xorist | d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2f

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2024, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
Size 366KB
Sample241019-d565aavcqe
SHA256 d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2f
MD5 38d9aeda5745ab2d524d8f29628790f0
SHA1 3d971bbc61c99f5cb5a1c8506be5dfba7fa813e7
SHA512 7a11d80b36f5213ac7a9ee7ccf50bcc652750e8a3521382ce40304ed2e4cd1cb20b1932070bd9d176b3d6def43ed109ef6af87b28cea33d26f7e463ee1ddf56b
SSDEEP 6144:3/sNJUbPaYnJ3deKx5kkdsg8jJa/R9QwA0rM7WqMkCGbRQ:3oJU2YJAKxznQl4MpbG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 7 IoCs

resource	yara_rule
behavioral2/memory/4360-6906-0x0000000000400000-0x00000000004BE000-memory.dmp	family_xorist
behavioral2/memory/4360-6897-0x0000000000400000-0x00000000004BE000-memory.dmp	family_xorist
behavioral2/memory/4360-10874-0x0000000000400000-0x00000000004BE000-memory.dmp	family_xorist
behavioral2/memory/4360-11015-0x0000000000400000-0x00000000004BE000-memory.dmp	family_xorist
behavioral2/memory/4360-11302-0x0000000000400000-0x00000000004BE000-memory.dmp	family_xorist
behavioral2/memory/4360-11307-0x0000000000400000-0x00000000004BE000-memory.dmp	family_xorist
behavioral2/memory/4360-11308-0x0000000000400000-0x00000000004BE000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b7q7TsuBvQ3W12G.exe"	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0003\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaus.inf_amd64_f9b71b1d9c8643e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdyna.inf_amd64_d89605b6b478d768\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj7.inf_amd64_161e1375bcff85d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\IME\IMEJP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hal.inf_amd64_fd0ae947345ac7bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmhzel.inf_amd64_e90a0a4c8e15815d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis1u.inf_amd64_64035dd8a7571ba7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\transfercable.inf_amd64_911a60fb265ff111\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdp2.inf_amd64_6550f790ed88c7ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsuprv.inf_amd64_696bb57f8e3bab65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sisraid2.inf_amd64_845e008c32615283\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\000a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Windows\SysWOW64\SecurityAndMaintenance_Error.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\Speech\Engines\TTS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mbtr8897w81x64.inf_amd64_0d8225e7d2696ece\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_hfp_hf.inf_amd64_0c00f8f3a465c9a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netip6.inf_amd64_f29ffcd2b14f21f5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\basicdisplay.inf_amd64_65ab9a260dbf7467\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmarch.inf_amd64_1ae6ea0bf54c0f5c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\LogFiles\WMI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_apo.inf_amd64_a261b6effa32e5a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smrvolume.inf_amd64_1d430c5b72323a1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pmem.inf_amd64_acec109593aed940\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\pt-PT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_proximity.inf_amd64_e42355875c34e406\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_69b5e0c918eab9a6\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\MSDRM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsUpdate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthoob.inf_amd64_c6923052f60677d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\gameport.inf_amd64_edfd5301fe3972d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BranchCache\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_32a9ad23c1ecc42d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vca.inf_amd64_6bbc643de0df118d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wsynth3dvsc.inf_amd64_1a08a3b6cd493e1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\lt-LT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\digitalmediadevice.inf_amd64_5b64b65052c3a32a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ehstortcgdrv.inf_amd64_5cb0c23f45dac01c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidscanner.inf_amd64_b4d877fbd7faf471\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_1a82423cc076e882\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_hidclass.inf_amd64_b37df5bd0922aeef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint4.inf_amd64_0958c7cad3cd6075\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wpdmtphw.inf_amd64_1aae998f86058cec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_b06c3bc32f7db374\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdsi.inf_amd64_0b96cc4cfeb2cbf8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_sdhost.inf_amd64_b71f983cb35bfde3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4360-0-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/4360-6906-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/4360-6897-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/4360-10874-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/4360-11015-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/4360-11302-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/4360-11307-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/4360-11308-0x0000000000400000-0x00000000004BE000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_scale-100.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-100.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\PREVIEW.GIF	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeLargeTile.scale-100.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-64_altform-lightunplated.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_contrast-black.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-400_contrast-black.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-200_contrast-white.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionSmallTile.scale-150.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\sfs_icons.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-200.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-400.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-24.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraLargeTile.contrast-black_scale-125.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-100.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80_altform-lightunplated.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailMediumTile.scale-150.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\159.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-24_contrast-black.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons2x.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-200.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-150_contrast-white.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyCalendarSearch.scale-200.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-250.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookAccount.scale-100.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-black_scale-125.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\Cabinet.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-24.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle_2x.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\cstm_brand_preview.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\THMBNAIL.PNG	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\PREVIEW.GIF	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\RunningLate.scale-64.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-100.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-100.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionSmallTile.scale-400.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-256_altform-unplated_contrast-white.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.contrast-black_scale-125.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Doughboy.scale-250.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSplashScreen.scale-200.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-30_altform-unplated.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..bitsadmin.resources_31bf3856ad364e35_10.0.19041.1_de-de_84c5fe4216b88857\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..ation-net.resources_31bf3856ad364e35_10.0.19041.1_es-es_48e80aba2573bec1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..resources.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_eb3bfc5e06b9201a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-displaymanager_31bf3856ad364e35_10.0.19041.746_none_041cd29ac291b008\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1023_sr-..-rs_b53367e969aca6c8\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..rkmanager.resources_31bf3856ad364e35_10.0.19041.1_de-de_83e9bcf5182642bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\msil_microsoft.security...t.cmdlets.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c85cf3ead6d6cf07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-n..ayingsessionmanager_31bf3856ad364e35_10.0.19041.746_none_6d98aef11474b413\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ecounters.resources_31bf3856ad364e35_10.0.19041.1_de-de_32948cb987c8f5a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-updatepolicy.resources_31bf3856ad364e35_10.0.19041.1_en-us_ad9ca73025205e39\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_netfx-aspnet_appdata_b03f5f7f11d50a3a_10.0.19041.1_none_14471de20d4e0380\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_netvwwanmp.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e7890552881df501\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-quiethours_31bf3856ad364e35_10.0.19041.746_none_86e52a0f94bec6a2\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ativehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_3edcb155b3075f9d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_c_fscopyprotection.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_92fa4602ba8a030e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..dcredentialprovider_31bf3856ad364e35_10.0.19041.1202_none_b6cad1a377c3a8fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..d-experience-smsapi_31bf3856ad364e35_10.0.19041.264_none_d4f5b53485b70669\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_d9afbb23e990d44a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mff1be75b#\4364afb08a160ec916d9ec14a6f5b435\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_dual_c_printer.inf_31bf3856ad364e35_10.0.19041.1_none_ede3ab00d7c856f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mapcontrol-core_31bf3856ad364e35_10.0.19041.1_none_ea6189f30a16ea82\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_c_fsopenfilebackup.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_59776784f0a50001\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..e-diagnostic-module_31bf3856ad364e35_10.0.19041.1_none_aa122dab6697e79c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft.powershel..er.events.resources_31bf3856ad364e35_10.0.19041.1_it-it_800d83f78753358f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\msil_microsoft.virtualiz..ient.6.3.management_31bf3856ad364e35_10.0.19041.1_none_529b8fe30076829b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-msauddecmft_31bf3856ad364e35_10.0.19041.388_none_3e41aaae1523b36b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_halextpl080.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9d7f4d616bbc92f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-strings_31bf3856ad364e35_10.0.19041.1_none_ae731d30ac4be0f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\v4.0_3.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\NearShare.contrast-black_scale-150.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tapiservice_31bf3856ad364e35_10.0.19041.84_none_dadff61413100231\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\x86_wcf-system.identitymodel_b03f5f7f11d50a3a_10.0.19041.1_none_e690fdc7d17e3f70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..cher-tool.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3e725eaf034df533\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rpc-locator.resources_31bf3856ad364e35_10.0.19041.1_de-de_2ba9b4dec372d34f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_fr-fr_c7c95139b0684052\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..ws-minwin.resources_31bf3856ad364e35_10.0.19041.1_it-it_3e8d14a2bb6382ef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.19041.1_lt-lt_2e7afc8b47e76ef3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\SecurityAudf6921413#\679ef210e507dd4acebe324d3d5fd13a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..t-uev-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b00b707900162ce4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..-universal-internal_31bf3856ad364e35_10.0.19041.746_none_662657d58db18195\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..framework.resources_31bf3856ad364e35_10.0.19041.1_it-it_8a6d66f827d999ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..lders-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_8a5f6eef2365dbb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_dual_wdmaudio.inf_31bf3856ad364e35_10.0.19041.746_none_8cc50abfaa861487\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_memory.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_f75d742039639c7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.19041.1_bg-bg_eb8891858577680b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-o..oth-avrcp.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_684b5dda860f767f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..ovidermof.resources_31bf3856ad364e35_10.0.19041.1_it-it_54836742eeb13ca6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\msil_microsoft.security...t.cmdlets.resources_31bf3856ad364e35_10.0.19041.1_en-us_25da2107e3ddc700\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-imapiv2-legacyshim_31bf3856ad364e35_10.0.19041.1_none_f44245466e39475d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_ksfilter.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_30689c886451d2e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-http-api_31bf3856ad364e35_10.0.19041.1110_none_6a7867af5278fb92\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ui-storage_31bf3856ad364e35_10.0.19041.1023_none_7a9db1a007319b1a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_4.0.15805.0_none_4534bcdd53211170\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\http_410.htm	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..layswitch.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ec151d9c079ec226\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-shell32_31bf3856ad364e35_10.0.19041.153_none_4a14997c70d61386\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windowscore-coreglobconfig_31bf3856ad364e35_10.0.19041.746_none_0eb88db7e89945d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\wow64_windows-system-launcher_31bf3856ad364e35_10.0.19041.1151_none_58a7e1ebcc7dcd02\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\404-8.htm	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square71x71Logo.contrast-white_scale-100.png	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..sync-task.resources_31bf3856ad364e35_10.0.19041.1_it-it_0ff4fa8774d4da5b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
File created	C:\Windows\WinSxS\amd64_hyperv-hvsocketapi_31bf3856ad364e35_10.0.19041.546_none_017fe414680118f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GJXEVPQMPNXFJOW	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GJXEVPQMPNXFJOW\DefaultIcon	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GJXEVPQMPNXFJOW\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b7q7TsuBvQ3W12G.exe,0"	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GJXEVPQMPNXFJOW\shell	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GJXEVPQMPNXFJOW\shell\open	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GJXEVPQMPNXFJOW\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b7q7TsuBvQ3W12G.exe"	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.leycoz	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GJXEVPQMPNXFJOW\ = "CRYPTED!"	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GJXEVPQMPNXFJOW\shell\open\command	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.leycoz\ = "GJXEVPQMPNXFJOW"	d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe

C:\Users\Admin\AppData\Local\Temp\d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe
"C:\Users\Admin\AppData\Local\Temp\d7285f6df3d2865b38862767dda78f08d9f8aaa8dedaa975d37fb4a394a27d2fN.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aic_file_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Size 50KB
SHA256 515127088a08427407db5ecc216a7670ec11ed6630d82cb95b5860b895fb5eac
MD5 7fd04ce517bd7943af188effe50dcea6
SHA1 679852f77368b2784a492300509d22c9845cba95
SHA512 3ccb402c43ae5ea3a53154e9d32927d42a478755d5915e6f6ee0e164d9a19ea96e4c9718c9022d3a2c3998be1428b49e884a6a2a02733bcd997e5db06098c70c
SSDEEP 1536:zD+ZwnfcOvGlEhZJbiO1RYOvOkyTZNLI6rWJRZ:mwtvGl2RpPOkyTZNLI6rkRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

selection-actions.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Size 1KB
SHA256 0fc101466c3343e0a74365afb238d8ad477ef4aab4d4cb279134fd59b96940c2
MD5 4b68f43ebb62660360d4cd50bbd7b7b9
SHA1 38500431b08506b7cb37447d4eed7ae2515ad484
SHA512 fcb8d41e0e198beb37323daed64f532d6129642ff62327947c25c1a12e01bc669c09a4477a401657bc6dd20c52bb472b838d3a93fb05fa60cec53f89892a3764
MD5 SHA1 SHA512

Submit Download

selection-actions2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Size 3KB
SHA256 d88a80177770bab555f98b7aaee5a2a229203df771bdd9533586dc1c89752034
MD5 364c45dbeaae5eb5c9909564b18f63b3
SHA1 0f9d5aca18915f11008d9b3b22afeb2bf8203f7c
SHA512 5ce6761a1079802a8d10c612429dfa7d4d8a7a229359ca7d40d27b57771cafc4996e939640162e91ab5cef9cefad6d9cfd7651b63205d22df2c5fca88451ec86
MD5 SHA1 SHA512

Submit Download

example_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Size 683B
SHA256 c7191372821b3f2b7d8da401250068e3dd98f701372be9597f2b204154d9ba7e
MD5 72eccd93cfc1aab518102b92b50f170c
SHA1 bf0afed61789f971b7671acb366269528c7d7244
SHA512 7d032b29b20f7534e8b71ee782425190c544cac7995b0208b78077f474bb9b7905d479d8f5be1397e5cd9ef26dd42af24a4f1363a2fe50136f23730548be6166
MD5 SHA1 SHA512

Submit Download

example_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Size 1KB
SHA256 7c23a4e1ee1654f2998fa83583f6af4dfa2db913e2ad29450e360372b8343451
MD5 54258f820bbd49ac555911027d780021
SHA1 9a7edfd1919b177a827ea035e92b6d3ed1feba19
SHA512 c7674c438cc334055e082d4b7a9aa71b5b65f06568e1d42830809c126e9be69a967ea1fcd1183311fe6e8e3106c0348154200022e3cdd1c35ac2605d555cdf88
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Size 445B
SHA256 86726777e3b10b3fba881db6eafe4e45046f7040494445667000972596f160df
MD5 d473a853fde41db2dae6b5d499d1fc3a
SHA1 c66b5bd1c0b64fd72f19462bafe1edbe712158ee
SHA512 07e6f9e2b585cbb61662c91b038c29c04ac634561587d92bec7d9e1122195e6c468b7dd0ae19e884260500438787e829095d8e41cd8b20f80898277b2f6d42c2
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Size 611B
SHA256 7895b212da1f365efe97850cfa19f487b9b9371df144f502577e771dd2c5571d
MD5 8b2a93ae028dcb123f99e375088f1858
SHA1 2541952c331bb49d55fe84c67a8b78180d4da9ee
SHA512 75d84c22a98e2b2d35d23edb3c70295bf45a72f7095892e46862fad6e7456a22b3a40c04c75d550e1d3356fde547d90ef0303870acaa80dc29dd885e265a0e82
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Size 388B
SHA256 22f0092aed231b3ce89539ec00901ad805e93ce535b624b2c44a47c02c8bac3e
MD5 32f20d9bd7c825756b89898ed5549c4e
SHA1 b510feffab77a07435ef25de7a4a15a2f8820102
SHA512 caa787167ccae15f9b66fda948d6b45d9429d8caa6235d82af873c4a37d90bf17bef277beb4d6680d6706123d1d0c141b7b6959165c44e067139a2cd54fb22fe
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Size 552B
SHA256 b7b3065303e7c932ed7fa260f7c0055743a37c06c1f4325d8e62d5ddfd652fec
MD5 936e6a72c86edfd822ef52760bf2dc71
SHA1 6421f85eb4835eb28063c9313f11c8d84f5207fc
SHA512 6ca096c98c6945b8c3dc752f8085555e70f332d4dbddce6064af34d6753c3197e578750f23fb163f8f701a061e1c3dca579301513071528189aeb386f563a9cb
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Size 388B
SHA256 ba03e80aa8448deb091610df5b7ac3c872a4c70c541fbc7d58aa926865ccb016
MD5 01aa439998084bc198e4e30b8eeb7bcc
SHA1 90d1a1f5f4255bd8a0c9469751b695b7ce0821e9
SHA512 6a1e237cb44c9f1e79214e263f62722e247954c37c4d19b9f88a4325eaea718c4df57915302144b603e7e24fa8464b5d5f8c7987709399521113acf5d1e834a7
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Size 552B
SHA256 786613aa51f257903b1e66cece5732541aad77a862d53217f3ecfffee4b69e97
MD5 87b6ac82d93dadf13f82e01a9b6f86fd
SHA1 b39702ffa85c7382b6bfafec0396b9b43d6f520b
SHA512 f5ef8f6f8a21a7e02c3afd6e8f26dc17d37cb5d8d2ca0dcb8f8545524521765e792c9a3d8a4d2552943137d390fbe7b8b2df75d4aca3e4318c5d9e21934da535
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Size 388B
SHA256 08d04c32bb375e11c283032c842847ba2ed3b835dcf6d274b807bf4a1c4ec69d
MD5 aa162d6ac90ceb744840cd0e7660ea94
SHA1 bb03403dfe06c705fec0289e720adda2df59bc63
SHA512 5b655b7b4aafa1b8facb4b06d70ffa43125e498c636f07c653cc89c3efb0970907a4a538e6e612fd26dce37c64f8e0cae638dd917e44ad668580481d41434fe2
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Size 552B
SHA256 0ab098936435752743f99f8e5e00abae18220b7c2e7a3a8b8ee0d3c376148311
MD5 abc73fd1739294541a0eedbda1947fbd
SHA1 d76bf01d40e7f3e9d94b421c63fa0627b3f020b6
SHA512 9b6eec9b04cd15f311eb96649abe17360ec5889f09703fef659d1b5f37a52690253618018924d12b927b302cca0740c0c9cc769a5498a3b6e11c329b056fc398
MD5 SHA1 SHA512

Submit Download

icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Size 7KB
SHA256 4c593f3a32b408ddf9191a65c457b7f39d563e5f03261268af697dba1a976d9c
MD5 ed5d7983fc4d34d0a7cef5b165b5d162
SHA1 e97922aad5832c4e2a56f1c0a2faecc501db0bad
SHA512 a64d6895d1b6bfac27ae4e1ccf6e4f53d0743fb6576cf2e4b03a3a4e819079ca85a77aa2ed27bbb9e8a489ce299081569e8d85d80e247e4c460606f7779ba7e0
SSDEEP 96:IT3RKLNPWoXmxp5+uYZKrlLiHDDvatzLTmjUXlLnXaQuZC8yYvC7kjCEKeZd6a3R:IoZPW/pTFC3axTYyLEQ8yoCja3GfyIlq
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_ie8.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Size 7KB
SHA256 407a9503f536e73c45c7e4fe1557a215c929fe8911084fb548cb1950bdb18a81
MD5 18f836967aaca967cbc52c2f12c800a3
SHA1 8d1570a0a0e2c6e2c10d35e1680db831dd7d35b8
SHA512 8ba5043f52092d1469fa49e85fdd1bfbafc290114e5deb88e0e7091e1d4d2d4e3dd23f2fb507d6117b8a5504a6e19b43da1df5518e3e8bb8df3d2f5bbbbedf49
SSDEEP 192:0VRgQ+OyMFPeXfd/UbdHk1czalfIVWYzTinYJKl9jwwW5V1S3OEe9K33h4:JQ3sFgEealfHYPdc9jiSfeeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Size 15KB
SHA256 3656f3d18c30fd33faa2b107f6e4e4c39722173d30910ee52249eca769d8bb8f
MD5 5ab57d9ce3d0436de22362b8d1a55266
SHA1 a50660dd6ba0d12865cd932b9dceae4005fd24c7
SHA512 1cc778aacb1c206ab0d5e16f7c6305ebfbb29db606109351f3f43c1093eaad215973b7369bfed98bcc1644e51a2c480c4643f52812e76fa751c71277ffe94e66
SSDEEP 384:sg09Cr9fWMicoP50ADzKNC14QgZ7d69mgpdE7ho/N:dXJ4zIK3gZSmBhW
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Size 8KB
SHA256 817555d679b07136b710abdff23cc7555c0b198b2db9a71bfe7072d8d7aa72fd
MD5 209ac3e693c7964b4e5354a92750419c
SHA1 9c1a5f0e482c012f376fcbe854e6fdd018379311
SHA512 49a7e33f370bd4964ff31afd8bcd4fca4d223808c0d257ec4c1abbfd4e4b29ab15f8c9f6a3cabfb53811c9a029a8f4b65ce8d002584a58d432fa478e9884f6d9
SSDEEP 192:csV+ca8XXXXXXXK7vnk1tugCzPAYhc0Q9U9Ubug7kZeQ5:hfa1TgpCzPAVbi9Oug7kH
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Size 17KB
SHA256 90d3291b3bc220612a5c05bd96b1145d507de6321ab71fad2f6ce2bef8545db9
MD5 8461ba2149268806ac1e74e361f739d4
SHA1 c089f911e68014b0572d2b854922427e3e8cb30a
SHA512 215b27a66899f0af64497c9556c293149c4e7b61f578ce2cd3ab0a823e26d47295e4a69c72dbef94a1bc53a52fb2b39903643247cf935e3da5de32094b8e55b1
SSDEEP 384:arbTRUWv8pKyWIC8bAr+u3iYekRVAjwPvrgF8j6zBkgRcshZB:arnkdWOuhHRVnvMFPzkm
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_pattern_RHP.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Size 179B
SHA256 23919a17bcc4f7fe0af9716ce4b91cbc6d492a29807be0bf54a51ea1ced2e01c
MD5 34fa8eb96861dbd949d777de1149d989
SHA1 69c0d16c05a21d2afda95f4fa1774c13da8c6591
SHA512 86bc67e9c2b8442ff3c82b331d0b61fab2acc80531e6ce30b98db50542e5859a3f96a2426b10deb5b84199b653f5a6f899bd942a8251c772fede78e1c0c02d30
MD5 SHA1 SHA512

Submit Download

bg_patterns_header.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Size 703B
SHA256 78a81efbecf006febeee6603385e6cc18c122d49cd9c40770e7df2c748adc3e4
MD5 8866f1e0855ffa593c2090789b9592fb
SHA1 4181895744a7b441d2d93bdac8d46feb211f71a0
SHA512 d67f284c3063a266158108710a394b743f93a59b7294a1ebb7f06f4cf017eb9e72fdeb3a7fa84c8623c3d3666379eca826247de0869c22af98d3de6856afde05
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Size 8KB
SHA256 ab9a94c3ebb9ef72633de39916290de822a3ff36bce1f3fac65d986edac6b929
MD5 21661972b3f97be550443aeea4bc88bb
SHA1 02cea3114bcda92584d3cfd97532d11a7cabdf27
SHA512 ab989ea11aec7bb85a94fb77b513c24eefb44be009cfb43f2474f58152aafea8db0b3b04a49bfc9d95a17c9b5c1fa30f872ff8355f2dac19b710ce88df9ab958
SSDEEP 192:l4jbYQPhCcXnaHWYVtNpn2KVFUmll89Ozv0nNik9CoTWyKwUsb:lrQ5LaHnn2KVFAx9CCgwD
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Size 19KB
SHA256 3fa6704013c9582c93ed5ce6ccc1eb3ca3604af129cf869250dcde0d2f8481ce
MD5 e0c1da56c834aab6dfd88b63d3b2fcfc
SHA1 32ea4c7d31892d4ae0af119e3f850ee1b6f10382
SHA512 96a6d2123ddcdbf79a9efc31d4e2c9295b9b180c684913374586500e38827d84127f62a5e5db0ba9d9b28a54aec7a45f737128721b68da6c14271410ac87b558
SSDEEP 384:zR5CEfVjfVOlotAjYcH8vGFPAdaDJeUWlzhWQV3ghoE42:zRlfVjfUotAbHIGFIdaDIPAQWt
MD5 SHA1 SHA512 SSDEEP

Submit Download

faf_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Size 6KB
SHA256 da919094fbdcf2f71a09213b80a869d215f2c372764c61097dcf58f02d977b32
MD5 988c0147a9bf1e60ba48d380f46dc88c
SHA1 5f21fc234143919c0c18715bb6c9f1bee3d1dbdc
SHA512 fb6d2e7804ddf3e9ed008ccbcc87c2b2084df5c6ba9f18b01784e530f945d1f72c4f968c6c170876a26ee2f46a83063d2b18eacda5f31cb1385feb396832ccd2
SSDEEP 96:SPtYP/ntgWKI5rS2uKObIfZ5HNU3bsfbQuxMr8lgICwAFGCeo8eNknd:Ms/e+dB31D9CBIlALeqkd
MD5 SHA1 SHA512 SSDEEP

Submit Download

bun.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Size 2KB
SHA256 70b8ed50a7212bead23cd8957a3eefd667019ed102fb1aa3e03b96f010abad0d
MD5 9b5b6ce85234e422041535114f051945
SHA1 73dd248a172fb24248c8207fe554bbed63ad71d3
SHA512 7b46fe561bf54dd4b9663eb6ae1605cb99f02681578aa2d69da3c4ee3c86c43f9f305473a18301e8bef6276f54bfee75068463bd4a8abaf2aae68e7d1b6b5b37
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Size 2KB
SHA256 814565a09a975b92bd8eeb8017ae2fd33d41f50d6e004859982e7cbedea22108
MD5 55e9f865de9393d01e97cdab045bb8fc
SHA1 929ee5f82b6e6c3f9336e4715ddf83c0f5040a42
SHA512 240630e5b0a27acb07f216cd599140c96c246e6642d5254330e762f89f82d33175e2e23fb726f9577614571ee1c162737b28390f155d66f5d89766c491e0e239
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Size 4KB
SHA256 d03ea2fe40fdaf7470fa1fbf01052de2c7673b04db1618e1787565a802fea00a
MD5 c00327d8356bf46632779b163d3e61f4
SHA1 320046e9bbf75d14c18e35d19d6237496de86068
SHA512 72e8d8ed8c0cd4f5d908aaadaacc5c14ac7c8484fa70c58a391744766f90be5f1e000ec1faf2a98606745b64e6d52137db374ec101027f2b2fc95b87e6debb80
SSDEEP 96:vBdg8E4ZRjMI3Cu317/qRsU1SULv9Iwf4VzVB:Hg85nYI93R/qt1pFIwfW7
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_arrow_small.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Size 289B
SHA256 1064f76369903984a89ff735fc76252d3330311ea72bef0dc03e0ffced33992b
MD5 f509ef34cac1e01b03dc709c0e14e207
SHA1 3e89fec86852cea944915f732b3970cf887be9be
SHA512 7cb07c6179f285d7cdd9a321e399a3bb8bbe6f17c893dd7aaf21d09f3b10efa551d0c02f4678902c8ca7d11a158859098c74cdd6589a41b8c4dd251d2e6e4674
MD5 SHA1 SHA512

Submit Download

dd_arrow_small2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Size 385B
SHA256 5160c552f9605e44503823efa76d400abdfc96ded48958539bf003bc6adcad6b
MD5 fa6952d1f7b82a6127c2c5caef5c9f49
SHA1 0eb97b07c8fd9e930a5422e7736d3bc47e0f59eb
SHA512 7d38fb35991aeab6d0a7859457dca7df364541417bba2d7290855ba265959fe5afd5ca4e3fe410c2159ea06cafd5724c51903651f016a792370bd5f108467672
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Size 4KB
SHA256 329e6b1ba5b36fcfe7f0687a1fcb0ad55c83d0af2ddfdbc3ef7be7cb349e3cfd
MD5 21db025f89830b3e6569c9f28595bc73
SHA1 8ec6ebcfab578be4326657a94aa6a41e394741fd
SHA512 1697ff29603d72cfa0dce012c2ed312a3b691f3671d1523cbb2f81aa0fa7817229038011d289878a68242fb5a46bfc7d1541869c25462a2b6985d97de72680f1
SSDEEP 96:fM/ncO4AB7z9K6IjQsa6KX5LtsYbYqRFIUuyM52Nw:k/ncO4Zd6/Y/LyM52C
MD5 SHA1 SHA512 SSDEEP

Submit Download

nub.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Size 1003B
SHA256 1ad872e2acb7bdb601a9e345126a08a1ae5bb8a7bda6d0a3893694038fa1fbad
MD5 1a9b9cb8dc1641f340dd75325a003800
SHA1 2965310e41909c8bdf66a4cfc0fe142f175158e3
SHA512 ecb3a88f2f93e2dd8062518d377ea7c3dc744e651610bf8ff1486a134394976330a3b4fd6d9cbcbc0b9a924710c1445302de7c202e69e6bb3785661b2df0793a
MD5 SHA1 SHA512

Submit Download

share_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Size 1KB
SHA256 dea51dc20927b4f9e4019a39112b1e612b7f1b63be935251780ef366065c046d
MD5 76389c9ebb4adfb72ae8874e0f1264cf
SHA1 60347b664c9249d3d9597a77f364b14cb30231fe
SHA512 d2e359e4c670c56b4d96e35d3bc9585451b17a7c5b405207013845f5f799810b1428e3d584dae304dd13015c13fa3b6eb34779b97a0c7ce1b58fead6d4d88710
MD5 SHA1 SHA512

Submit Download

share_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Size 2KB
SHA256 194a37d7ea7ef49dee8ec545cf03ad0de110f985a02d959fc24d3afe2baac5b6
MD5 2a206f4c65ab3cb352cbfc6480534650
SHA1 7af781cf43e737ec5769d135ffc55490e9f7e7e3
SHA512 0d9134d11a385a83902a0ee05e526c5fdc417a04bab8a269c59da2e91a3554855de6aaf0592396ead139625c48cfed65104115d6a98590d03e368d28ca7da1d1
MD5 SHA1 SHA512

Submit Download

adc_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Size 3KB
SHA256 4f261c4018a8bcb7e17a7c741a79db08f660b245e998f493b76349b29711737f
MD5 8ff1ba69c403e56a179204eed3b290ac
SHA1 0b0bbfb8d34ebd43606cc4b0df3d23c051b1f24f
SHA512 542d2b0c17f9691dd9a5d662bb22af2f7f9811874b4b2dcf922e172d90ec3d40d23d659160c4e8a8c266c86e20b2fec64711b4bd0eeea457e39d550ea991d9a9
MD5 SHA1 SHA512

Submit Download

adobe_spinner.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Size 556B
SHA256 da2835be214a7e817a8e57e7c9fae889a072b31e2558171f69014bfd3082e9ed
MD5 a3e60d76e1441f908603c8637983f358
SHA1 8a68edc8dfbd44e6c97ba9a0562fc7dcd64f441f
SHA512 56d70c9497cd217ef848739e1fd0a6f710d13799d354b214d6fe0c865de9f9c879bee46ed001a997becf1355dd2ba49ec00370fbffee89c4cfe264f610775c68
MD5 SHA1 SHA512

Submit Download

logo_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Size 6KB
SHA256 6af465dc3559ae36fd59bc5cb02c841ca8835cdcb632fc3de5c4a20cf30736c6
MD5 a2cc2d060d08630835113c1d895c4e83
SHA1 5066af214311bb3c0f7277b4a8da31ec9c5909fb
SHA512 cc1fc97a809431b6b0b2fb3f65aa7b6fabfd3e23970863fd90f1ee65bdf7bad2a603704e273561d2525761079e1b7d4ce1157898c484f4838608eef8048d89d0
SSDEEP 192:cEPxrHUE8Z7D+/5BHMdmKR9TRO0LdmkB5WI/:zryexBHMdFpdmY
MD5 SHA1 SHA512 SSDEEP

Submit Download

sat_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Size 826B
SHA256 d1dbd58394b283585e8e9ae80f0b33afe2d9c10cd07e563fc7748c0648222023
MD5 c19f7df8637d15bf5a18001626f006a4
SHA1 fdcca7f96e38f0f22d4a2d79f5eecdd2ea53441d
SHA512 f0b4737eed2c5dddf99e7365fed05c49c9aa6877a1811ca32cd084d4eab159352a605f9d61d6a393ce42ff0ce341001a4f38d64cbc77e30874af6a86739f9937
MD5 SHA1 SHA512

Submit Download

sat_logo_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Size 1KB
SHA256 9244c4288edd411f257ed38ac959becc4dfde85848f8cd984fb4d33c0d1ea8e2
MD5 bbf841622ee77dc7cc3227a136723fbe
SHA1 2b5ef452769e22c5156e9c64c4923de92f50515e
SHA512 e338f8e7e27679a93b4a4fb22a1e1593684a89aaeb2c5c62a88fd08a2e554a575953bfb9960167862b525101d0920cc1ec4a6ee1d6372259382b9c6379f1bdd0
MD5 SHA1 SHA512

Submit Download

DisplayLanguageNames.en_GB_EURO.txt

Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Size 32KB
SHA256 b94dafe6e4a670b2cdbb4f6498f16c91e75b09447fed025302e72eda8941f6a7
MD5 c1e3343ea0fb95f910e134e8f2339ce1
SHA1 7c0e451d937dcbe53f40832d6f4697cccba59dab
SHA512 47c255a946cf02b22165f094672326ce161b8c732083060397a7295d28183f6ce672f5435663d116848be1f969f37a4d88b41eee83ad3434e9ac43e0bdc49045
SSDEEP 768:e8Nm2APx6gEAnh0X7ftxqGfvM/xf0RbURuEjvOmwsFl+Uzovs9BKTLVbKtZtPzgk:w+pjliJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Path C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt
Size 422B
SHA256 3cadf5cca10ae2f3ccb227c09be5d789f1aaadb0ec471f9ad60ea511c158a471
MD5 1ee5052508eaf02a5fcf6c574a83d175
SHA1 29bda576d6c06f8f6031df7cfc56b5df6c42dddd
SHA512 c28455f45ab22b02406f347c725d6df5167c54a58bbe11369ab7bb84dd677b393e9f9fbd2565cdbace4d7f6a54716cb88f936ed058b65f9060cda9cb96424f89
MD5 SHA1 SHA512

Submit Download

win32_MoveNoDrop32x32.gif

Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
Size 153B
SHA256 daaa944809817e7c5ef6f218a14663698715b984c07a6a3ac7d5ab5bbf479ee0
MD5 190a4d6dfbec070570623d62a05c7ced
SHA1 5c8cbf4a27375e75b5715ec5587288a97d78a2d6
SHA512 fd2e60d417e5e19a48d22660db497900891bd3bf9b41ded5bf917b03d64ada3b32c239405be3804e328356fdba32a841424c04673d059473fe33135cfcd5da83
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 190B
SHA256 36451d15904f6042d09727778af8e9bbb5fa01cafd9e74088c6a004c02c578c3
MD5 44806d00fe4206213a711e9b8325a351
SHA1 ee7e1355fea1b0e8fdd1f3d173a5e857738eab52
SHA512 741347f88375cee534a073929942c3118920b35158c242be6a92b3f9a1b75c32855da465603a38755a9278a195eb6ce6650667d93246878cc4484811821987de
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 190B
SHA256 8b8f55a391b286450688f8cad4ff0bcab6d5c9f1563230e01172991bb7380f36
MD5 60715b862df2218d12c536862263c928
SHA1 f4b79a501f2ede7496cb801a19c8792dcdcde7a8
SHA512 bcb11b1388f24d1359692117193aa9b8bb15a60cd47b3eb3dc322cabee58e768e73360cd317c9119073237d9d44fc1cac9160e58722494f85445f2e23e27030a
MD5 SHA1 SHA512

Submit Download

directshow.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
Size 1KB
SHA256 86b2604f7b1bbe39ad86f4430704a9c0c75120cbb14577d70bc04c9ee9142df9
MD5 25b4898ee8cb4ccc2b08615b21bc3457
SHA1 3f305f8e2b7f088446c7dda9741206ba8c46c7ad
SHA512 9f6882850bee902f7534a2f4d9604c477b4c1fd2c324493d1acf4d4320362857a8e990487fb919b8b2c6bd2303ab110e9210f4f8cf389c2b26ae3873db993df9
MD5 SHA1 SHA512

Submit Download

glib.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
Size 31KB
SHA256 432e2635a7b7c7aff8e4380729f335ad627bdaace88b69ee21a0d439870b534d
MD5 ab0201ecf15512e92347962d12dc0b0f
SHA1 e10c20e0fb5425d2fe989e52e641a3f1e8fb42ef
SHA512 0e4bdaaf40f59d7490cfd5f7e65b53c42adf80ca6a260adf9e1a7d0b75397ee5243dd3566b2b91e0033bf6bb9a1c2c93532c2eb01cd839f406ccde873ae2c406
SSDEEP 768:qQBuWMimxUbYhbsvQJYxZ740GtNnazKnEh:qQBuLijbYhbgQJYxLZzqEh
MD5 SHA1 SHA512 SSDEEP

Submit Download

gstreamer.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
Size 34KB
SHA256 fb267455e0f166c8275f12119283ac0a91a2cfca7fc73f32082d083facecdb80
MD5 34cf301703656c0b1caace668555f692
SHA1 1692262f37db47eb719d1819f184dbf3c23b132d
SHA512 9d9cef0705f274ef5190c075fef170da1bf6deb475e9f40d45cafa11254a507c7fde6747e842425aca578698959bcb677322782f3165ba0d6a808752c0f14a4c
SSDEEP 768:gbeABuWMimxUbYhbsvQJYxZ740GtNnazKtK:YbBuLijbYhbgQJYxLZzsK
MD5 SHA1 SHA512 SSDEEP

Submit Download

icu_web.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
Size 23KB
SHA256 dd4e187bdf7ab4c9102ce05186262b9d14effb0ec88520ddf1f50b0009b65bbc
MD5 feeb7afb8e2e5cab86b59e9693516a08
SHA1 3905bdc7cf362955565af38f3304454e72ccc7f1
SHA512 a5aca4df0b5b74bf6de1edbba395b3dab076f4b184427ff13a832d3701907f4808267f6fb620ec69c9cdb132249a2311bdcf24c128f6acecb3169cb65cf40917
SSDEEP 384:IQ7e3AophiXTtPYxbKtuKju+zlAjW6tkIQuZpQc/oxE/VLH87j99TIyvrKDgTZ:v7e3WKxO9ju+zOS66+ZpQMox+VL8fbvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpeg_fx.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
Size 2KB
SHA256 987949ebb7795faed52ad905227ce02ca6d7aab52cd148b3766fa043592ab497
MD5 7d8b81400645c29b047bdf4519f2e310
SHA1 a94cbc69b57837f0ff94d877e9f1e7f94e790dfe
SHA512 f9afb13586fde97057f642db6c9403424c235a13790ba3efd3e7c8f28bdff6537b89c567b51ab4be9bd9191bad0ed8e085bf6cd8f0830392602a6db7de0937cc
MD5 SHA1 SHA512

Submit Download

libffi.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
Size 1KB
SHA256 ea61a43f556b6e2992305b02dcae2244ba538b4631d624641c6cfed20e2e63cf
MD5 e297e0d6ed974633224eed4c2587efbb
SHA1 6beec1dcff3416a19672d5553f61ae222d93e405
SHA512 0cfc63f6af417d96dd26bcd67e36920b83df6ff7834b2675b4c6ef83a1514a69a1f20d5aab97d43a26467d4c6817b5d1bebfc734419c09f9862e8f09253c01f6
MD5 SHA1 SHA512

Submit Download

libxml2.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
Size 3KB
SHA256 8c1f5a82c59673b38b9e6443881bf707b313e687d326f39abcb29fe12596b5a8
MD5 f7053b553a0db85d94f43ee7d97c6883
SHA1 82c4daf100ca3a54d0cf35241e5e147c8eca5cd3
SHA512 8b23ab55a699e7fcc652cc393be09f03e2691cb74c6d670756816d3bcfe9b4e36a7a5bffe36d3423833689c50e286f555156d066289a3b81ca5a338483015055
MD5 SHA1 SHA512

Submit Download

libxslt.md.leycoz

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.leycoz
Size 2KB
SHA256 1df5021cd8b724569805a9102daeb2b6fe7aa193ca1cc55814c3d309a9a19c83
MD5 dfec802308ebf1c8d33ac6431e19a3ea
SHA1 9aae1ce4858807f66b6e9f4b830524b2b5882ebf
SHA512 40f0d44ca113636683b7367d8b299fc3ee3844c7d651bb15b72adc3185a70993c8a2f273558f4652ddd6b2929ec74832dfbf20c124766fe848b2b7b06e948081
MD5 SHA1 SHA512

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
Size 5KB
SHA256 88ea9c7ade77fc0640e0b8d51c2b78fed5908b632c285e2a24725c6b99d5be1f
MD5 ef139168d151d9f9106afd6ccf15da88
SHA1 16a8bbd4d96091ece7124efc191e9b74e40491bc
SHA512 5bbb83b9d48ec408a5a762896a54c2f96a919be9da5b7d6a451fa54b37b84036acfef796cbf1fab5e0c36860fcd7e154fd7879c0890892813cb5eb8e73a5b897
SSDEEP 96:Kg+i8eu8pVquSQVxVqsXRySea0mrZUOn0C6mklD9Mo9yjPdFAR9mnln:j+Leu8p84qsXRnefmTn0bmklSo9BTmln
MD5 SHA1 SHA512 SSDEEP

Submit Download

public_suffix.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
Size 17KB
SHA256 b5efeccb0052043b91b32f9cef94e1a5d4a5eafcc69b4b8ef31e2172fd68a2bf
MD5 eb3be1261fbcb707568f8dce93fe4f7c
SHA1 89cf098abfe3f5203c51bf30d93248d5df469f00
SHA512 70e0513a0af2b69c8046bd6b046d13199591b252ccd811b3394d068cb65e1f5bdad3173fc82c8991bfea69320cc6f9218e585c547327ae80d30c9581a222fa7a
SSDEEP 384:gwA462ThK5W+aqs905jdV5pgzyH2fKW+wYoRA7ihWVTtmc9v:gwActP+Bs96kOWfKT84oWVTF
MD5 SHA1 SHA512 SSDEEP

Submit Download

webkit.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
Size 320KB
SHA256 60562c5488c7b90d2fe668ea9b8268e4a98a4b5d36f040fb28b60ed7c550dd68
MD5 f78fe70eb3ce46192e0c4bb3c5d98e05
SHA1 0149647e37f821c07f7516b0f5212cc3ef52dfbb
SHA512 19ce6d9a2d0af08027bad60a9df994924d650a20575f62d887ffe1d41f0c5eaeefc561f84989efdd5b766b3c4c9fea6c0c75ca8dd6327fc417f0876ae3a334e7
SSDEEP 6144:t7phFwvXBbxjy9KPCZ4UlloZpu+K19O59X5Bl1lA9HgT9ukM79Dl8sYTh3eZSPlN:R/FkXBVjy9KPCZ1lloZpu+K19O59X5Bz
MD5 SHA1 SHA512 SSDEEP

Submit Download

asm.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
Size 1KB
SHA256 36c690004e0db4d25aba9a4a74d84f29e88736ec1d4571e6642ec85d83628b46
MD5 b75bb7a39a76a30648a1ff3245b23fcb
SHA1 301ae0ee24968a3f516a3aea9c8dcf018ae2d588
SHA512 100ce308387c2c6984f8ca3e44db757c1aeac3538898497b22983378049eb78e572ceaf368eb522f7456f2909834b7c6f82dbe40d34e996619177f1d7314ae62
MD5 SHA1 SHA512

Submit Download

bcel.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
Size 10KB
SHA256 0324cbe05ad0fc8ca469429e7d3bf82c1fb627f6ae71f303c69c9d544dee5b0d
MD5 be445c6a8d302edf36aa981d82df1b45
SHA1 422484f3e514d7e913c87a12dd9b2ea02911090d
SHA512 9f21d055de001d3390682807ec25f48b050e66c602a00bc6b53290fd6d2ceb95c66968353ac4b1d13b3637e53ad284cac0eb09d546ed7229a48fd6987c9dcf1c
SSDEEP 192:MVw/eAlTI74a7AcLYae9FHiAx2WsJ8ze2QcaJ5MLHKNfZzhXUIe3t0dDpESyWwam:JeABatQj4HJ8S2QcE5ML4fNhkzusak1
MD5 SHA1 SHA512 SSDEEP

Submit Download

cldr.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
Size 3KB
SHA256 0c0a13dce4b2510672efc9a1b68d7a4d86d0c6bf1052dee04f052c2445c9fe97
MD5 bb43c481aff6ca0dabcffe32f247d413
SHA1 a671e6c5bf56badabae84757db862e878c14d0f8
SHA512 64342f46a22cfa7bd72928f3b5ee2c310af792e79ae99ca00a1e39d8b37bfebd69ff3751be59699358641770a518a25188c6257c2eb5b2d6042db68ff72419a9
MD5 SHA1 SHA512

Submit Download

colorimaging.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
Size 162B
SHA256 03820ea865ac52daf4e7048e344f88a4804632f2fa2ce3cf99fd0165a038cfb4
MD5 2f8820644aead551d1827640b55c7ae8
SHA1 3cc58d9da12988d9cc78473f1001fffa233aed2a
SHA512 6f99f3c9d282ec0e80e09ebaf08bc0f6ecdd93b34f07f1e62a2ab46bf5e3609efe541382e8ce65cce9cf369b670830eabae3fc46ffa47fa0f548b3140053888a
MD5 SHA1 SHA512

Submit Download

cryptix.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
Size 1KB
SHA256 f01b31f0926b5ebb52d9ae2a929717dbfe4f7cc2d62e153668e27cbfbc9a56f9
MD5 893595374166913093323da602f704da
SHA1 163e73a6b21fe0e65384f8fedbc5bc738f10cf03
SHA512 0ec20a91c06ce9b54b413fce3991047dd298e6593cb4a866c2b5e217eac8b99bf57e158c6dbd10ef1e18b840c266610a6d8100cda94ac84d4da070f29d10f18f
MD5 SHA1 SHA512

Submit Download

dom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
Size 3KB
SHA256 59aac938f89672e8f7f10a551c4f3238a9558e3a161c69667be2213aa1dae728
MD5 fb042410ef1ac8502d42a28d62cb0dc1
SHA1 ada63d5289561908591a80c02e36f9b4a5649f2c
SHA512 b4a7d393351e44f51c58f994db691114157a0cc09ea069594cb974fdc4c8c09d1691bc51140328ade53d7a696c91cd3eda8be621b20941fe09556110e0d9b4f1
MD5 SHA1 SHA512

Submit Download

dynalink.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
Size 1KB
SHA256 1ef343b14a0d53b27733e7567e59227065cbaeaf3585aa65171901023cac96d1
MD5 869b13a54d398caaab35f014cb4ab366
SHA1 42012e38cc4acfa16babe7bbe2f3af59c6350d37
SHA512 9568568db5fceb1ad977053aba424e1a5b46542847516d92bc009790fb6db4b89f31ae6053392ba472ca653e4e6944cc18895d0dd5b3d5e9c524a14c7dc049ab
MD5 SHA1 SHA512

Submit Download

ecc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
Size 28KB
SHA256 aa1cb720a2972921afb8d832197f2268d2621795e21c192cf11af010ea8b28bf
MD5 ad92e58aef99448724f93bb774a8a34c
SHA1 c30f44c3bb681c1e7a7b7a4f7080c86af5dda88f
SHA512 5a7b9761c5a85e9385c9b944d69a91305d052d07d3db74cf297ed714cfefb971b8cac1e4035c0abca85ecc65e3295a5af0c97828a109542316ad9e18e2231802
SSDEEP 768:3LO9QYJzCq5tR0pQbsEQPrcD+oN0vD7R3eljmCO:bGQYBCg/0uQdBoNC4/O
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebxml.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
Size 2KB
SHA256 873473628c689ea278b60fe24d1de7788c379cb1cb6279b4c789deb9af095765
MD5 c158712d4fe7ee6063381b1f378cafe0
SHA1 3a2eba692e7d63569f5422b403fd5074bb8089ca
SHA512 037665e529888ded4aed7133023e84429e6594ee67d69ef5a8cd06e57a4be277da1c02f7131eae902eba2f8ae6311ea36ef624bce27229bb5ad09413cc080331
MD5 SHA1 SHA512

Submit Download

giflib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
Size 1KB
SHA256 eb033d1e418c163edf045cbe751274519c14b254abe225534bba854b519cd992
MD5 291194c499bac4d3f29b11b80e8f2e2b
SHA1 912e82d7e720908badeb275b9b40688d8b9377f9
SHA512 6b58bf7403ce22e99c811cd33b870d824248b9e05d577a6f74309449c3a50d3aafd6915728ad9bf796cc986764e6416223cb5df8ab9a314f2f5b58c941a7983f
MD5 SHA1 SHA512

Submit Download

icu.md.leycoz

Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.leycoz
Size 2KB
SHA256 a9281dc1d5839bacf5cfc601d2b1067c5360b8632cceb6b70d059ac38a2f6eda
MD5 45bb129ff78e4b5380f96c8106f7cf3c
SHA1 e4a62f04922752b8d6e75a0583f674fd6b989310
SHA512 2d717b994f7145224ad79dc58afe7d7f22e3bed96bd8fcae304a3c62ef47b709c18da317ec7c1e6eeed1ee7849a3cbc80f324570c04ddccc6b86b0276a30dac3
MD5 SHA1 SHA512

Submit Download

jcup.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
Size 1KB
SHA256 4dffc90c3d76b50c37648dd65ba50ff49715c138785f2f93b3ca30e45a0f4eb0
MD5 ecf71d9abc8ce7f9788f658736146881
SHA1 ba06547b5eeb910e1fc69086fa688b2fbdcd3c70
SHA512 a00ed42c0b0b247ef04b10ecec60c2bca30830efeff46660b46fcd0f8265d830cf760db91c22f74d45d5ec48e3bb96e5ffb8a0638a88fc916f3b27c1b50555c6
MD5 SHA1 SHA512

Submit Download

joni.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
Size 1KB
SHA256 72cd5ea21e58e4ecb04e12530aea6e7e5e96f009fc06ddd6cc6ea6aa7cc0bb4a
MD5 4a23005ac0257b2091bff515fc91623a
SHA1 704deefa073b48e66068e0169da8c2f98779385f
SHA512 15d911a3702c9d0f6b1d557892bf587b5d6589236eb450a0031e9ccf3a0f4d212c3556db3a26c9da35693c80c0f5734bb9b31717765828fe5da8f9a2c330d7da
MD5 SHA1 SHA512

Submit Download

jopt-simple.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
Size 1KB
SHA256 f5231ade8508547d2c72b596946d406a6c43a5461e8c6dd9848d86e428a8a449
MD5 6e106a2786adfca5a5f85405279d2fd0
SHA1 aff6642df31e25e7a8e5161325eee0b6b2485a9e
SHA512 537794848d84f2591de12a484f88ce841594dd27f2c11003d1a4f9147a3800aa93eacec7399abc5ae5d121691f22ed91621343f81d91587d0a815a0d77126b17
MD5 SHA1 SHA512

Submit Download

jpeg.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
Size 3KB
SHA256 2ac738bdb692651b45aa9efbd56e7d55e038390e695353399ab0ed9513c93f39
MD5 57eae7d4c55baab403519175b60b9f81
SHA1 dd7ed0bc41ab05f1168376b96c4cd130c1709728
SHA512 78ac1aca24886ba9786f9adf6c31d46b39fa48de6441c4f55996499413b4b965842375ab6ffb8f2a8344fbcd1a06ea0389a13b30f6cda63620a30900aa33ad00
MD5 SHA1 SHA512

Submit Download

lcms.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
Size 2KB
SHA256 ca5edd9dd1d0151431bf9ce940ec03fb9ed9a40ba52fc529b37119404c1cb13f
MD5 2368b9cedba6dbab496386547f5324d0
SHA1 e3ba3c502c0971377ce024e06135a23bbf364368
SHA512 57d88b86eeb14e7e39e751483e24a73672963cc48cf4d8ad49b02f80174047f49ab81044e2c380fb44f2195b9cd2c3d8b29a8ad6c3d1798078d5b47050df0a76
MD5 SHA1 SHA512

Submit Download

libpng.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
Size 6KB
SHA256 567bd56fc8c37ac9e76dad25396bf1d510160a0dce27c5df99a0fc7ae1f9c5ff
MD5 11bc08802793c49c7d1abc4617b34ef1
SHA1 c904a73faf24d154b64f6c0ebbba3f4e84c61c6f
SHA512 aada0c5de550308f02a3570ab52de31de3b5ea19fc2aba217196425f75c7379bf1c54ab6d8c39005297e4ccf6c503e2de7e2021ff9a7f5b8e79d85b5b61bba98
SSDEEP 96:A0IASDJHypNoMG7OKFax2neNRCfhSi3Ly6Td47MEkYWUGhdpquZDscGzDKtiDj+c:A3DYfJG7OYZYcDm1eUgZAZzRyzwma
MD5 SHA1 SHA512 SSDEEP

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
Size 5KB
SHA256 faf0feebf9b392072941014445e97c0338be52d02fa76aab0c3eea066d6426f8
MD5 606fc87c6e8cecba85341e8ad4a5fd88
SHA1 6a8f2948d7c57c7195789b86fb8a3f74f7b0cdc0
SHA512 6116695b7bb5a37d6534c287451760f245d04ba4dcff76340bd7b19d042bd2fa5e1ab44c2824159898e3e8fc6410aa102f9d9d4f56d17858444ef532a7116973
SSDEEP 96:c5g+i8eu8pVquSQVxVqsXRySea0mrZUOn0C6mklD9Mo9yjPdFAR9mnln:D+Leu8p84qsXRnefmTn0bmklSo9BTmln
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkcs11cryptotoken.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
Size 3KB
SHA256 eb1b9e3828c3dc7d42dbd12b6289814b7d38f3e16ae06450c65df687b890f7ff
MD5 268278742c21d529da291f6f20dd4677
SHA1 5c7fee053bfe585cfe57d5c013805eefab326926
SHA512 43cbb0101ea69a003bb7e8bf2c863c12e49e5a436c738276778336d1b5f93d63be9d2315741f581a3334b35061c7dae1b979a3416f82ae2889773c0d9006f7f7
MD5 SHA1 SHA512

Submit Download

pkcs11wrapper.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
Size 2KB
SHA256 97534f4a25a4a2140fba826bb23ff5d7900ef554da4bb14598091fa030fef258
MD5 b5007a100d7a83cfda1ba3022ddd2d8c
SHA1 77be4586255d1eb3d2dffe55c713efeac3583c15
SHA512 7180d4b030c99fae41801e0d45082ec2650664976fb8e76f74174fb8a503f71f8556f18fe342e749095ce152ade76bce188d83e4350f29ad5968184efa932f41
MD5 SHA1 SHA512

Submit Download

relaxngcc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
Size 2KB
SHA256 f5298671c7aeb41c75ed2ae40b3d375a7ad7c2ea0af555d917e16a844d591c67
MD5 360be9f21b32789b82898eb4e079d961
SHA1 478b76e45265078c28cfa5e86afd0a21ee7b5f60
SHA512 0680cf66056c778c3a34c7854608885149730dd824c96b34ed4b8e5266142305c8ed15404916852b95c24287a5f8ef62c3029e5146c5e432d60ad1d9d4f5d6cd
MD5 SHA1 SHA512

Submit Download

relaxngdatatype.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
Size 1KB
SHA256 403f5be97e42a399d16d147cb1e741291b6faf940048e230f0c317d4b30f326e
MD5 302065d1d987eadf6d5a6b003ddf2050
SHA1 8091749a4b402fdb77377490b8d7ee9d5072e774
SHA512 7e8c5c9061ba9c302128bd7d7b272e4712a818cae88212aa4e9a4cc3b109e83479351071470970aab97becfd5b8586b9ac5235afc8a36839a81223e91d993d45
MD5 SHA1 SHA512

Submit Download

relaxngom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
Size 1KB
SHA256 04ca0294775d2905d0fa68c8ea306b987b531e2643ce56cb42bf8146a5f965b8
MD5 082fb6176d4b0a11a068c70d6d0c98a2
SHA1 45889b71efeefb124aac61a5f48f56685f06ea9c
SHA512 dff6e565b381f0041ea0e30e09e09ed7afce1dc2ce2be99fa20549e2b366451976692ee502614e744642e0a73415c11041f6cabc9690d83361aaf91f511e562a
MD5 SHA1 SHA512

Submit Download

santuario.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
Size 11KB
SHA256 58a3113d66a40a2775c150d4948b64b9eb4a6239df2dcf2e6ddf4e5bdfbf0258
MD5 571d5c9397069fd32638d4bde3396ba7
SHA1 7b85521b3fc934e3577216a8f82649d189ddff26
SHA512 36719f0b70fb8b4913aee35bc6cd93e3fa408e3e9074e0f26e6cfd4fd429600a1f9f005ece33ce38eaa9f340004a9e4372619599f621569108097d550f32ebcb
SSDEEP 192:lhs5aMMluxidhiJQyYA/9Li2PrVU8NEC1eczrkVE7ltl907n:+MwYdhoQr/MDuierO7ltl9mn
MD5 SHA1 SHA512 SSDEEP

Submit Download

thaidict.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
Size 1KB
SHA256 3a5984206bae021b3d2010e3e66f41e964ca43596d703c1125e7034f59008bc3
MD5 c100047b84911b111213714c2f2cbbee
SHA1 1bbf3631272e87eb4acac625be67b5bc0b43697c
SHA512 c61455204183738b87fbfece3cad53b0aa0a7c9355609d190d4b037b65846fad229b7edbb043f2105756778525129a7fb87f73a6f41c1c691609c812fe61a649
MD5 SHA1 SHA512

Submit Download

unicode.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
Size 2KB
SHA256 fe54b174fdd952a1cb8c38f5cca4704badf99ba19048a9f3339df925128d3701
MD5 5411bad0160c7046050b27ea58277672
SHA1 ae5bec22488c41640023356621197b37499cfdc1
SHA512 d8591252d3eb71d232db8adb4e7d7dd817bc9505dbd061cbb84f550a17662c8b0379dded07cc5e714c9346e107858efe14e392299c1b687c4bdebb43f84a7e71
MD5 SHA1 SHA512

Submit Download

xalan.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
Size 11KB
SHA256 d48d7db763c4145efafc9f19df24ffeabe2191205425ab2f0cfd400286251049
MD5 ece95a8aa7061e2e7c04832a8195d2e7
SHA1 89bb28a3e34b07f4f38ef6dc9576226164e5dbd1
SHA512 d978407ffbfe7c975a9b91eb3ddc951d8c27db667cf188a50688d66a70ddd7a7e3816a88a85d1a05137566a7d26658f00239ae8c84ad973921978388cdc9b6e7
SSDEEP 192:X0TXHElglGFGXyd7cYWz6ekyIoysRV5sW/CvX9iDeuxHUaI/K0Y8cYwV5yoDu6Ar:X2XHSgkFGXNzp1IoysR/joseuqFLwVcP
MD5 SHA1 SHA512 SSDEEP

Submit Download

xerces.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
Size 11KB
SHA256 5b8b9baed249978359721d3340704662b682df4de5f58516e1783339d8cca7ef
MD5 0ca99331f156d2447868f7133039234e
SHA1 37645df5f6436e7dbd02e6f52002267edc25e90e
SHA512 7ad0091e736914e2104c0bd5407f40cf7e1ca84fcac3644ebf4aa027927f3ff82be7b35653fb09b40653cf04b11d850cb9560b817c1ca929af10f96aa529c0fb
SSDEEP 192:XNGa8JaUejZ2x4/9Yr3ff6ElHfB/DjlaoKQe97nycrUYxrtLvYpK0+YioxA3B:X4JDeta4/9Y7fflH/DcoLeNymxrBQpKP
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmlresolver.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
Size 11KB
SHA256 309a5ea60de10d60ab0ea38747d626d783feddabc39d47e18a4f65832ceaaf09
MD5 b951703fe29bda5973cdf6caadb57da9
SHA1 338d0772329a3c7c2bafc42a2a83784c7c83df14
SHA512 17e576d1277ad935ad5515f5976594af8ff8f393fea0c836877bb1f2768d4bf6870f460ac4e070a1e2f3119956ad2843e73cc182db54b528279a6592e3113251
SSDEEP 192:QlGXyd7cYWz6ekyIoysRV5sW/CvX9iDeuxHUaI/K0Y8cYwV5yoDu6A5LCGw:QlGXNzp1IoysR/joseuqFLwVc8z9
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
Size 1011B
SHA256 ce22bb6fe63895fcc09d7dcc53f8043f78fb8f68681d3dd323ec9a3f6bb5e3bb
MD5 25b17245f1aa9a02524258c13922443f
SHA1 111533b78c572d355f9fb9f2345a93d637daf52f
SHA512 6d72b68ca0d1efb0ad28727808fd6cfe3ae84ea89ce55c48ed9f9140d1cde68b4bcf370df82d5d96e5a68c29d75d797b6554cc9656ae7dc2303d788a2cc58ad9
MD5 SHA1 SHA512

Submit Download

AppCache133727661992394667.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727661992394667.txt
Size 77KB
SHA256 0c872d4ea727bf9592cc9d683fb2957c7c521704642e6e34d71b9d736a5b2b45
MD5 aed3344722b40b5a350e6a4ece537bde
SHA1 b060966ad88551402a4383edc18a84571b8aa981
SHA512 41db3c8cae87a104045be681409d2c249da152b2dce99e94da72f0291a53e24aa4e05d7df9e1122f5149f18fce49f6073481a41fb6386b96efc70b530e5422c8
SSDEEP 1536:v0X+Za4/u10PzGDl8/NIwlGwN/Hx0fQ8b59ccjA:v0X+Za4/uePzGDy/K3wN/R0fQ8b59ccc
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727662487357744.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662487357744.txt
Size 47KB
SHA256 8846bfaec8f5867a42f7cac426b0034aa43e5cf3587f74d9514a32c9efd4d0c0
MD5 4872accec33fb7ba09f9013af3279aa9
SHA1 4e9d041edc9f9be7647662e28fbf12da12654b6d
SHA512 84c3cbd839da6884933c93d348cc9fc6cb8838cdc749132bbe2433360b8caf2332a3b5912e558fb1e218ff435a2b7c524a97125d47335705a7e121b53687f3b5
SSDEEP 768:LKh+IXpde1xVpi25zlmq96HB/aiEdtdep:mhv58x6S5mq9Eh/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727667722373689.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727667722373689.txt
Size 63KB
SHA256 bdaaf95e310556182fa63b393a308c146954f42c06c19556eae955eb813b8ace
MD5 6027a2b7224f9e151bbcfe7948f8cd5a
SHA1 d75990ff1700e6dd50af29d46c8d4710998674b4
SHA512 d7cfaac81f6c1e49c4e53b4a9d9d2b6ce93a8a74ab196dcac8283e3effda7b295e4a2c9d030f0579717ce6662467c36463bc2bf6312189e7aa38b6c1adfba1c0
SSDEEP 768:TGV+jI0XbNGU20xpzWiGYVrRnmSENNxaps8BV1O:NImbU0jlGYTnmfN/a+Is
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727670771168387.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727670771168387.txt
Size 74KB
SHA256 7f1be135602a062dce01ce19632858a819d938ad626aa70d170173bf4c6fcc53
MD5 3ecbe6038ec8ecc7afb5b7559c675e04
SHA1 25dba67a9bf2af772649bbb05a0f0aaf8d0bb34d
SHA512 87b3b3f940ac749c720996be97574fc78ec4185210ca37a04f90a69173c1dc87f0bb5283ce301db4558c33a4e961e89f96fa05bf568bcf459a3381a062e1b625
SSDEEP 768:Tec/1eDFSzC32UEufvB8rVMEd2/n4nDv96HBUg4vvdYdtdbd21debzy:Te875UGqY24z9EUbvFyVbzy
MD5 SHA1 SHA512 SSDEEP

Submit Download

File Explorer.lnk

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Size 407B
SHA256 24144109fe4ddeda2357c6bf380941589aa5ed5c94bc942406f533ffa2161c93
MD5 a525275e89cb8f1f90b93f0c1f1a1ffc
SHA1 91ea71760aa597358c90c72b48dd1ed781fd3ff3
SHA512 b560de7b4aa4e05472af97a544fd2f23fba4d72e3c08013ad4ba3e0f039e228fd81d8383f82895c0dc207fba335176bbd23e8d68ecc8cd0bfe97da8b1f858646
MD5 SHA1 SHA512

Submit Download

ASPdotNET_logo.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
Size 21KB
SHA256 a90324434911cdd8beff915385c492c8cfb47288e5c9626d92aaeabfcff16d44
MD5 60ab67f9b776a7684697067c292e9bb5
SHA1 ebbca44ec73c6d0d3c587b6600185e1f6d9622ee
SHA512 44de40c5292f2e6c86318f9af2bd856d7af3e3c2432db0ac6a1a5556a0c8c761cae15ab2e2835863ebaa4e3cbaa1df614e6095c6f23550f9a6852123045bbeec
SSDEEP 384:/uB9jeXf+66UiBRa0FvrLq5yKqO7xU0qvOMT4xYI3So5yGEx:mXyXfR6U2Ra0hLq5yKqO7xQmMEuIXHc
MD5 SHA1 SHA512 SSDEEP

Submit Download

HelpIcon_solid.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
Size 1KB
SHA256 383cf8b387e7a871428e76d4c165f60876ac666f95fd9549aa92ff2a19cc8b83
MD5 ca8ec462edad386f065c26f364f6a0aa
SHA1 1958bd22de7ecea713e1150b3dc4e19058259682
SHA512 712dacd6a7afdbea862b52c7373148d833e832f28038584fb7dca2f31d6b8fc3a6957aab9631e990fdfe32a4e7207673da03293ae25514c3aa1a7f94cc1b130f
MD5 SHA1 SHA512

Submit Download

alert_lrg.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif
Size 952B
SHA256 07f998a69a0960902da083cabdbce52600086f259e979eca16ddf4feec19d8c7
MD5 6db99d1df393d7a67084a2c0160d6a58
SHA1 5011f5f89b071e38387de32319c6eb805525893f
SHA512 66909332b1154a2e8cf4056a49eadd4610e7a95ba890e698ca49be0f9857cf65730712751dc3ced4b196e354e96c83ddd2c2a56655239de2d52854d972218ba0
MD5 SHA1 SHA512

Submit Download

aspx_file.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif
Size 121B
SHA256 cf52101bfcd22a7e76872be349170826df267593ea84f87a2991e4fce337addf
MD5 9efc0acf68fda4ec5b17f6b5dd841e67
SHA1 d5f437a6fccdf937825b80acfd08d3f13191591b
SHA512 45dfbc7a3d3cbab9d22fe6a53c0d9bedcc0cdafdae96aad9a299b9e8a7e0de9364865bbeb4f8a175017a2126ba40d832f2c7f7729a8f048c2359fbc591df1ca8
MD5 SHA1 SHA512

Submit Download

branding_Full2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif
Size 1KB
SHA256 c5319d529667a2ec89fe142b69827d4700729537e175ed185adb945936271db7
MD5 d5e366806b979e3a33e2e12ddab03035
SHA1 936edbfff215a13fc528d7f86f31997049a3a220
SHA512 9e53353117d90362cb04663d07a44f4824952f58a80a9215bbc761ae4a91091abfea070b533193fdebf5c519fb6d96c50c4091b721e783d8e789755384e71558
MD5 SHA1 SHA512

Submit Download

darkBlue_GRAD.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
Size 8KB
SHA256 66165c9f5673e46189a6ae110483ca1f2f8982256c38ec33a5586e7e76b66ab8
MD5 5eaee4d83586101ca94cbd6db23419ca
SHA1 fd5653258c2c7932e3b21b43b62895d5e3726010
SHA512 37982a9f3d21abae069b0fc9d10f3f8ecefe7d46fa99659ca9de628fe394674731452e5edae487885a05e19123f7f15990a6a1a40127ea7acef114084ffa6e5a
SSDEEP 96:Cj2U/oEozKm2k7gHfd2bEL2bEmQtMAfFjFxXOk840dz3SCjIVl9v/4dUb+t:CKWnmV2xLXOk70dhkZA
MD5 SHA1 SHA512 SSDEEP

Submit Download

deselectedTab_1x1.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif
Size 61B
SHA256 fb5859c33f7084e9209e94206f2a1354c4c466e56b9c8bdca668229b2fc713dd
MD5 72046d9ce2b319185af8e439624582f6
SHA1 46fbb2926f66469ae85f39082fb46dc868dbedfb
SHA512 17724e6706666ff62dbe233e05b299e52e96ee83685934702204a80c582df11fd18857adb2621f6933104c791450348d358b77150ce739cdd3010f0a4017585d
MD5 SHA1 SHA512

Submit Download

folder.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif
Size 914B
SHA256 7e1ef2719b5ab8640221112697806607bddeb2c47cadba01b968c87294b23931
MD5 7f4512385e062b8f6169e308de3f2519
SHA1 c6d872111ec511176621d003624adb148788bbf0
SHA512 3cd4e005e07a9f7a4d3204c60ff8d6d007bf6115baf91c6adf480eae8268336ded6256a743c039f6c631776f41d42f5652e82466e1c1ace1f955147f0fa0b59c
MD5 SHA1 SHA512

Submit Download

gradient_onBlue.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
Size 90B
SHA256 1bebaa6e3bba24569c14e3f3b3d88b35d7b4b51b261dbc73fbc3ea9125edbe52
MD5 d118f5558faebacdef6d4f6800a8d8f8
SHA1 c491a38354a52dc0d77ae50706aac7fb412e7470
SHA512 9549ceaf47ae3abde83c1db029e25033d8d94908b92fb4bb20e173c739f3bd41b02f324fbb3a7551b3e158e95849768ae946c57ce5259313a5f68c45fe90ab4a
MD5 SHA1 SHA512

Submit Download

gradient_onWhite.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
Size 90B
SHA256 ad0ab299d5b9e06fa45a2d3430300374a51a92020af46390aa10374bdf6ff6f8
MD5 c3a6cbc73d2959018d1c808273483d08
SHA1 f47f5efa301e88d9cd7137c1584dad94b9b721eb
SHA512 5ab4333b3adbc3f56cbfdcf5e3013b4988727fd7194e2ecb944fd955b8097614ef41c904b83feaf701d3624842aa69fa78e66066e9872cdc652fcca7cfaee542
MD5 SHA1 SHA512

Submit Download

headerGRADIENT_Tall.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
Size 328B
SHA256 891a38ae41ef4309bb412cb344cf9615bb9eba558e20eb66e24fc3e3cf96477a
MD5 a3a2e8e4018769171634369adced8d53
SHA1 8542679abb36379dd4c99d54191c73306ba97ad0
SHA512 339e3b054c7d00f3c8262a8e28b726f751ac37d90490c9891c79b34d5b9882953a7dbfb033317c8ad27239da4b160f2363b3aadae695877d708b7a1ac2c68924
MD5 SHA1 SHA512

Submit Download

help.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
Size 1KB
SHA256 230157fb1f1d8fbeaad9d76575a074fcc0dc6004a6bb4fbf065990ffabe52ce0
MD5 c1dd8ad38d7a1f4613520f069f0d0646
SHA1 74132395034ac3decc4fb06279135417769cbc8c
SHA512 061e9fd698a2ce38a2b74f9480f4c8c65147e4aea70f4bac75f74a0c3529c4319cb2e6469a37c1335eaee757d08b44501cdec9b674d99c316cfa7cbceb60dd8f
MD5 SHA1 SHA512

Submit Download

image1.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif
Size 162B
SHA256 585af654ce19f1d03fd1086cbb74d095e5fe2a201a44ff3ec3ac1d35eb7c8945
MD5 cc570935f09863c5b030dc97480c530f
SHA1 8a723dbb7b77dcabd135e09dd6ac5a60535b02b1
SHA512 aaa326847fb77e37329f6d232dae8a7c97b61484296de6941a295111db650ca7dca6ce15ee0e802e731588e803fb1f3d7fe40183a83df701d9cf752246ab31ad
MD5 SHA1 SHA512

Submit Download

image2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif
Size 586B
SHA256 c8b12d34b12ed2206e24562e9d5e5eaf7db456baafb79dab5a299b23f8458df1
MD5 32491050dceb3e33a77722a372cbb8e0
SHA1 b31f4b75cb4076ea8ca4de7af2f705d406137210
SHA512 cdcccb0bde6cf65ad40092edf33d687b5df808fd8a1272a46b913570b9ae2adada2434ca3f8db939b7d0bee44f7eb800c0495ebc33e62b1d39e448f7356d7f3c
MD5 SHA1 SHA512

Submit Download

requiredBang.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif
Size 124B
SHA256 4f4d45fb2da2953cc003a51b7a0ea5d439c7fe163f90a703c446c7a9b702ae26
MD5 bb6fbdffae67128f0c4d1acd64e52f96
SHA1 4d2bc7aba05c36fd1df6baecd3ed4cd292743533
SHA512 8300d6e9bc28d8e61b3cf01b13011f10a0d2dc59ecd05032a14aab42a29af1e61af6ae13856c69b395d9e8689ac01f67bfd1c8b3a0b1e5e25c4d88b64d589d23
MD5 SHA1 SHA512

Submit Download

selectedTab_leftCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
Size 65B
SHA256 f4007d94f35fbc83e87bd2fa6f7dad1321e80db6dbbd0175abdeb530f56e68a7
MD5 18d028b4888b6f6e9db8ee0f427854d7
SHA1 3748602bf75d436827e2176147e6ff08fb8f691d
SHA512 65155193b7d98183be24647d628ef9738cac380c988fab3cd775f89181dc5adff5fee1b1f6aa2fc43e5650f8e11b99e23c28e7382636307e361119aa871d773d
MD5 SHA1 SHA512

Submit Download

selectedTab_rightCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
Size 65B
SHA256 30a37cbe50c62b343f48af376084d51ad5f0f4a38bf0e21e8bb72d633a206fa2
MD5 21b2f81c7de3321ce7004af728d11a81
SHA1 cd7e72941fd5e7980e8c81fb8dcaad45b2b05581
SHA512 466a5be67281b38e9d779dd2f696ecb85618b000ee7f748cfe47ff630b7f9ef0d2a7c97581c4cc0c76e79e0ee640f684c26367aeace89836470c285de2a2a52e
MD5 SHA1 SHA512

Submit Download

topGradRepeat.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
Size 8KB
SHA256 e0cd484a0256cc274c15a855d967da47298a9f373851a82b77e0e966b3602b6d
MD5 e19461030bf2b8f5bb805b7431028e56
SHA1 d4645d105b9ef395d26b2e41cdec9af3279438c4
SHA512 aa1d59368c1461f5c3cdb07565f8e7939e731b185ef5e540048901801e1e19b326a582b6ae3ca84d990f4f62bee2e4a7a7947135f966b0b2effc16cf569b8f80
SSDEEP 192:04ZBdMB6PfQdJY6jQPcQev+eeeeO+VI3G:NZBdMBUYdlEPcH+eeeeOQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

unSelectedTab_leftCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
Size 65B
SHA256 d9fd61b1a3e5fc7f7d39a3b1bd6b5f8227d85b53786146f3960cbdf32dbb203c
MD5 eb84c814eed81f69ef49848d03420206
SHA1 45b76a995aaea76d9ba72fcdc8560b89a7b1a0dd
SHA512 e3b5bee34e28b56e8581529865cd10747ea96e9be558dbab8136c0dcd1160b0ce2382ac51c1c09052536a969f1d03fa00a6bc7a91487cdd0f76d5e0b67260bdd
MD5 SHA1 SHA512

Submit Download

unSelectedTab_rightCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
Size 65B
SHA256 e9e7c651fba92b26a74573d452b2dd9e2115ed06c411499e04445fd86ade2eb1
MD5 7f92eeaeab07437f434742ce0c4f2827
SHA1 8edc9fd784dcbb612856ed32a28ee49d77267a9a
SHA512 7a49ba34fee8b461cd2e8b554a38ae8cc1bf69f0b616676565d061ebdf0827bc5af89f53161996f05974322c7e7b2de86e4f589252c09eb0dc9415b162fcb78b
MD5 SHA1 SHA512

Submit Download

yellowCORNER.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
Size 880B
SHA256 f533c7760611fc66630e5ce4681fe9b57579a63eda2a311fd74ac6fdf55d2081
MD5 3b7e64065cc1094746d92a408b05dffa
SHA1 985e0b8f5ddaa56efeb989a2f8d70cf81a1b7609
SHA512 83109513ffb1b3444869925a509b63313347e28a0ace4cd10cd9a2e7523af242fab28858d0f8829ed30fd83b052f0ed18a74712f5ca6572960351a10594565d8
MD5 SHA1 SHA512

Submit Download

1 - Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk
Size 1KB
SHA256 eefc312bc64df42e05af2d08d898ccc271223ab62035157078e590035b8b2bb8
MD5 f3733ead2da8ec7307a0003dd673ba8d
SHA1 ffa41e5d1553ce39257a89f455c625b6bba6a297
SHA512 54233f26ac88839a35a2db7e91b0016eea9125df273e79b8675b1bc920ebfb08193e5ac91b023edd60e35e9662b8e68c45136fe374fdeb99ee831e45a9d15755
MD5 SHA1 SHA512

Submit Download

1 - Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk
Size 1KB
SHA256 604895a0926e85b43d1fac3af312ec0bc95270e45dce6acdb6c11fe0b924d476
MD5 f8c2fe1f3790e6c4315a161d9584a40f
SHA1 8af7736687a097f48d822b1c3aec86e3387cf952
SHA512 e5990a2af7b3f91e71a43da3ff000788b1fb01890e864d89f095a74c5bf6ca2cfbc91d2870e9c6c76d44aae8b1b07fafabe563c8961e3543abeb9adb266b9a0a
MD5 SHA1 SHA512

Submit Download

2 - Search.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk
Size 1KB
SHA256 536144ae29d4f9fbf894a3b9c76e12fc105e09370a94d8d972b423e6c0f33c6e
MD5 f92a0acd570ed1d32e21a5343d5e87e4
SHA1 9b7c07400704de55d5d5cd7b5084bbfde2c8f316
SHA512 779bb45e71865efa4dbe08b239a5ed13b9451ba496ec6f673c16d14cb8034f499e6d24c8effdcef892ee72aff5712fb372866a7146a8d434422d0c6ddc678e8a
MD5 SHA1 SHA512

Submit Download

3 - Windows Explorer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Size 1KB
SHA256 b84a881e3bd7a3afea8f2fb84b0becaea421339a99bb3e92d3d9f05d60d30944
MD5 0d2b5cf53272ceeed193e7c93b4afabd
SHA1 1ae4a307f5aa6e37a23e6aefdbd0f96b11379860
SHA512 b834599d7b0d5f9c739587ea2e836ca50bbf0cd40b08dc398e68147ccaf642cf5215c11755e27aa3d28f100db68c58e6c018631ef4e4796d9c9b1211521372b6
MD5 SHA1 SHA512

Submit Download

4 - Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Size 1KB
SHA256 aa635b514967ad50dbed6217e4d7a384acfabf7a39a425bfd38d140ca526785c
MD5 bf49a7156215fcf317e7e852c3cb89b0
SHA1 15a3b4f7b87bd5a9cedc8c2d1d9dae55994aee3c
SHA512 2a472cad7136dc5e372b32d6d7b77f96a6dc4f960d68e6c2b0e2599f53a2278e525a0668d0ad2780531ad3d06af70a796347f0ea1c4f797f1587bcb4bb1b0354
MD5 SHA1 SHA512

Submit Download

5 - Task Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Size 1021B
SHA256 840c7a1f11b43dbc04bceafe9bdd747bb833e064a5d74804bf24d2d426abada6
MD5 9323151503ffa5c8ad122c6de0393e54
SHA1 b95f57c6f0429232df39ad01f46287c431fc7f08
SHA512 6c289e001f7b75e8de87cf1e8e4a5229984a9d6208a37d43d80ca25d80fb40590d2cf5e02924d9e8162ed070e7bfa8718b671485896cf448ecd85d5cf97316fd
MD5 SHA1 SHA512

Submit Download

01 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Size 1015B
SHA256 29990a64de3760bddf9db385564fa55b0f99f10a74fbc21febc9480c0f68d5b1
MD5 e0ae916d8725c920f936bc47f6b3ba8f
SHA1 6e3821cd9f3b3f914e0db17ff49fed57764b8ec2
SHA512 f6e063a9293f5546fbaabb0523e9419f37add922f064f2696ffa6cff463109e8265a965d561577240a3f7de7460425ef580b700f77b672615a6388f93e4310b0
MD5 SHA1 SHA512

Submit Download

01a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Size 1KB
SHA256 a5859dd8acb3d3b0d98b698205221dcea0e0b8e93f46a9ed7d386d02f3c5e210
MD5 47be01893ddc8b8d7994255f5ac9e7d4
SHA1 fb3f8537f7f6dd3a5ac41e9266156d834df52543
SHA512 fd083cc8a8d6b99c0489446f08d7a533376c05204333ca3325551d56a79bdf45f33d46f144ebb6d544ee578342785cbe80197fc360bcc509bda02f4d07e4566b
MD5 SHA1 SHA512

Submit Download

02 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Size 1KB
SHA256 f47938c28dc0824f3e6994e24cb9d56e5fc12c0b75ce39d24dd99ca149cd2e5b
MD5 334ccf8950443619458fd4fe9c4a996e
SHA1 4e2fc7268eb440cc90be88bc1c6cb64611283245
SHA512 fe916bc1be596924233ea300c273ba11600d1a5e2dfa96cbdfde341ca1a07c212097b64e4c5bfbc986be16fb68cfa2c7414eb2171439aedd037a131b8f7c487c
MD5 SHA1 SHA512

Submit Download

02a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Size 1KB
SHA256 b0fbbce230d40e4476ed1d59b288f88c189c4dcfa07287a67590dc7ab5039900
MD5 ebb39518fdfbe31a8139ad88999d1a6a
SHA1 f7ca2fbcaafccc4d863fe112a7e73ca505892fa9
SHA512 885a995c6a64f65122145999bee4e3a8dedbef6e954b5535c024d54c77e1e0ad5441b41f7728543c428acfe9ec5cefa53187613366ff1d0e6d3a6f8b07d9477c
MD5 SHA1 SHA512

Submit Download

03 - Computer Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Size 1015B
SHA256 65c01e8e1fe306fb7d8a828f710f084acb5706290d061b2bd7b186db7aca7eed
MD5 823b0ba905697ba3c9b57d863b37debc
SHA1 b8f41d160e0ef7f5138eccfc0c448527db49e03c
SHA512 6ae173a41a00f72658d3289f805b155ac510db68a61916260c1fddb3b43ab0281653ac12d3fe298087bc862b7f02f93ae0235f82beadc18e21d860b0f0bbdca7
MD5 SHA1 SHA512

Submit Download

04 - Disk Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Size 1015B
SHA256 00156a9c0ac7d76f59e33964a4d4957158f6f13975bd5fec9d0fb87b4ab50a7a
MD5 51226f9d11e97ff52e56703ac6500bba
SHA1 09d996416e31bb1fa1682c95f4de9a0376295755
SHA512 fc0c32d8c212eccdbb0330b5d83e06caef3632ad1044acc6f16547a3db1a14631047900497e93aec0afc76b7068fd1a5315a43101940a139981a1f2000db5d4b
MD5 SHA1 SHA512

Submit Download

04-1 - NetworkStatus.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Size 1KB
SHA256 80a1a9fb26e952cd656135357556a08883e4e2d5664a8fefe913765a66229244
MD5 ffec32174a95c05251fcdc51f5224c97
SHA1 896bd699a496698764489485582b6a348817be08
SHA512 47025faf5ba8132d68856982ef1d0458578305079fb9d022032d378112053c559bb270333da58b4c36b1e87e1ab1ec75136a55ae6e09fe62280ea5dd596eb069
MD5 SHA1 SHA512

Submit Download

05 - Device Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Size 1KB
SHA256 b5e6ddde4d0dc7daf41c740df69cc85393f3684b942814e05a523d3b8904ac16
MD5 78a8a00c50b5529028bb9591766b945d
SHA1 e31a84927553c36c7d9ce07e0ab52e137efab271
SHA512 e34617d7103f9ac0c88c477b96e1f7251a0110f3fb4762288ba309ae90b0a4baa67d5bdfd28c5bf029af1d034e572ce66fcfc356155d479ac1aef6c76292613f
MD5 SHA1 SHA512

Submit Download

06 - SystemAbout.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Size 1KB
SHA256 150f4f2594fdc647967d3074320602e33ab657596cbec83ccdf69c027b81b3a0
MD5 ecae7ef9c1a86ac263f874d298fffd0a
SHA1 92b45a2cf24a644f956c9146625e7831a305a8e0
SHA512 f022311742ec80ff23298c283af3303e726ee3d4f4780487531d468f808cbf74ba94401091792c82ea2c29a505a8131e3e4a0e648a4cb81d50d4f54bd728201a
MD5 SHA1 SHA512

Submit Download

07 - Event Viewer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Size 1015B
SHA256 bd791f10df40c528446485f6da5b344c6202f6801229bc16e3ba7596f2289f03
MD5 fa05b645ca36cdf53c67c1e51f8ea57a
SHA1 02209f69f214c066dd2d05df76490b99a8ac997a
SHA512 c50cbf8f807a5faac8c190e27ef5bd0b2211a63e77452c0b305c083f942cd5990db2931c4671b903fc1b036a7c159690a8a9183d2bd54b0f2c456bdb54b74d3c
MD5 SHA1 SHA512

Submit Download

08 - PowerAndSleep.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Size 1KB
SHA256 b02d2e41fdca15bc5de1dc9be7da3fd013958a122f38a71b71b9ff28374e53d5
MD5 5d37d31b3c69d9ad556cf4207ef2567b
SHA1 d41f60fe6e11ba7f1b262f98f6f42df49ecac36d
SHA512 066d96f5fb1697364e281c56fcee5fbe8aab5932462993f5e8719fe3468d9a7239ada1c8955b4d6747774e17cb6109d667c66314c7a8acceb683ca66c9a5b33c
MD5 SHA1 SHA512

Submit Download

09 - Mobility Center.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Size 1015B
SHA256 06ffc43c18ec8429767117416868dd20e16df07a39b60a059a416442743638d2
MD5 bfabfa2599edfe8f0bf3d533d996dd39
SHA1 2bacbaffddfb6730f71b2c30fc3356c8188e1d92
SHA512 98274341f863c29b88813fd5ec15032881c431d2b7bd1040968e0c54b101f1947dd937ea05746f299593c1cf37b440c948be95658a7b3fd0c3ab74ce194a2f69
MD5 SHA1 SHA512

Submit Download

10 - AppsAndFeatures.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Size 1KB
SHA256 a05d33621b75fd7d4667cc02b9c0d8b86abd4823b14ae29ba2151200e2a09012
MD5 e1d4d8e2a9313a4c4556e24087df1121
SHA1 8d36e74b78afb936ad67aae62c1f933121d3918a
SHA512 45f4ad7e64acb110fafb76ac6294ef92230bb4c7a56b508e614d51783cb24de6cf78400e8bdb5bb691515abbda82e911e69c1ba09d21706a48609875ad85ec98
MD5 SHA1 SHA512

Submit Download

Shows Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Size 352B
SHA256 3a247a8f0cd3646e3fd7146a0ee019c2d2048aa7977469449736475dd60da6b5
MD5 0406a86fedfcb73569aaa3bb4b197d5b
SHA1 70d0b7c1919bbfe7b7b91c1d6308a4b01c7873f7
SHA512 cc732a0961120d674bed0c37471790b94453f9ca0791e7fd3b512fe58ad56aa59e76862ad77dddfcef41b4dc3c74e50cf1f2eccf0ecaf8c4c04ccb78aacbbc11
MD5 SHA1 SHA512

Submit Download

Window Switcher.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Size 334B
SHA256 36bf78fad37a4e6c82f9d965f17095286c27a84fd9bb214d792f30cd28411dd5
MD5 7390c0630e70d2160ec66a7eaf19a285
SHA1 5c0705311bb201f3e93740365f4069cf4df91b55
SHA512 89605bbd5b388ffed9c729cc88acf6b826fee2df861bac71ae346f111c8114ac61d8de2e7f59e1b23db67cbfd330551dfebe5a2a1ea97f5cd88bcde467d43b11
MD5 SHA1 SHA512

Submit Download

Magnify.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Size 1KB
SHA256 182a942e2ecb7aec501f6174704e437ddb0c2d6f947199521418a70223b41d91
MD5 ea6bfaf5ac52c762bdd5ce7e2c93115b
SHA1 7cd31b0226a81964e620375bd8961be1f1a5879a
SHA512 28a41abd5f0e74a081a74afd4e36960bf2acf28eca9e6f7230279de8d88054262acc5072159c73bc2ce2a2f52599011be4218061c02b984cbbd3474843060035
MD5 SHA1 SHA512

Submit Download

Narrator.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Size 1KB
SHA256 6d41a5be1171266f0de0016aeec537dc1aae31c165a435539b5250e73dcd1b48
MD5 2fa505216ef60b51fc500f12e566baaf
SHA1 aaa1916a8aa515996d6d7ea684f134cbac25b93a
SHA512 286b1b23e884dfc2fb75af3aa4b3c4513e1deeb5e21957189b669e04255aee0114c1bb5dcd86d3ac8c248414e24bdb9d196657c410e25074740fd8852bd81437
MD5 SHA1 SHA512

Submit Download

On-Screen Keyboard.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Size 1KB
SHA256 12341ff33e9549faf9507c2dbc4f837a5f1507bf9e7590219d76bb07e53cc011
MD5 c5ff1d7d3779c84a6da3c39da71b494e
SHA1 9949566e272fa60379de92e0d1c8b086d034cb42
SHA512 a42d8f91bdf7b131ebbc16d777c27b457b2b3f36c24fd51d05e1c791706a26bdb85bbe78be771e71e13d1efa1a62eee1a0daa914252f43b0c6bb703615ac803e
MD5 SHA1 SHA512

Submit Download

Administrative Tools.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Size 1KB
SHA256 46d09d13749027de380c1647c5b070115ba72f6a113e9c103e3f4f2294814a8e
MD5 c6b6420f3320f6606da263b3bafc9fea
SHA1 7af2b352fb605bd5b7fabc0a353f32d1ba2ef30f
SHA512 b5816d847194a4f911f6fed2f35623661dc8991f8621d8a0aeeacb153fa01da455824c6781f00ae903b4aed2541d89d430d986410511252e2f03beccaa7d1f80
MD5 SHA1 SHA512

Submit Download

Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Size 1KB
SHA256 203248ad2bd4fc678376d51c5ccb82e9d7c8e3f4fe5a95eab5f6c96e39c55983
MD5 23d49a360fd899b05751d676cba11dfb
SHA1 c4f2c1a08c2322fd9489c44240aeaa7c51c33222
SHA512 8531feb9027bec9b2873768ed728f6a634268eebfbacf3d3e99b749f79dbf4f636d8c4ad8b1a96b5e2ca6de24b59bd3e3c36ac36d9c9c74e7d7ef135a29f0f00
MD5 SHA1 SHA512

Submit Download

Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Size 405B
SHA256 db2adc732c9a2d7fb142c84f8cd3ebc3f091c2f6159606d4ee31ab77186b486f
MD5 ea33eb69a7c0e434054b097e7e4749cb
SHA1 4bccd25d5aaaaed16a0300825321400b6e89d6e7
SHA512 e6e6161f8fc8eff5b80cf6068950a5c22ceec6ff739c27ede71c36c8b1d143aad592a93461c3e3130caeefbf4cd82b730d84193afb49313bb51e0ebc0b8b433d
MD5 SHA1 SHA512

Submit Download

Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Size 409B
SHA256 608a96bf3296910aa875f205fe316f767c6fab129eec4d374ee2f07e3e479a9b
MD5 36e69316cd3b3e880a43766b1030331f
SHA1 8c3e057ff44044b354c1f32cb581472d9fd41763
SHA512 13e6cc0bc4840a06c44fe448e576a1d4bec17e8ab3f9d14342411e491b5672b0bf3546cee7c27eef099a5016798a62ca54e61e5c15f8eaf7fecfac80078c725a
MD5 SHA1 SHA512

Submit Download

computer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Size 335B
SHA256 dd3d66089276b16f9892448b3a92650bf02a791c58d525b9b14f9e5204cc4b49
MD5 b7f25cc5d33c57d8a5c3d532cca5fe92
SHA1 d595c7ba8aca34eb441f88c287ac1658ec92d073
SHA512 2d02786c9c1dda227821d3f5bf8c0aaad21abe8ad150e09a99cc9248493daf99adc53fc93a4a39dd5e3075d54237f99131aea4bc25a5a8f138f47761a4b6177a
MD5 SHA1 SHA512

Submit Download

Windows PowerShell (x86).lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Size 2KB
SHA256 4c2175d011ec4cbf6826ff61abb91bca19c72114e85ec031a75889c0382a725b
MD5 7ff13c0f08c8896dbcd323ebeff5610a
SHA1 3d6d483d9de45cea22ff0c13fd35ac83443aaac9
SHA512 0bc3a006128dcbc426af44f20fc0dacd84d5624bc11aa4aabe45af5767885fa127b54520d01f0f047beec236ef67aa2f6966bae853b22ea97f9f9298527f6fd4
MD5 SHA1 SHA512

Submit Download

Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Size 2KB
SHA256 3184ebe0fda0c65b05b77de0b1734ff449f716a5767f38c654b07e60cac01c7a
MD5 7764fb3cd0b770bf069680422a730d81
SHA1 704599c43ee14131e702410425a25ad8fcfe0c8e
SHA512 058237c3a40f09d1a69d5f4a85370b6e12968d7050e57c6ac9b60ea94a602c03cc7875230d8790b0d196627d5dc1a4add9657ecdffdc8f7a347efb24d0dcde54
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 e48916e6cb2b238bd081bb841a72bdc62375b6a15b7a182574cdc3c7f73410a7
MD5 e61ad8fdedc5a70e593e63088c9b52cb
SHA1 d562037b44e6b2d7c1b1f88ad2a332c3b740d3fa
SHA512 4f852d8a2b724659efcd6f97c76da0c9efccbf25d8fd6f317547c0e1959a9e4565c0707fe1ef8fb9f238564b36b77850be5e1bfd1b2d44dc4e4b990139938f3d
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 53c7893646e8bad6947a46d6e7e6412e8f72f7eacbb1abdbcd8b3b73db6deb1c
MD5 5248c2c7ca8667d527a9ab9fdb6ed36b
SHA1 464c4e615b45bc3fe2cfc79bcacf4434299e5bc3
SHA512 4de760e9c4e55198c003de0d32a273c7069e25c45b0a77042e62e99adc6c302d75793b723fa6a5349b33c7766f6756eae8746aa8812d90838e0331a1c134e4b4
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 cf9af1255cf77ef780d5c5f2ba25b2d54ca17f462773d246c1c2b42055a43f3b
MD5 77718655ca116bd9374aa124df4289b8
SHA1 dbddf5b36910d4430710f4b7aa49703077a74352
SHA512 40323660c3cbcbc0482687cc4f8378ca3ce86b10efbb7a144d1cdbe4b31b1133ff3ad05e626636ac86b009ad6ba665ce8a2ee25553e6b7986110a99ea69f7d0f
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 e7635242a3302462065702e3c757e70d3bb32b3fd2e3e40e7dbf3fa38d4ef395
MD5 68eabdfefc76721953e07ab2af95c80e
SHA1 cbacdce119f890f58b316ec418b7b7a088806934
SHA512 1da19e016c0a5aa7d357a0af3177e53dc7d4812f0acedbc061824074b79dd5406bd4e09041a4a74fccde778a3c38007fae38411eae6479b27403b428a85e36db
MD5 SHA1 SHA512

Submit Download

OneDrive.lnk

Path C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Size 1KB
SHA256 a2d9e5ec6d8aa07f8064beae9105e554f86b4a412982868c296db98296091bba
MD5 2e61b0a1dbfa515b2560489089ec0927
SHA1 2e6fd30a26e66be98d84b7a107b625d170ce0cdb
SHA512 3fa96adcb4676fd0944924a322d13fe77289df9e4dbe3852dedfef9b5318f084cbbb6bef4c9bb5488906a0cc95acb3acd91fb7bde6ea13cfe685029a0dfdcb15
MD5 SHA1 SHA512

Submit Download

memory/4360-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4360-6906-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4360-10874-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4360-11015-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4360-6897-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4360-11302-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4360-11307-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4360-11308-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads