abe291c4f141e4ffe6bbe59a55eb5073d8f352ccdf2196f6e0b9a1d877d43d7fe1992e6d90e37d0fbc6d1306041a643d0cab96c02683fb8241da4300
MD5 SHA1 SHA512

Submit Download

glib.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
Size 31KB
SHA256 2c2a3a045fb4c306ea4a91993c8f0d4a086634ac5513f7a2986f89374e217221
MD5 02e11df37d899d29a2ae585474604f0f
SHA1 0410fa913120a886cff1e37787c1ac13e677481c
SHA512 a9a2ce4139717d32feb4c92d64441c438f2c80ec3e74148d8144ba22b874821ff2528589952266eaacffc693d150a6ae8d1e0f5bc057e13feb9e0a50409b51f1
SSDEEP 768:lMtNFlK2Ay+2cfsXb6z0gDnPdmJaVfsUadZJZalBFWd7r5NNhHSxgnY:Kp+/sXbU5nP1XadZJZOBkN1dHSxgY
MD5 SHA1 SHA512 SSDEEP

Submit Download

gstreamer.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
Size 34KB
SHA256 644d88e8318fe71c582eab888fc7f66179f34815d7e8db30645abd3d6388e445
MD5 39757b418fb2a4ba739fe36dcc0d32ba
SHA1 9009532138bb52360e6b7d16ded196f0f0a393ff
SHA512 00bb1d3360fb675849add5b3886346e856c02dce5e326acb3398c6356046c45acab6f9fabace214b2d6a90e5c476910e26cfb85182aaf2cbc9f728075f07669d
SSDEEP 768:jnnLCrD9avC2Ay+2cfsXb6z0gDnPdmJaVfsUadZJZalBFWd7r5NNhsPF:/CrD9avr+/sXbU5nP1XadZJZOBkN1doF
MD5 SHA1 SHA512 SSDEEP

Submit Download

icu_web.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
Size 23KB
SHA256 990ad6cd2c8a21752356202d65be7f474e7363057e20edaeba239b459044b9b5
MD5 595716665bdcd93735439ddb9a7bd12e
SHA1 108631f019a9af5c61d5ab76afa48e1eb6b6c6e5
SHA512 83e1ef7900bfd2bb4471cff68bad111fc4679e62eec84c65266712c9d27cd76ea9892ccdefc6d436eeb228df8c1909c24ef16899c7197ed0cadc7125522cd179
SSDEEP 384:IQkPi1nBxhi3SvNrdAFvRdBdEmR3B9ITcx2PXt71Q5Tup/RhiQO+YU7xwlr73xIU:vkPiqSvRd4RfTD9IAwV0Tup/viQ9ttUT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpeg_fx.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
Size 2KB
SHA256 768371a1b5b89877621718d3712377f0349fcf81fbc88c69648c449b3a04c237
MD5 40b75ee45dbd60fcfed7241bf653afab
SHA1 f7ce67ed4b4ddcd7c83d26a3219cf974aba78037
SHA512 0283e65819d59b7c24021f1a5fa212efdb8d1c4ad9a9a547be4f4429819016a25ed5633abccc147653cd84a86291d21416d1767eb96954ace16654618f2d81d7
MD5 SHA1 SHA512

Submit Download

libffi.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
Size 1KB
SHA256 bbf2b6359827304fdc1b3ef37fd6cba28ea611d21c7c541e2a43860eb343be1b
MD5 30140d82844f18999e7d8efdbb550f24
SHA1 527d02e8e68c165464068b1b754364bb1411dc61
SHA512 387c88a82c1442fdf5aad71b2fdd8c811328a0823d35cdb2ac4a993a493cd70e6c04f5e73b72235898fe9760267b0046037d0824eb4382c7e8a5b07c3b476fc3
MD5 SHA1 SHA512

Submit Download

libxml2.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
Size 3KB
SHA256 a63f858e869ee84625b64a47b480abd36f23b33612cde565969eff1f211ece63
MD5 ab1549890647b2bba3270ab42e8d7d62
SHA1 1b5f6df040c11b525096a52e0731ebab9228c23a
SHA512 d34d9a52ff257e5215ac51396e460742125a9135c7edc7f83fe0eab1412a8fcdec19c0136b8ce7c0ff5adff00699f71094e44e3aef92cfa61d95df0f259fdf1e
MD5 SHA1 SHA512

Submit Download

libxslt.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
Size 2KB
SHA256 242f5862bc2c20c41f6893e4c90952fb9d528b60804725d139f8413896034be9
MD5 ca821bc77aacbdf89ce5f3915a4133ae
SHA1 4708748063588c8d609e95a639ac64c7fbe5851f
SHA512 cb8261dfc95745d0f7f290a15554a19fe32a895e86d6190dce419b22801820d351f5328b0b3503dc4dd4127cb4d862ad00c9ef72f30a6508763d6281f0008722
MD5 SHA1 SHA512

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
Size 5KB
SHA256 5fc105cc8240ac0a9595293f6015d7a6c9e2942ebf537dd6b424b372593de935
MD5 941329bd6a491ca6910d17854e4719f6
SHA1 2a0543e22914bf007c05c8e8cad537972d4efc1f
SHA512 35d4eac19e34738b20476a2a5dc20512b1b42f884987800ac9ab885fcf0546699925bea01f0fab12a719571e46f8b7c3e42f8446842e1c341c2635ae3fd363f8
SSDEEP 96:JM3xJpBeLrBwwAAB0kKwTSblcPmSzUH9Sk2IPebZ1wxSrfzZC1qb8gAuhHPjeeHW:a3NAHBVvB0kKwT6YUUk2IPzqdaK8gPP2
MD5 SHA1 SHA512 SSDEEP

Submit Download

public_suffix.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
Size 17KB
SHA256 f0b90a848e56323d018675979d6a5fe39bad276f515fc6706838cb919c78c18a
MD5 1a16e20aab0dcb36830b613252de925d
SHA1 fdf2431889ba42656c3b7c945036b1e62bdca72f
SHA512 68175f836ef0f7f841e27dac52467ee28449d75110b13ce9aefe0dfced2eed704560a8ed5f0c0e225d77ab237d4f6fae96ee851c78e89f2dfb711cc79bfbdd86
SSDEEP 384:gjwKMSK6JeFfWmtbHgn5n/OFnXnxJGMRZZZZZZZ+zZZZZZZZNZZZZZZZ5e4ZZZZw:gjwR6sTtbHgnpEXnxcmZZZZZZZ+zZZZk
MD5 SHA1 SHA512 SSDEEP

Submit Download

webkit.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
Size 320KB
SHA256 c252841d0b62ba8303f1fa818a434ee11518b6d4b49b33f44cdb6fb5eeb67b65
MD5 b8957c9df793fcf2e4c39e0eba8d56fe
SHA1 2144c82603be580f8a71ac4fcd324a20ec3a52d3
SHA512 010fbc7822c295daf4b411a70bfe38a55ad12ef15171abd90e58e979931c1fc623d90b410f3f086b4e05d1c8c4573f076f88b85776174a18120f6db3e1fdcd6e
SSDEEP 6144:kYjL3HxpIkBUQjZD+lrxHJX4BtqeL3DAn4UXf2FCAjgqWkYKlJv1NcaWHO1HwbGq:1L3HxpIkBUQjZD+nHJX4BtqeL3DAn4Uz
MD5 SHA1 SHA512 SSDEEP

Submit Download

asm.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
Size 1KB
SHA256 cc05a4d0ec2c6c1fa1d82272af7e4351c4f07ef7f9b4f89272228dd27dc9719a
MD5 47a7a14399d0fa1e826e1423da2ee60d
SHA1 1c9f950be4b68fd1db1c2e6b3f6e1c12c54ba32e
SHA512 e1b225ca7daac26cbccdad75c8056dd06465e731c789aa119e56a068b1a58904311ca12036352866b586d7c496865b90cbe4e649dc2ca4a174332f7e1afdb3cd
MD5 SHA1 SHA512

Submit Download

bcel.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
Size 10KB
SHA256 a523a8e50a4d15a6326ceeafb23d401d723cae0d7337814abc1fc988355bfd09
MD5 f0c66a425885563f8a1c92a9627b5250
SHA1 b27a5a528c4044d6c1042651b557e82d8441b678
SHA512 105ecc088493ceff61f43d9098709bcccb706b931225b3662e96481a495e01fefc3611e09c6fba7d554cc81d943fcde0bb8b7af1140ed161593c6d23c98a4954
SSDEEP 192:Ubmk/k08knhG75FYpurIu9iBAOK4ou+NYiNXjAnKoNY2AhnGHkZdxldjQ:1k/0khG9F8LGakzqGXjPoNY2M/PQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cldr.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
Size 3KB
SHA256 5e439609ec91f2e92e08678b9885168ecc16b2f9fafcdc89abea39cb6956edf8
MD5 259745db2b6b79949f343992dc25de57
SHA1 4ebdbf3d771a4a9b59ad4f8ed6ffaf38c6b12413
SHA512 716fafc7a796f2bce655984c5e90ff6bf8d2d3630224675c8387d95db98d8879eec36b0c09aaf093486767f71a0394b345db355ac86e9ff24081d86af3b9a6aa
MD5 SHA1 SHA512

Submit Download

colorimaging.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
Size 162B
SHA256 4ef6b9cde0a43b024825244d99a6f139365685a819a99d008fca8ca97ff32f91
MD5 9ec9ce9d34311315d5b81444f88732dc
SHA1 01244cf15183960927e8f9c47f4e6d1398e34a49
SHA512 cfe9340d46267a1678171defe3509ec2cad1407a80faa9fdaee796320db949e7a0668f322a40284a20696945195852f7339b7ad1aa3a35a6384cfa330835d3f0
MD5 SHA1 SHA512

Submit Download

cryptix.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
Size 1KB
SHA256 68535f91e4cb15b389ab812e6064f3a277cff7e918895c5faee3932bd737ce72
MD5 7e33f0408d28ff7ef7afcf98b0aab3cc
SHA1 007299f2c9ed35972408b11007175be8f3812bb6
SHA512 ff46de722cc1a15c3e3aa5f704ff68b6c63c1a12f9c09801130f52d23ee7af2d35930b61f73a0330446d197327dc64006a6035388e12e6586c04b274892f13f3
MD5 SHA1 SHA512

Submit Download

dom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
Size 3KB
SHA256 18e6f72bd377daeb34d0e02c68189be1a4e227d3ebfa277120f3715aa8b0e171
MD5 b0bf3a0bbe7924382de482aedbeb1c54
SHA1 4efeb9bb0384b545531dc91f7d95925621865098
SHA512 8f28f4f67fe03698c9e15967ce7db99767812b937049bb7dd5cad14f46c9b5ac6202a1f49aebb13be44b47c3f84aeb8f110fed64d5f0929a4259e0fb69e0373d
MD5 SHA1 SHA512

Submit Download

dynalink.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
Size 1KB
SHA256 1f0a1665788ae25d08478e4ea2921ad81c8bfce025f3fe6a6275a33bee500c24
MD5 297cdf97c7438113a27d6bc5b2cbc8d8
SHA1 1066df3bf092c07f45b38f4ad764cffdc3a9e4cf
SHA512 9bffb78de93655faaa388c2130ed67daa82ec7022f8bc2a5acead9be93e380dc6dd603b8a9f3ec145a0031c7f9cbdfc0a198ca907f9c4cf7023ff35cb8ff68ce
MD5 SHA1 SHA512

Submit Download

ecc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
Size 28KB
SHA256 88b34ecdc6c2917e4a94240d83dffa0d7ea8b8b705bcf43c4f6c24ccaa36c069
MD5 919d9d171ee74b8b6ab5a288c151d7f8
SHA1 778b163fab10f66aa5b4b6f9ecffc94af34cce29
SHA512 324a917aa8d9304ec8a04a33d14d0b572f578fc0649988c04d830cebe233123be95df16f5818e2f5cb6a9051bcc5a3385e9b2a82963309b6a7ea4ea3c1b9808b
SSDEEP 768:ztLakvFDk+BMjjSVqQko26PKhPWeN0fEiAACUy:PFIeDkoAhOeNNlj
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebxml.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
Size 2KB
SHA256 02faa0e60a52a2e24f305bbf240cc46e1770fae1a8765c8fdbddbd38059e0adb
MD5 1b7ee58b247bd65dfa3f8bd68bc11d13
SHA1 1495c6a167e9a3ff22cc9f3c623c7858b54dd4d7
SHA512 6151e7b61606f441b76594cc448ab281ce26d68ae69a7331bc570c8dfc64b6600501357542c5e23ae9600191eae7e538d0695cb9b9908ca1017b2fa2a74339cc
MD5 SHA1 SHA512

Submit Download

giflib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
Size 1KB
SHA256 f63771717b0a1446db8d3c78b059cea38f04dd4b3b1eb3d513c2f000a39e8d18
MD5 10aa20d5d9c63ab3a222c84119915c17
SHA1 3b7101023f4551da0fde6a33bcaf1c2d366b7f28
SHA512 a2dd3c0a36531c8cd4801869a5d0cdb422c3f89df34d512c6ea655868d533b52468e67a81c005eb1424cf12a898fb3265d66c2f986164201914038ae33b06b6e
MD5 SHA1 SHA512

Submit Download

icu.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
Size 2KB
SHA256 a13408a312c6fa9502042f43ba47ea55cd8e28c0be4278d43e44b6c3581e8e4a
MD5 4e7018441fbed31f983c11232c4cafe9
SHA1 1bed87e57765e221e6aa4dfdd28e14c1a97584a7
SHA512 192dc3afcad2c4573053f8dcca09b696062e24cec091d8f9fb6f12e18b2f0b88f4ef9e0312b4d3a7f999b94f5948c644ceb415ed9722a13a34340920404a8664
MD5 SHA1 SHA512

Submit Download

jcup.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
Size 1KB
SHA256 9de9118643ea8bf35ebc28762dad93b78ce55b56a797a17784d00ac2bb41416e
MD5 91f2d66640207f17b864b5b643900fbb
SHA1 2d5c2b33c826c421e2d2a06a1b47ca1d07c1994e
SHA512 250b77eaa9062070a6551dacb4b3be7746ef553405fcba16539cb1533615d59c3ded192c2d127da1353f3230b8536785aa8579919536437e6abd8c5365179564
MD5 SHA1 SHA512

Submit Download

joni.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
Size 1KB
SHA256 2316c5f1f87efa543b7a938100ebabd5a875e62f392c33effee28de770c15e05
MD5 6b2b0391ed26b54993dee70c99c58e98
SHA1 e0a3b9f30392da0cf79555d5809c3df64cbae489
SHA512 52a5891f68552d30d6bb486a89ef02cef2daf26129482aa2cfbb006d2b2493e51b8c742b4e97c37987851469fce261bf3222e0b2dfe2d10a0ea84354684b0467
MD5 SHA1 SHA512

Submit Download

jopt-simple.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
Size 1KB
SHA256 4b8e98947143d346efd77a124a4ac4453d135678d0d7e2d815b043486a3393b2
MD5 e5ed77238eb156def8fc3dafb8b991ff
SHA1 a77589a70146ab7284fe0a5322f785e84f4417aa
SHA512 84072921392474ae97adc27aacd9dc9491bfe9af32f3bf302a3c63d107c5b9dbf87a9dd5237d5e8e7eb6290f5736940c163548a48da2254e34924d35f661d419
MD5 SHA1 SHA512

Submit Download

jpeg.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
Size 3KB
SHA256 d4aadfed8e36fe29313b084e77dee8fa03172c289a34a81a83d4238f4aeba0b2
MD5 7203da2548f4724d3cece9309439b6cb
SHA1 7195f1bacf3598521b4deb295e81d4c189a1dfd4
SHA512 61046163c6ca7fbf1db14eb6970c2b7344cf0c6ca9a35aaa8507cd4a9fed712e04542e5a6444eb5b1e44a99e8b3c11d2c749d4b5202030e4585e355f4c511812
MD5 SHA1 SHA512

Submit Download

lcms.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
Size 2KB
SHA256 782bd4dbcb133eda2957c43397b825dacc3148574ac33f89a1749cc2730ba33c
MD5 b2e70571629cb5e21a5e53d98bd5c8dd
SHA1 7f3739262ea4cbe8db561cd5b254bd1ab6ce609a
SHA512 479dd44eed97f47bda3042477c4009d3a2790f5d01e81c7d4c7f9b5b1dffa5f0372066a37bff9acfa11259dc19c4356c3735770109e994464104e3d5d83f9953
MD5 SHA1 SHA512

Submit Download

libpng.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
Size 6KB
SHA256 b437bc0a73b5ae64a2157e5b32a859524bc7d37ec06a68d061fcbfdbb4243155
MD5 900314bb2302715821fa8c1ce36de902
SHA1 a077ae154491ed586b14ba9e03324b6d14f4d54d
SHA512 c75f593f1ef64b8ea80977afdd514150195785dbc50c10ac134772c5beab868a8739a84d489dbe9f071fcda2d35117436b00989970425ca626ee0aac28356f89
SSDEEP 192:jm3l5J1+WOedWljOeRSgnxEKOrl2SmUy1gH7JDsWtmxJX:jm15JZHWljOqnnxEKOrwS5y1gb6WoHX
MD5 SHA1 SHA512 SSDEEP

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
Size 5KB
SHA256 d34186455b193c328aeea6696d46eca7bb51fb9ffcdbaf00ca5d5e1e8d489462
MD5 ff08c83c2b4a9b1765f53e965aff730a
SHA1 c3aceeaf8a25b34eb24e139edcff0fef0ab1b5ca
SHA512 20347077c8f771f829946e310a30b6b1bdedb47f124e742f30da1fff198bde57524d167f81fb6b52782448a842bf163762dd10d310bd5bd028e77324bb2cc694
SSDEEP 96:CM3xJpBeLrBwwAAB0kKwTSblcPmSzUH9Sk2IPebZ1wxSrfzZC1qb8gAuhHPjeeHW:r3NAHBVvB0kKwT6YUUk2IPzqdaK8gPP2
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkcs11cryptotoken.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
Size 3KB
SHA256 efb7eb96ee3ecc8e1c5dec842f176ff690302998d4b96d1ce74bebb70f0858f8
MD5 315ac4ea99be3fceeec271c2b3560959
SHA1 f03883fd55868a0577ea923345c6da33625b92a9
SHA512 0457709b6bfe2592f36451c8558fb8bce8971f0e57a372b63187a885175c77deafec1733cca42035a06a096bafe436d4f66b1a2eaf6f8810a237d1facdbc70f2
MD5 SHA1 SHA512

Submit Download

pkcs11wrapper.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
Size 2KB
SHA256 57a6711deea097028b5d4525b78bd06160efd90f0f600dd91b81cfde1e5771c8
MD5 472ccf19c139bab5a43ab606e4b35e09
SHA1 39af95fee161fc72b017bf56647265710bebeab0
SHA512 141035bde0aa03dca9813e39b79e1fe3554b24ae1b720eca3423388fc6d4487b473b57ae755ced8f79f37bb8e32b74c7122936b7b3a69701a79699fd0111233a
MD5 SHA1 SHA512

Submit Download

relaxngcc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
Size 2KB
SHA256 18e9de708666c253f5a47e542cd8ef506374619432d10d40fd20d2ee04543a5f
MD5 a94df538a5ae77cce0832eeb2227ced2
SHA1 77d54e392a9b86059faa30a571cf970e885a95b5
SHA512 ce6c97146633e7d53e2422d8e02949419e2cafa061a8f49d21596c2d2be753faf606c8991368cff529e0c73cf8da35e6516fc010dfd862bb69e2f28d6ef684fc
MD5 SHA1 SHA512

Submit Download

relaxngdatatype.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
Size 1KB
SHA256 f9a1534af1bd2770909de56e5e69e159100760dc99d0d48f3c5c916936afa3c2
MD5 93533b5b86d928ea3f7e420f8d7cba75
SHA1 65d91ee7ce8b7dc44a5140976281203a1a1c1606
SHA512 dd4c70eca151353a704b42e3800af8ca6ead2359e834a08d3cc683f2f5ef887e3c98713cded179f8b53789a8589c0acee1b23c036f9c522b525f11cb94d2f9ea
MD5 SHA1 SHA512

Submit Download

relaxngom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
Size 1KB
SHA256 c89a150d2d5bb83450b89b1bb06df216551b5110c00408633b822ccdef25ca68
MD5 46b6024b963ff307fd665e28d4ce0740
SHA1 f6a6eb58307380e8919727514c3b88aa60bead7d
SHA512 a632e98d7134f3fe8e668683da17b54f538276b143583360fa207aed593cef9cca33695580d7db7103c9f8130ec86e9b06acc9292388db59f61e78fa80adf175
MD5 SHA1 SHA512

Submit Download

santuario.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
Size 11KB
SHA256 67360269dc4323d6a4e658fa92445c726c12deb337cf58bd0d514ade0026551d
MD5 77f9360bc3e47fe66a6dc8621e957298
SHA1 2aabac67073124085065ad36cc6a6bb344a26296
SHA512 19d5f87d0b587ee06b8dcb62838da0b04c54a8450fd7c6e4171da1c6cd1266e12496808e67baeaa0d714d337321f664553aa0420e4c2ea78753aa95b270ead61
SSDEEP 192:aSrWkJo4b+wChxjY+3HHh1x+qs2aA9c51tKF2LA3bBiKg9Qzvu2bgu9xQB87lybW:ZBwwChC+HhGl0c/KPrG9A2ugYxQhCCB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

thaidict.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
Size 1KB
SHA256 8aa5f39b345da43117449f53b64536af14ae7bf3dac75241bd5171be3aaff67f
MD5 0df9400fb419e51dfb112039fbea257e
SHA1 8312118409b8fc757dcc2ace3baecafead18468f
SHA512 22b4e5ed1d96da0366f4e7173338471af9e9e2ec53d28aa61e5777661d53816db7941d7ec6f59761184b19af7325f5f5b75d9375df5f8abe9cfe33140564b79a
MD5 SHA1 SHA512

Submit Download

unicode.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
Size 2KB
SHA256 47c36ae49bf05864bba5721618faf076cec1819e3407fe0082dcb79167059bea
MD5 25e66a385437a1cb9f8d4188d513f276
SHA1 9a460a7a701d89c40ee77399cb6625663e56b04e
SHA512 08236f5214eac5d4bfb5f120d00d3c1cd90c3616959fd2f8fec9f41afd1bfd398216b97081b072ee928b9e80e2f690fac2c60fec6f6c524c29bc10ed179a7904
MD5 SHA1 SHA512

Submit Download

xalan.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
Size 11KB
SHA256 3135d91ba8af0b2a446ffc4e1fa14d9b93ec184f36f85e8a3353b75c72b97a6c
MD5 f08ac1db18857089b9845cc1118e5e76
SHA1 2f3cbd3bd34023a64a85b03140d03fd61cba248d
SHA512 b99c18ff52bbeca94bee75339c25410293147bf85130ebfc41d662a795603f7e270a3b150085774de70f053bda87fcaabf0ff64852ea9645e6dcca0deb1c4f18
SSDEEP 192:pFeyKbPTm9a6CIy+nNl6WoVMn/gj4mwwESb9WoAQ3l7EYjXVHn7B+51JOHekdhL:pFeZya6vRvqVQgfPDbfAQ3lhjFHnc51+
MD5 SHA1 SHA512 SSDEEP

Submit Download

xerces.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
Size 11KB
SHA256 72a66e82a3e8d97a21274331407b664a15656d092a80a691e532c1814d2d35a5
MD5 853e4826fdd7fbf515c8c55a07787640
SHA1 b5a4ecc8da689512a1d5c5242e5e5adcc29486e1
SHA512 c7f675abbd6ec5bd25dc73ed6c84ed9c9f427eb069c14d4646c5cf8ac3382411511f06125e1c936535308ed07d4b69bc73382b403e6c064a1acbdfd94c6f0688
SSDEEP 192:n7p7XFPZiqLb3GrYsQ0RG1h4NUqh94NtfK+zbrODErUTRLN92e3PA:n75FPiYsQGG1sHh6Po5hFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmlresolver.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
Size 11KB
SHA256 4f24f34f4ef179f63c7fa02f0caf36cc758edfc6cae93cf2ee5707830560f741
MD5 80f77870404da566886b600482094743
SHA1 aae586c1633f9632bdc298e3cbb7a7e222d1cc92
SHA512 62e7342d0081d7450b901b8386a08e2fa1374bd559ba7014dff26b2cfbc704155d81d4057d565f5bbd77e0d3ccf859c9a2b3e65e622b9424363b361061088fba
SSDEEP 192:vSmm9a6CIy+nNl6WoVMn/gj4mwwESb9WoAQ3l7EYjXVHn7B+51JOHekdhb:6/a6vRvqVQgfPDbfAQ3lhjFHnc51oHTJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
Size 1011B
SHA256 76b762dc0abfac974419331e2e55400460c65add8b8cd558730ee4472066e08a
MD5 776fbf89653cf813c40da9473d9268dd
SHA1 c3b31b3db91c5f1ee120ee6903339ebeecda2939
SHA512 ddc7ed5c906543d0d8252c4a4c79554aa0f0abd464dd8f151dc9da0f6e35f76cd927285ce197c86df3a28f4db386f102c3eb9ebe58002a13c22b6fa17fd306c6
MD5 SHA1 SHA512

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 42B
SHA256 07fb57b9dd876615fed4efcd8a0f138e69c935e952b87ff2f4115125e06a88ad
MD5 ac154d8a3b1315e61e5905fc6fcf547d
SHA1 a50f49738881b22bf11638420bba2b73b2c2368c
SHA512 8a31afa3dc49ff3979c1c2b5b46aa56e4dd2edea918d520c4f414839e6d9bb852430de0c18962480e17b3748bcf7f2c7b0d2f593d70e33be11366fc099acfe0a
MD5 SHA1 SHA512

Submit Download

AppCache133670754015919606.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754015919606.txt
Size 77KB
SHA256 bba9eaf168894552e8693e834ac2e2e5ce677c5e4495ce4d760089ff333bbd22
MD5 297e37e3e751eb6ff1f1a1b309040600
SHA1 9b4d36cc9ee28297df6cd8eff6aaa1e35acf7552
SHA512 7c961c4eff903fa8ee3ded03e5f022623ce463351b860dcb90d3be29c9ca688b0af2c7c30430171098d9e78c0e004a9131692a5d753d7cacaaa9af9daa1f08b8
SSDEEP 1536:Zsf+7nJ/DgbRTO/nIc1yL/wjdjlwQ27GQ:KfQJE1TMnIc1yL/wj1lwQ2B
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133670754558884338.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754558884338.txt
Size 47KB
SHA256 1093793b68567bc6d28c4894fb3e5521f63bb7b26759739e49f3b47d5fbc7713
MD5 5f99e2629f758b7e42582543bb6f20da
SHA1 85da65a645ce3325b672b81681255bb153f3bdb5
SHA512 ed2e15c67fecfbab96d868d70aa258e7f5ad0f467530f0833e1b1dffa5885686029ddd953c34ed129a2114956953d19e52dc0f7245d8ef925ff0e9af38a03da4
SSDEEP 384:IToCB/zJ4ZyMBsfWuZoh2DbjKYjlt5hp0Qw726I2hxx9sbAKiieBkQ:1W+PPlhwjKYjlwQ7Kx3JGQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133670761023232969.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670761023232969.txt
Size 63KB
SHA256 e2d84a731d8e5f965dba47050e78c6f71d65da6f8584b1530eb315128710890a
MD5 cb18bf7335ccb922376e534df0accc5d
SHA1 8c26a17bd28f464d668a0cf545ad1e30b75f0cdc
SHA512 54ebea8ceeef4365eaca718a84e94bc6a6e1422050fa3a700adcd8bba09012132f9e5841009822e0261510d59b050032ec330431a673e0b2091c269fcbb99eb0
SSDEEP 384:1Pf3G5dwndw+C9SRb0kW+fwXIA5TTKN1QW6si0AaTJRSGYJvxwE7ds9gNkka1:RfGn0dvCERb0kcXlF2E0AGDYNxevkW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133670763578088095.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670763578088095.txt
Size 74KB
SHA256 9c778be84e4007b11fb8950f6aa2c95a1ed3dd8741290f80c79ef32b2718a757
MD5 6eb3428bfdcf1c807c98b9fc501bb39f
SHA1 466836d89a83300f6e07c96048c25f7dc6b35380
SHA512 2680ad20f7ac08b3a35eddf411c507dbd54518114f290e32fbec147f604cbe9a0f31904fd39a00f2b1acf32150e475a6ccc1a9c9d1c11ba95bda5169cf1f4d43
SSDEEP 768:5WgcKYjXhaxbWtt1y61gu/AOMK6PYTQ7Kxu5A3WW/:gbKYmbWtt46yu/ARK6PYTQ2M5Yl/
MD5 SHA1 SHA512 SSDEEP

Submit Download

File Explorer.lnk

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Size 407B
SHA256 d5333b4366816472e9ffc39b4dde839faf9c9a208168fceb798fbb076abd8231
MD5 f20df7a90bc20fb7cbd32a4d58016718
SHA1 a8e08f02165dbe25d78c1828689055d2e56fe13b
SHA512 574da41cbcbf4cae8a9160b21ed8154b01c1899b019bf1da860d23e1c572790313f5c43ac97459b7c799f438194f78e553357d0f16a1fb304990c11e1e65ea50
MD5 SHA1 SHA512

Submit Download

ASPdotNET_logo.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
Size 21KB
SHA256 4112bc6c34848cf1b5bcacacd56f76ea4bad8f8b4c1570bdc2cf451f6d739c8f
MD5 22f4e2f23c1198900d51f7b865c6c6b0
SHA1 345989c83688a6e00f89652dc2a252164bad757b
SHA512 ebcf5e7efde879c624c9fdfa37f54aba6cd5f00aa9e8378cb649ea938740801110578bfcb12431b64bc045fd271884fc0dfe681dd536f4edb43a4c1c5398631e
SSDEEP 384:SvKkHAhoPazKrZvxggggc6JCO9sv3ouJC9yrsE/gBxh6szt0Hdp:Svlg1KBiy9G3M9yrNU7B0Hv
MD5 SHA1 SHA512 SSDEEP

Submit Download

HelpIcon_solid.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
Size 1KB
SHA256 b7b7a50b0fcc11f2030da9dbe246c35c96888d6dd45a061d4546ec7776c42cdd
MD5 dc65a902b273cc903bc5822f35bcfc8f
SHA1 8dd2af171fa753b3aab86ebb5ab89ca75dbee910
SHA512 2be74af97609e18b1d90463c71cdc3e1a4e61b2c6bfb9953ba712ad596d5fc9b49645456ac98fb36d44ef4e99324f7f677d7e1fa00f390ebb6916b9359f81c77
MD5 SHA1 SHA512

Submit Download

alert_lrg.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif
Size 952B
SHA256 7b4d1b1a483993feb4fcc4e9ace44f872178962b00f5bfd9e2b3b58a6186d89f
MD5 230b5e3b5c7ffc6cc58bbfcb5f89cbe1
SHA1 68ccefe86bc6cf59c3abfe33ef78264ea0f0c1c0
SHA512 d503b1df607992ac86a251bad9075beb9374a1e4825e2d253d1de0f55b24e98eb211022c070e2ee9a597bb43f1ce5d9678e8d3dac61e279f20108f5e9e29f30d
MD5 SHA1 SHA512

Submit Download

aspx_file.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif
Size 121B
SHA256 001461ec05f1bce8d3b91d929caa53f51432621a9830a7ea7193a94dd86fd473
MD5 7fac68c30f4d555015aed6528dcedc46
SHA1 57cb5d29f05c0364397e74cee0849dcd4c6a7cb5
SHA512 ea814da665100e8b4de81e857f5f73a7b38422c382c6065dcb0701a7be4ebc4c0e572955c30fc8c6ace12e4cc17c1c48e24673dc4b74abe5a95cfb532f5f0efb
MD5 SHA1 SHA512

Submit Download

branding_Full2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif
Size 1KB
SHA256 a2d561fb3b47085f6689c8ade1ecd616d07f713c1e4f780bf8a4345fd43d5b0c
MD5 0c28233f85a4fd653a2fd25abc1be47a
SHA1 cd7e9c9ceb603e4a5ce5ceab8237f13b2cd22c5c
SHA512 592e3f8f4196a19319563b9b2088fd4ac6f54b677f20603d7b955c53d6c23bd71d28b67c3bbf00c7c73c69ddaac4ca571417bfa42cc014782b5022c2c7bfb706
MD5 SHA1 SHA512

Submit Download

darkBlue_GRAD.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
Size 8KB
SHA256 0bcd3ac2aa3dfa11582893937c05130ede66a9f909ae0a03d243ed636ff619a2
MD5 213ee0f14b9371abf0bfb605edd52201
SHA1 df928a79572cfcae790dc7d7c24fe4d447e9db3a
SHA512 df302b66d361958c6781f22d0fd4919f8e5dbf17b55e1c970628749ee3a7b200cfd81fe2f47e3fc915028376b398acbad8e5e6ae77ffaca682e67844fb67a583
SSDEEP 96:MsaoyDHX4VwMAeVda+LHP5RuBS+atRZH4fxkfxkfxkfxkfx4hsN:5ajkwMAO8Y5RuKR5uxaxaxaxax4hsN
MD5 SHA1 SHA512 SSDEEP

Submit Download

deselectedTab_1x1.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif
Size 61B
SHA256 c2179096f1f71cfca80a685040ec183ba4d6d67dcb685cccdae4659035e56024
MD5 85423017c30958499affd6dd9aa54766
SHA1 b57b0907b759205885da858caf1cc37b1ccd3f6e
SHA512 0d2ee10f7f8bc0b73f5419a016a31ee275935e32d8cefb8da3fc8b55ba9b9d9581fd0531443bee4ac7376726b056e2fc1886368cc934f2e6b9ed3d15575453bf
MD5 SHA1 SHA512

Submit Download

folder.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif
Size 914B
SHA256 c7d89596851545891dd9a9c5376909d81e47e1c5f7840561522d2bf30e0b18c6
MD5 245ee848279789ad9a0be59dd648e7ef
SHA1 237d2760d9d8d0f68af8a2f645c9db594475231f
SHA512 f2bfb7f9d5477e265e851b8f2adf89e1c6cf5b1d4ef7b138992e1bf92202d321a82ea9de61b4e464b9cf78eef4c6c558e19b79b16305d14586e7aa2b3eca4934
MD5 SHA1 SHA512

Submit Download

gradient_onBlue.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
Size 90B
SHA256 a31a2d34f1a254bd5aea332eb88d6d57355a1a46040dbce8b58aba09b5adb9aa
MD5 443e86363fb6314e91810a94490db2b8
SHA1 1b5c987b7a3a1b20f59024cd98aa70ff4eebd298
SHA512 d5c207e107cf5eb6f5f6222ae7676c302305b62d4abebc2f2fcb8ea5ee55c2000bf5bb3703cb0b104116227bcb6393b342b0f00c93030c121656a3b5a34b4947
MD5 SHA1 SHA512

Submit Download

gradient_onWhite.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
Size 90B
SHA256 5c1a46b0fd22c0a5d6c31d18cbc4d8897787e9657c7fd6a76449260213b2d4e5
MD5 d841ad7f3d8398d6e2bd73b7b364ae0d
SHA1 7f1b978bedadd05566ce4cb025b1bf6b6b2b8ba6
SHA512 4e8d75f70e232d0146e91d5639afc4c1780ad3035c6320a467a27bad0131f0b6007b6b5a99f17ac18aa1b35636bf4d5e2c5dbde5aecb5bcdb0ff1cad9f813ee0
MD5 SHA1 SHA512

Submit Download

headerGRADIENT_Tall.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
Size 328B
SHA256 a0bfddcb61326a8e9170e67dd6ada7b5a93312ba52e394b55bca38eb9037e022
MD5 f9408f8234c0df0acb9d2a118c2b65fa
SHA1 c1e17f64375f754db3c8de39b8111d72904ca789
SHA512 27e2d961a72f7adb1c1b5548e897f136b0ce4445d5d7583132c2f4309b977d41484985eb05ffed5ab0ea142b38adaeb2d5bf82b09881803779b42c6fcc540fbe
MD5 SHA1 SHA512

Submit Download

help.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
Size 1KB
SHA256 233866fc209438722d94feff8dd0183b66ec2b141450bf030ce4019ae81775d3
MD5 3eed7760a7fca390e30f8696c4274616
SHA1 572b7c5672a31ddc4dd796b62e4835d8cc1f8c90
SHA512 0bb294784a5ea233d083dcf818ef495b0b7e6bc941e1b1eaf8917ae43b1c5b34eb06641bf41fbb501c26e9aa0aaee0e0175cdf304d4858013afebcd564857b7d
MD5 SHA1 SHA512

Submit Download

image1.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif
Size 162B
SHA256 aa7ec1b4bfdee1ef784f65bfd9c900e8ad743552afd97648ded9b26720b89b8b
MD5 1117ff16b9e3fcfaa7d5e87ae9b8def3
SHA1 2c55e59b0b65d5f6ec47539e96b94de6dc02e274
SHA512 df77cc693bf17fc333ec469773882dd189330bfeccb3b958a5cd06688db2d0b8fcb82bd4e860057bffb408554089c6e4654b586639f41b7257b65dffcb2cfb6d
MD5 SHA1 SHA512

Submit Download

image2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif
Size 586B
SHA256 ebbaa9ec449199a197eb011415db87d12ebbe5e5382bae1745832e2789ac362f
MD5 63b72272232e2889f1aa7d08ae9017ae
SHA1 f8f0d22b4a90d66f515f099525367665754f579c
SHA512 d2ae5ceb892a8586b966737bb0a3a3a7fe041aa632a2eab3d839b11b81410778d064947dc4ff3d2d6c47b7bc69a0fd3d982d0313cfa3c6109a20bbfb5a2e8345
MD5 SHA1 SHA512

Submit Download

requiredBang.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif
Size 124B
SHA256 b48aab91594bc9c56febb87ca6cf2d3e976739f669ba8711c5e15de1d4328983
MD5 93646289357f70e0f3afd3405d2d3e20
SHA1 ceb1456e992ba0f53848075e3dfc7f4f2003b913
SHA512 ebd613613937ad4001a61de7cb6006037723384d90a425dcac95e77f431f49eee760b9fedad87ae7bd5d4236f7c992a3a4fed4b0afe2783ec314e6ff97785bb8
MD5 SHA1 SHA512

Submit Download

selectedTab_leftCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
Size 65B
SHA256 5169f280687c9b39d003a6009d888297a23efc0f7d735deadff6acd6a2b7d7db
MD5 850d56b39ce3e14d03af9908a1fea705
SHA1 0934210597c63666172021b138c25e0cde049cba
SHA512 6fdeaabc9ecec5e5d85def8eae2d21d3c6ba8989534106a273e2dd08d93e3c06645d870fa991570d8bb82bc4efeeebadbbb8854a3435cd0dcd124ccee535329f
MD5 SHA1 SHA512

Submit Download

selectedTab_rightCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
Size 65B
SHA256 cabceb98b663a041d77e43b48b4a89afc97b48866f4759343b76ebc210c4864e
MD5 c04c43fda5e13be8e50600c5141a38b5
SHA1 4c0ba5b3a73279ef829dc70f1d9160f4b7b2f93a
SHA512 945a24537914df0bb110eb0b61f21bb092366e5306b69af55bc31e4413d8ebb71f3308cfab62f379516438d514dc31527cd469545a551af3f60abfe7c6fdf32d
MD5 SHA1 SHA512

Submit Download

topGradRepeat.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
Size 8KB
SHA256 c3c12844a6cf1ca3b78879274c740b53cd6fe0827f7e149e5b9d38514c6da803
MD5 63ef645050fd6437d13639e64d22b6ab
SHA1 abf38824c449ea162975e68e345840be0f6466b5
SHA512 7af9db2716bfe4310700a80dd8f709858c550746ee6fd02e65b57bba6cddd23d14c41c4bd287d13d5539e7d8ddfdf5c6fc6bf29d1c2ed02cf6135204f3c239cd
SSDEEP 96:4a1/duHKEfohwzdC9gtuD49/qEY2KT9nynynynynTOvilZFMFfD:51oHKD1EqExKTJ2222TMilZmFfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

unSelectedTab_leftCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
Size 65B
SHA256 3170e4afc8a84718dc206f28c3d966cb29a423b0991e4f68db7df89265dc68b3
MD5 2697d7066e8ba2a75a354e513f98b0bd
SHA1 6e3d0d4d67e7d3b6c823f5d56d4a1f66e6cef292
SHA512 41bf2f45e573e675ae7d6e7650818e6392b31dc2cf8b4ea7c6e7a46e08eca21a3db455e37e201c59b4936199522c7aa9db61bbba2256367c1762b26aad193b40
MD5 SHA1 SHA512

Submit Download

unSelectedTab_rightCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
Size 65B
SHA256 2e8481f10432dbdf584c848efee296843a110cad5871a4287cfd30fd590ac3f3
MD5 d671227c6d6db542ce73700c0bbe6ef4
SHA1 ac3ac6c19a079bffd97c4866d3c7cae5ce8bb5df
SHA512 95ea687d98c2f1121a1a6f43520406c0876f1912a748ddf4b8c3dae5dcf08d7f6216cf07dbf2ab50a459435740d0a69f4ba7bdfe4e885f3657a7103260cc3fe3
MD5 SHA1 SHA512

Submit Download

yellowCORNER.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
Size 880B
SHA256 e9186aafafb3eae70812b08738dbe5bc1e44397de615082f61ef8d0c1f648d14
MD5 f70b5d88964043c9bf10ae5ed754cc57
SHA1 04f9b82a55e2b771524bbdae132652e655878071
SHA512 cce43cd663a1a4f233a6994c40d6abfe3629b07f1ec453da951c406c347313328e6de1bb5434fa0dd01ed009dce86d6039d609c28dafecac3f642bb491854248
MD5 SHA1 SHA512

Submit Download

security_watermark.jpg

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg
Size 49B
SHA256 96b312beed0101a92f84868c24c42176566f1457638796d0f1ec2a65ad13aba0
MD5 bddc97cbfb38280e951b43a61cbbaa3a
SHA1 45094681a7d3b93c20cac89ed655ecb8f778f5d5
SHA512 c94332d514aaf019cc6f6066ef279548b6e5422b2160a6a7793637c64184efbbd41d28efceafbbe3138ee96f5968190c182dcdbe8943390d4e79a131f7cf5bcd
MD5 SHA1 SHA512

Submit Download

1 - Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk
Size 1KB
SHA256 b009b5fb53105c38e178f48a0907e35e31efc85678c097f6502e0858e49fa67e
MD5 9cf1d6f43568cdc086f31b6bae996e41
SHA1 5f555cbaf5602188b88d32f6131e4cd8a613578b
SHA512 864eb18a3d8433d5c01315e4a74c34348b4573cd6d472a9306f42858e2cec029736b69f11fa7dbb311ff3e413e73a82aad6e555e2d24ce39595a3cf92fd0b776
MD5 SHA1 SHA512

Submit Download

1 - Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk
Size 1KB
SHA256 d913ae3e6e03e2456df1a505b2bfb3708d13c52d1aa87b12b82577e8daf14403
MD5 df0562f6cdc6fd9f3fe61b1916133947
SHA1 b8aa053e8d134a270f990f1ea452923fddc7847e
SHA512 83426d689ae7a0d4f0804a8532bc0d76bad01ca971ff8207155aac2492ba1f98e3967bc4cafb632a1b99ff48ce8fe4ed940d47a63b8b797c2bd573b4fd6b4c7e
MD5 SHA1 SHA512

Submit Download

2 - Search.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk
Size 1KB
SHA256 dfc5d1e1e52a97abb6b8163065d1d8787cb5c0597745c114bbcb69d21385940b
MD5 8895ac02f2e9d13c126f69fb30e35001
SHA1 4e085b8624c30dbcead638978a78ea4d87b3f8fa
SHA512 a44bcd23dfac03734cb95b08cfacb9f37f706a6065a0a276b185d8593e3e8780c8cd9f62017fda8ce26df2c703283237ab3afdaa11ef3dd37c6156f74f9f18e2
MD5 SHA1 SHA512

Submit Download

3 - Windows Explorer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Size 1KB
SHA256 57a3654f4d5a013671ea4a66a366b3e37fd546059961a4a3a75f1f0713d65cad
MD5 ba785b2937ddbe99ac65277838dac9a7
SHA1 467a1ba25e2ea007d7bc6445f162e0db15100c5f
SHA512 677087d28af49ff1c92f764ebdcd8153b96f8b94b6ddcbb99d08f1c1781595478b893bcda3197a6605c10f35f27fae497198a18550292aa81b5110d4c3cc41f7
MD5 SHA1 SHA512

Submit Download

4 - Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Size 1KB
SHA256 f7bb875f6d23eaa5b63c4edaeb92b0c50427e62f6b388d2f1338df203b263524
MD5 0b11d36abe459526a3b30d09c050861a
SHA1 42fb9710546d317dbae6db53f494aa4a44266e97
SHA512 ec741acc7cd2e1620ed645df62ab820bf095bc025d07ba04ffc20e1faede5f61113c32dde3a8ec3d42b1ecb85d48942644b80e8495b7378ccf17805462a9ea31
MD5 SHA1 SHA512

Submit Download

5 - Task Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Size 1021B
SHA256 fc4f56ab8ed48cd70aedac6b56169a463b50a8287c569c52f5ba128efc398cc8
MD5 380bc3009f00732b98c858844b51028f
SHA1 c8adecc06197cd76d46d3cbe411f0024fb309b50
SHA512 33e0fa7da96888bafee9351f1d1ff5608746d6b58594a5db1bbad5b0cf0b9578bd5b7216fd8a7747308066813e71600787703b37a34c30f9fb89c2322f6803ca
MD5 SHA1 SHA512

Submit Download

01 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Size 1015B
SHA256 155cad44a963983dbb38668a489aa03540be15a095cda7bde610650db92e6033
MD5 9d89f52cad5d3f9a37ae3d187aa31042
SHA1 540001dae003745eb4165c50ed328173c3cf8ace
SHA512 90c411eb7aa7bba2cc7d6734bf0a9ba2f7e2673779b4caf4309c92cb4c6df9986da5f2ca3b16844bcb8d5b2454aba6fc5684da1ed0b4a73c352bba47b3865efc
MD5 SHA1 SHA512

Submit Download

01a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Size 1KB
SHA256 8f636fe1e77eeb10fe7d6a24035de6edafcffe1ab6ee5a40022d87bfcc4e8e53
MD5 e9f6dfbc2724cadbe5bb7074ce494abd
SHA1 20bb1d8c0d0390a7b516f69d5f5e0c24cefcbbe9
SHA512 3f1c0491f36f72baeeb785be92b425bb2a487102759f74cdeb2b7100c117cf1a38e2b13dcfea734627e6ba1da829c728d0125fa3d57e1c81316b5be8c0316bac
MD5 SHA1 SHA512

Submit Download

02 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Size 1KB
SHA256 ecffb452f4fd7af300ab141f23b650ba29dac243870ed95e20b55ea73421f0c0
MD5 4d923d5c5684d95f514f50cdf7991f98
SHA1 496d88070b9d5f4ef7d208633065853c1ca4215e
SHA512 41861e3305fd3546a1f4793eb2d5c2e538f876caf0e73147a448842f70d54b891a05a14095e57219a563f3f18e9dad524eafe3c9fac8af2f04202dd02907346d
MD5 SHA1 SHA512

Submit Download

02a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Size 1KB
SHA256 190a16ba3a3074be50e0fea80d1385db1ea05e48646d154c0b0f09c876a2a710
MD5 a2456da00af4cab38c66c0f8c3b4566b
SHA1 8e6c57c6438d41611f26c0b163bdead43ea72f6f
SHA512 c9d19e1583c5ec716fbc3d4411009290779531d5505bb5055f8cbc7d5901841e1280751ac4ecf6414982883e301130e7970cf3a19956813fef63add1d61f9020
MD5 SHA1 SHA512

Submit Download

03 - Computer Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Size 1015B
SHA256 334f230a0dc15bf58bd58407057ce01c500911e4fc58ad7a07bde3efd884c634
MD5 f58a58e31ff7a19a134fa3c5d2942762
SHA1 44497a789261443e8d4984396c3b930e25828fce
SHA512 a247f05aff31cc7c32c9fdf7a40a3a48eae2a38a01a19385c2d90fc76f44e82ff2f2e8b5a275dee5f5d20e2fbb73c31efd8d384928e263ae5ed9f3880990ea2b
MD5 SHA1 SHA512

Submit Download

04 - Disk Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Size 1015B
SHA256 dac6c7c9b556aaf4b3be9f879e7b479c96ff278a2a6992773273d2c0d569ccf8
MD5 b0b4fdc884156500ee4c4df2f727f79a
SHA1 ad200d65f0bd3440dd9962f68107b2d1a50bf68d
SHA512 54c0bac5a7baf28e7bf9261a0689ead7caf42d536f3b62af8fb67912893a25c999372f6c78a243dfb6398e5821fc3e3a5bf68d8e8d98997049b99beb4ef28753
MD5 SHA1 SHA512

Submit Download

04-1 - NetworkStatus.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Size 1KB
SHA256 18e2ff46496600bf1d8d9965bd1ea537c5305d6f49c4fa5514e19f4c61bb66a8
MD5 a5fb69b008f2a58a88ed9be0fa820ede
SHA1 b73d982c2da0f51a84d0d529860aaf220a352398
SHA512 4fc9165ae818ba35c4e431c7de4b7aab75a5b99857fbd6646b64b26cf163ce1eafe6aad74bb55129b5467e83c0cd460d98c871b9f59cd57721ebed2a5e09472e
MD5 SHA1 SHA512

Submit Download

05 - Device Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Size 1KB
SHA256 9a9bc663463db3f7367c1169fa98d38494ced0f6a103203eb0a64c6622b5b70f
MD5 75c29fbcfbb6af431f3590a343c21bda
SHA1 5a12c93398808285e05b36af4a40ae4568f1612c
SHA512 79490755059dac4b13203c898f97a3b9b8ed2a7ad8be5e7167c5207da300d5f73e4a8fba77d20b415b5ab585098b3b37f7825d57e45819a031ea9ba1436741b1
MD5 SHA1 SHA512

Submit Download

06 - SystemAbout.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Size 1KB
SHA256 fdfdd56d7eff1667fc33d33955027ae3dc1285a8ebbc32d571115602682e7d40
MD5 f11764533870c78099167296b9aa77b4
SHA1 8f1f4b7dde0d629ceea73af56c37a4cea1f667a5
SHA512 c0a1b86bd463da259b6d7e7115dc97fd9ae079a6290d30a68897df9813cbe514c28da253a91578cfdd757f3567210f0c69590c8fefc2fb5276556fc9ebc5d21d
MD5 SHA1 SHA512

Submit Download

07 - Event Viewer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Size 1015B
SHA256 be23a8c17b11a4379363f7924aec044fe88ab2e7bcbb9b570e868e28c5eb734a
MD5 67110ea92afa84676ad3fb00490296da
SHA1 bcdb85e428cd1ea1253d28d9f1650553db4c19c9
SHA512 4046a3a3aed7ac81894e1a3b6daa6fbcb32b5bf6e6d8dc9eee7533bbb1c17e926fd7684a2488504f666ed348f25f2a6a09334947d04ec1934e7e4caacff7d3bc
MD5 SHA1 SHA512

Submit Download

08 - PowerAndSleep.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Size 1KB
SHA256 a8297731821364f9861604f8882db0285b1c0273b1aa2f96ec1055174380c972
MD5 db65f7ba8903139bd9c663dcca708ecc
SHA1 3c27ba25091f804b02e8254e773fad1b367c65c7
SHA512 fb738d2c4db3ae03d5b3157b7b71428ec9fa601be62e30f15fa376f9eb2d4ff4e502d71fb28e1d2889b2f91e3d73917d76c0092e71130d1a02b24dbcddd90839
MD5 SHA1 SHA512

Submit Download

09 - Mobility Center.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Size 1015B
SHA256 4de50d6e0b26c545d5b6a26b5e065ba1bb4caa277fa3b4f8d108b1e182ffd877
MD5 c79d184dfbc1f68cb4546d9bc0971d75
SHA1 a484ad1da10351edad348241b1c29ea8e692bc6b
SHA512 4adbeb25c5409009ee753e0eb5f28aa0adf086d45055627f16d7bcb083b53a5e06e87b00f054567017fef53096d618e00d45a9ed7eefefa567e1ea12094d057c
MD5 SHA1 SHA512

Submit Download

10 - AppsAndFeatures.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Size 1KB
SHA256 524d8d80fd0c71c59d1e9649204e388f6c0835537026ec6fe351c8e3c6146fb5
MD5 d3b760fd0ca6563a6e390906bbc5db0d
SHA1 36064d5adb1b8f3ae6bb3abdfaf3fa4d4d41bdfb
SHA512 d4fa0a59bb2c215eb07d009cd1349c1e75af9738f09767701a1f901ee9bb62361280bfa25538ff02d0bc67c7456baccdd71ec4c6af40332c1c6e47b795255762
MD5 SHA1 SHA512

Submit Download

Shows Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Size 352B
SHA256 c406f3879414451bf4a53f8f79e90743bf7de4218e32f7b02ebc68824a9c1615
MD5 7208ff0ef4c6b212905bd82176dd50e4
SHA1 3865865fad059e74bb3c7cfbc9e59bb537fd5fc7
SHA512 bc80ee7613096ad23818ae45e9c93b78628bc9a25be78f85e335af91994ed875eabc10616a6d928d3c3f60e24564e63abe020ed0280f7c01a9e5743dc2617ba6
MD5 SHA1 SHA512

Submit Download

Window Switcher.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Size 334B
SHA256 832b39678c42a7e1c42b64fb204b0ec18853b563bf5843544b09dedda666c28a
MD5 c587d8a84c5716a968ecf1028f6a0483
SHA1 81a32af938365f1dad70e130d909202c3ddacd66
SHA512 3c3aff28eddcd398f98fed8bbd39d25e9290036824a3d1ce6767aa7cf2773e5747b5608ae18d0660b3514e7aa296bfbb1031c91fd49562106344fb3c837da2ce
MD5 SHA1 SHA512

Submit Download

Magnify.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Size 1KB
SHA256 93b6ffc935082197f792026bdb2374b16da61354a9d2d6c6bb7366514e2667ef
MD5 1134c0db9918feb788290f5a4e824f1a
SHA1 c7c4596ef5c4b5157afcbaee179dfa467c54524f
SHA512 1524663bbe076045529b50a33b337af934be0f7cc7218c8fd9e74b98f22b7b742402d0ccaaaa699ff65e42aa616e075a9645fc495073da19bef8e168ab6f39f9
MD5 SHA1 SHA512

Submit Download

Narrator.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Size 1KB
SHA256 c92b7ffb3f82946eb3b3a06d0a0feeebd5c5211d401decf62b4b01956f74d185
MD5 dd182941546b35165934932f8818e3cb
SHA1 1318872c5197392b51a678f13dd1c0a12215f7e0
SHA512 1fc50c0d8a72dc57040454ab9bdd152a2ef74a3d6bd033542e45a506e474ddea30eefb50272f68a1e81cfb0a8be3b95f0cefe4dcfcf8bf2b32392380a50296b0
MD5 SHA1 SHA512

Submit Download

On-Screen Keyboard.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Size 1KB
SHA256 72f26bbdeef2f706cbd175302a990b4732cdf06041a48d500cc59c8bbf951045
MD5 4cc021c9d3503b96b045adde3f9dae57
SHA1 4c916186eacd51df8c98cb3fba761d28a64b399c
SHA512 c6e1cc6d8fe7355afccb81f2a411319b3b4651ac5a689e2d53acb3ba84dd5e198c5dd6169c9e15efc61f792bf1c40e4bd791717101c81c23975bd572f7d3b8a8
MD5 SHA1 SHA512

Submit Download

Administrative Tools.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Size 1KB
SHA256 82a9995bc7b0291683542d5d15b4b76ab469b7e20761aab673b4787c248d116c
MD5 5df608f0b38910122d91bb6bb4fd268a
SHA1 ce803d688523f84ad20d0a448e7614dd057276e8
SHA512 453140117bfb396189c350aeb53dbce7ffabdd5a3abec55cf6556da3bac73711fd31c362ccf2f197f38e93a6ea2d1e04ad900206cb07b985f1f44559a3096f07
MD5 SHA1 SHA512

Submit Download

Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Size 1KB
SHA256 40fb8ff2e27c7a0a7def6601e1aeaf5ca28be92a8a9a1f11fe617e44dfe0b71d
MD5 6891f8d59d714dc2fc94e2c1ee745f8b
SHA1 e3dd527a46d99298f615bdda656dfad0cb248217
SHA512 0368474cc562bbd82ffed34708b64e33a410aaf4bb3570bbe5938ddcf3877515b0a7bf263eac11a565e4d3c66b93b8a4cffa64a44b3364d8648bd870d4698abf
MD5 SHA1 SHA512

Submit Download

Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Size 405B
SHA256 a4ed5868040b876fa8ee266d8e1fefd16ea677a3b6e54c88052fb72221b4bd09
MD5 7bf65f583d569c75ffe0e8f36e029bbb
SHA1 26b97f736707ff8782c279c473d250986817f73b
SHA512 49d6d39d1b3c76f4bec14c3d000f292b2e31957767c614faca4061e2190cd9da276b503a6713c3593bdd1e9e3a6b466fdcdd5ee836f18d53ea6dd0525030692e
MD5 SHA1 SHA512

Submit Download

Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Size 409B
SHA256 187d47b9b94742b66c66383864235888f4bcfed301cb449d29a8f3751b1292cf
MD5 5f048d35b45ed88a4832bb9f8c355a6a
SHA1 661b53e73854b42eed4301f10d34082d0a314835
SHA512 1a9c77fb5ab02eb49163626f15887390bb8e4f5e4cd688cae5d2b5907f14639d988ddabf8cbaee4606a86204cc858645115f052644d01d5854069d7229ad4ec2
MD5 SHA1 SHA512

Submit Download

computer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Size 335B
SHA256 9151609e61ca992022582f4e7136aef2311c506ecc7aad8dd45d4936383dd0ee
MD5 0a1d618bf72c46e1cad6fda06017f399
SHA1 efde43dcb8c152472e59f9e3b7635a5391f3cd88
SHA512 c25769b6275f3134159d7d3373d656517ffc050e9edae845bc1668789a8b5527a0813f7317f0be390017b35f7ab755648f6bc64ae0c35f5ccfea7d5607f4fcab
MD5 SHA1 SHA512

Submit Download

Windows PowerShell (x86).lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Size 2KB
SHA256 16f2cf9cef19f43cbc00a987569f5858b6559518ea44d48f3ff0093599290402
MD5 715d1b1d36ec63fff53787ce964f242d
SHA1 e54e9caddd96e9b57647c4331d52563bde3482b0
SHA512 d692804733744baac1d71856727c5efb41f0b1ed8ec1f4c34d4b1ae13d626cb1b45cef7452e7704ef4c2863a5e627150978d344fd8a9057187d0f95b4cb88572
MD5 SHA1 SHA512

Submit Download

Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Size 2KB
SHA256 64020ecac1f213e9a10138591f2cc5f1551dd76f20262839d74b962647fda4cf
MD5 c400d3a855d3382e710caeb5d35b10b1
SHA1 662e105040e929dfc46eb839d5b255de05684f41
SHA512 2915c8efa399bc707051aa7a3e2d9f79800be8a3b1c8ea11f1af9f618b1c85fdfa908c49ccef76a0a081a209dfa7590bdc500bbf4abb2733c4774ea8bc3f8ec1
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 324e43d14ec44dc39a397396e09496fec8201f53ef4f831266c2a50d934dbbab
MD5 abecde2afbccf1b16ae605ff206fe25c
SHA1 262b9e6e4bdb04ef08c91353fdffb1ec48e1cdbe
SHA512 a34cd691c3e339cd80c583e582ffe8ae9d1316c438b5d3fee11df1a20885016bd9ad430ae0b9b962bf7d9ff3a9219de54e48bf83ef25f52a4f10157c21bf886c
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 b576c428b36edc250c16afd06c3da0592ee979dd5ad1f28c48c6d75ba9c39713
MD5 63ef8401443523ecc49ceab749f37d9c
SHA1 1172c814d8b8f19a7fd6f736e0157b15c3050549
SHA512 3d419d7e70a81a3ab11231e5f549991ed625c4eafa4eefae247a2bd029f39b269292a1a363afd707e24f66b7ec0fa1a552b688764f0cb4313c764f043313f53b
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 d2bee2d265e57b10bd7f45bdcf8db0bf6e88134aa0629af3c487bb4fcfe619fa
MD5 4ef0d7651623c2e1c0ac97a0b5a98261
SHA1 0ebc05dd66c20e7497fd3eba11b84d07864bd020
SHA512 528f0bd5f6a974b49428a9010ea2925db4bcd8669bc5339c1062a80929285951e4e689c91818ae910a87d66dd07c4fae9a8fe124effdd452a232e23df9187972
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 3f35d7093dc17d21762fd7f40506031fe2304078c4150ccf6e63d98ef8505785
MD5 7bfa45edfba45818e5b13c792d57dc6d
SHA1 1b1216dec210b7a6a21fa8fdb12960f64a480c38
SHA512 897e58067c9801c60e078e0525f000cb39cb687276027cffccd6e2856f0592687a22128ca826db485ea7125880328bb505b2cea6ae09c061c5f679d4d63ed7c8
MD5 SHA1 SHA512

Submit Download

OneDrive.lnk

Path C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Size 1KB
SHA256 58fe6c2471ccaf6e8b8ef7d4ee5fc02b362775063f9723b3c7c1733c8c769965
MD5 5422651753deaf9cb2285db3726a46d8
SHA1 a2ab93e90c08e4a890732ea6b75da1bbf7978f5e
SHA512 0358268d989a397de6aa42e4de52b75c4d2199cd5cd7a799aca00e7138b3efd915fd2d56ea0d80d1e733b812ced3ce4f169a231fcd08d6faaf4a5d5d789dbf55
MD5 SHA1 SHA512

Submit Download

memory/3968-10607-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3968-10967-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3968-0-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3968-6103-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3968-11296-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3968-11297-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3968-6100-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3968-11302-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads