xorist | e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392

Analysis

max time kernel
111s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
Size

39KB
MD5

5d8c6e9022da9cdde7c83e500bc09660
SHA1

fc8679bea044346912f09ff17ded0caf53af9b07
SHA256

e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392
SHA512

373ca7cbcb63d1cd4bf33be6c524a8104781a714aaa0d50991cabfe746143ca18f355a592f681128ffb829fe82d7f5e3f4d2d5e956a520f2d4b9a7645f37e4ed
SSDEEP

384:HebFNw4Pk1itKkpAjjalraxkqYvjSXkDCgSZWQbxpwMB:H0FmBkpKj1xnY7fDCpHxpF

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral2/memory/600-0-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/600-5391-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/600-11219-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2189) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\llsyriQkU2dpajN.exe"	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa.inf_amd64_7cfab61cbab23e11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmhrtz.inf_amd64_aa2738d63955f632\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sdstor.inf_amd64_0d2a33dd67a36577\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkTransition\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PnpDevice\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_infrared.inf_amd64_3160910a003e1f11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttp2.inf_amd64_8c1e04ee38482578\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_d6132e4c7fe2fac6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\arcsas.inf_amd64_b3d75f82c617ac6a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdpbus.inf_amd64_05ebd3b4422f62ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tsusbhubfilter.inf_amd64_283a44fe508f0682\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\nb-NO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\et-EE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_memory.inf_amd64_6fa9664593233d6e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ehstortcgdrv.inf_amd64_5cb0c23f45dac01c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsuprv.inf_amd64_696bb57f8e3bab65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcard.inf_amd64_bf5afc5892966e30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmati.inf_amd64_16fbf6520a254fad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_dot4print.inf_amd64_33c48c563d7541f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_usbdevice.inf_amd64_815550fc328ea85b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis1u.inf_amd64_64035dd8a7571ba7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0804\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fdc.inf_amd64_fe3599e7eac09e7f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mausbhost.inf_amd64_34c86c15777c913b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmetri.inf_amd64_50397e28bbcd6514\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ts_wpdmtp.inf_amd64_e0577000b188c16b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wpdcomp.inf_amd64_d5fc5f7282c9bafb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\amdgpio2.inf_amd64_808fe94735c4c6b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcpq.inf_amd64_3acec385f5d67bdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmracal.inf_amd64_dd534e815632509c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wdma_usb.inf_amd64_e879d41db6fd1ab8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\whvcrash.inf_amd64_1173082afb4becfd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsantivirus.inf_amd64_632d2ac0d68cf3ed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpenr.inf_amd64_20c8782372e47bd2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scmbus.inf_amd64_c78fd781987c1675\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\eaphost.inf_amd64_d37080dfb66d830b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidspi_km.inf_amd64_7e53b3972dc4df20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\monitor.inf_amd64_8a98af5011ee4dc6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_c62e9f8067f98247\I386\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\percsas2i.inf_amd64_a7f5d94e6751c911\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_skl.inf_amd64_9d9dbb01837eba23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/600-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/600-5391-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/600-11219-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreBadgeLogo.scale-200.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-black\Settings.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-96_contrast-black.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-32_altform-unplated.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-256.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-200_contrast-white.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7db.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\WideTile.scale-100.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\warning.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MixedRealityPortalStoreLogo.scale-100.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-256.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-32_altform-unplated_contrast-high.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-100.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-150_contrast-black.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1850_20x20x32.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-100.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-colorize.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailMediumTile.scale-200.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\9.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-200.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailMediumTile.scale-100.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100_contrast-high.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\WideTile.scale-125_contrast-black.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1850_32x32x32.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.513.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\PREVIEW.GIF	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\91.jpg	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-16.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons2x.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\157.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-200.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-400_contrast-white.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxWideTile.scale-150.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare150x150Logo.scale-100.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-150.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.targetsize-48_altform-unplated.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SpotlightCalendar_2017-03.gif	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\new_icons.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\BadgeLogo.scale-100.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-pcw.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_eedd818099eec00b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_netfx35wpf-microsoft_winfx_targets_31bf3856ad364e35_10.0.19041.1_none_4be830b77f349807\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_netfx4-browser_files_b03f5f7f11d50a3a_4.0.15805.0_none_bd44b0b10d98186b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directwrite_31bf3856ad364e35_10.0.19041.1165_none_51c2d3ade8f8f246\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-ie-diagnosticshubis_31bf3856ad364e35_11.0.19041.746_none_d581d37b912a7b88\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\TimeLanguage.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-svsvc.resources_31bf3856ad364e35_10.0.19041.1_de-de_bfc8b07a370e33ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..favorites.resources_31bf3856ad364e35_11.0.19041.1_en-us_85347268a334471b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-audio-mmecore-acm_31bf3856ad364e35_10.0.19041.1_none_96d696a28066f556\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_refresh.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-winnat.resources_31bf3856ad364e35_10.0.19041.1_en-us_6b217a6514d7055b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1023_et-ee_e6e3f803d394cfff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_e20a09e712bd275c\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..onfidence.resources_31bf3856ad364e35_10.0.19041.1_de-de_67e161fa2b5f0735\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_tpm.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_597793100b99c168\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-wwfcorecomp.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_44060f38c5cef92a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ctshow-dv.resources_31bf3856ad364e35_10.0.19041.1_en-us_ce36b4a7501697bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\x86_wpf-xamlviewerapplicationmanifest_31bf3856ad364e35_10.0.19041.1_none_c257a9aeb7dc91fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-runonce.resources_31bf3856ad364e35_10.0.19041.1_it-it_581fa2c5820a2ddb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\x86_netfx-aspnet_appdata_b03f5f7f11d50a3a_10.0.19041.1_none_5bf454b921ca2c86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\TURKISH.TXT	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\WPF\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.19041.423_none_edab5dd3a4c202d9\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..filterwmi.resources_31bf3856ad364e35_10.0.19041.844_en-us_127c9c347e0b8d02\n\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\SquareTile44x44.targetsize-96_altform-lightunplated_devicefamily-colorfulunplated.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\SoftwareDistribution\SLS\8B24B027-1DEE-BABB-9A95-3517DFB9C552\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..lprovider.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_da8246a692dc70d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\square44x44logo.scale-400.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-150.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..snapindll.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e0eec3b90116322f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_e2f3aaf24de135ec\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-quickassist.resources_31bf3856ad364e35_10.0.19041.1_tr-tr_50bc8031d41812a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_mbtr8897w81x64.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_639b7c42b4b7784b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\msil_system.security.resources_b03f5f7f11d50a3a_10.0.19041.1_it-it_f6755d9a7370cda1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\msil_hyperv-ux-ui-vmimport_31bf3856ad364e35_10.0.19041.1_none_db0db48be3885975\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.19041.207_none_7c3810dbe95a473e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..ctionflow.resources_31bf3856ad364e35_10.0.19041.1_en-us_d373f0df89c253c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-composabl..ropcommon-component_31bf3856ad364e35_10.0.19041.746_none_09e190d066add4b9\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.1052_none_0bde546bcaf8e34a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..-uevagent.resources_31bf3856ad364e35_10.0.19041.1_en-us_55f37253c2f33150\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-eapttlsext_31bf3856ad364e35_10.0.19041.1_none_5e3e5c8d9a304cf3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-printing-fdprint_31bf3856ad364e35_10.0.19041.1_none_0e211e3b24a05820\overlay.png	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..e-apphelp.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_661870035f53b1a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-networkprovisioning_31bf3856ad364e35_10.0.19041.746_none_ab4b4bf819106234\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..ndows-media-renewal_31bf3856ad364e35_10.0.19041.746_none_ddda8869e0386ac9\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_wvmic_kvpexchange.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_7d61d552240d2a4e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ssettings.resources_31bf3856ad364e35_10.0.19041.1_es-es_fee8ae30d47b8141\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-rdpdr.resources_31bf3856ad364e35_10.0.19041.1_es-es_a614526647685ede\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-dictapi_31bf3856ad364e35_10.0.19041.844_none_b4a737a0a8a3d36d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..-universal-internal_31bf3856ad364e35_10.0.19041.264_none_660eadeb8dc39506\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_usbser.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_25eca2a6806abe40\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft.activities.build.resources_31bf3856ad364e35_4.0.15805.0_ja-jp_f42fbb0793b1f303\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\msil_system.data.sqlxml.resources_b77a5c561934e089_10.0.19041.1_fr-fr_20d64f8c263cfa2c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..rformance.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9229cf222a1087d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-f..overy-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_036fec1172c7e855\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_net8192su64.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_6c5e65607b51e6d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\diagnostics\system\WindowsMediaPlayerMediaLibrary\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..p-support.resources_31bf3856ad364e35_11.0.19041.1_fr-fr_2b7686924eea88ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-smbserver-netapi_31bf3856ad364e35_10.0.19041.546_none_28f4648fe3bb982d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevwow_31bf3856ad364e35_10.0.19041.1288_none_bbfe125d1b9094cb\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "HAPVDRQOHXAYMMB"	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HAPVDRQOHXAYMMB\shell\open\command	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HAPVDRQOHXAYMMB\shell	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HAPVDRQOHXAYMMB	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HAPVDRQOHXAYMMB\ = "CRYPTED!"	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HAPVDRQOHXAYMMB\DefaultIcon	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HAPVDRQOHXAYMMB\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\llsyriQkU2dpajN.exe,0"	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HAPVDRQOHXAYMMB\shell\open	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HAPVDRQOHXAYMMB\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\llsyriQkU2dpajN.exe"	e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe

C:\Users\Admin\AppData\Local\Temp\e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe
"C:\Users\Admin\AppData\Local\Temp\e520e80d78251c93a6ab15bcca6217d111075d0e218c2b571cdc5dc5d981d392N.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
a2340efd99364bc2f39c4373ddb16e53

SHA1
3b10c3a55d35c413acffbfd6f73165dc73e1178f

SHA256
a3f52bed4eabbdcb1d30084b3762f09584973a0b45ad1d61ef62cef09d41ce62

SHA512
8c9c6a83a484863b47298fd69e9fed3bd654ae45fa850e8a26f4bb8409e9091dce0dfadadb79ed5e2571b6e1c40ea1276c95a468436ba20e84e639750a0e9d7a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
25a2120c601011c49d300c8d4dba32fc

SHA1
63e11020e55159d823b023d53df9524ef4da28b8

SHA256
0264ac8f3c4839da3d360e2e5110bd12bec3fa57da1802be5add98a08d44cdb7

SHA512
873dd2d0d9e339396e8ff77f8e3691922c0451515b65a17e29f7de1f7000eeb4e01869d5917cd7a921694eb430983a877b2e07dfb6733cd19f5081806704af6c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
19438c6d0ddccab3aeba8fe22ee07b6c

SHA1
d8db10dbff9ff90122b943da45582969954c836d

SHA256
2c2f50efccdce841d13ca6b3b88629e381366113d024d0fdc13fe9e2bce9445c

SHA512
8eb0c905437139e9af73ad90343335f77fa2211a27328bf859b204c7127d167fe1afc30acd881a7e13d65f0e6a61a1b69937970a6b4e0be85dfd0bb9507dc230

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
879f09af6da9d397b5f16365b43c351f

SHA1
d2f673badc770faed8b5e19cb54f68a19883e433

SHA256
5ec2cfb039b92fdb1b8ed7f2ea2ef3edcf85fdeac83f765cf9df5a0f8949b3ff

SHA512
fea62e0300e12c974380469cf60b42c750e2f02d011b5a1ef0fe6cdcd8a3121a3e7c5bb83efc081447b4c0d80f178aa3eeca014a87347d45c0866020af08c93f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
cfc38066cc835c534faa6d43ca473d1e

SHA1
feeafe67e6b97d7608546a3ddb1f4b9c2ce838c3

SHA256
67c1b15f2e80ef2dddb80aa0ef16e862775739a4e53de5bc52c0e1452c3e0c27

SHA512
d3b869bc88d9bb6a086e656885fd2924c3c125a24619b9dcf40946edeb7a499b648a5d4c07389e0b6b6718c1ce3e72fbca5c3093966cd804e75f2775e6cad0c6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
6a332359ab4d14fe4fa4d10f054e926c

SHA1
be83ae6d29956fdc9a0b9333edf6bad5495cebbd

SHA256
377ce2e0d48230fd57ae3eaa9ed79e5721d77700638022fa64b48be46323f1a7

SHA512
71899f552c6fb5fe9c2411879ba94859e8872dc5374cf249b0da2b42cf280560707452725ee628cca502d1b9e52d9d18918280bc0ab521fcdfc8562e8d094539

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
9651e5f829114759e14b85da3621bbac

SHA1
b11daeb5f561c54bd33be651d687927f8afedcb6

SHA256
44a7bb3f7af5ed745565d5e974b205115ef021e50200fbe48571b6c271a90863

SHA512
1fc72e13152b4479eeae568af54e29a1e5d5c88c331d4bc0d5469236f4764c9eea5bc34fee1110425d5eeac5020bcfcea51eb70b7b40e1a2310f388ef3935d17

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
cd93ba80932e111aabf943f6b3f4570d

SHA1
dd5f020278c184e604ce50f5da3f6c16038d6043

SHA256
e6dea4c9cc15ebf4eaff65a34aeda05bd4f749601f17f6314ee2f4a9d57f22bb

SHA512
353cabd1500005a70116e4f2bbcc92dd4a676ff81a36cfd483aeae01f60a83f29bc976f6de05611c1debff3404b3733a7a79d0fad3246d116acddecbb5d396fc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
72f0255c235f36f4c961c117a24d924c

SHA1
931878d6d0fafe86c557ea62f077a6a9eb2d062d

SHA256
460c04e621d19b7f323a07a41e17cbbaab76a3582214a3dba8377caa1d42391d

SHA512
5c861ab4a5bf7c209af182a6b3e262ced7ec4c643d2d6be093fb8289ddbb895a98238abd2bdd0769568dfc8fbe10a07653a8ad55457d47e9e15930bc789d6b42

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
920d03c722fb206c8f3602bee3013522

SHA1
b9f8ccd31fd3d7690cf284c00bfb44e0e72bc3f1

SHA256
16812cacd114b4d1ca6d74860e465f148bfe5443faf167eebb6c358269a5d60d

SHA512
72ab50fb92018b43a750b9f664bd8c8d29ea3db6a27c19d137b8ad3b443b92f9b392d73311e477f9f9112907111ed1d33a1093a4d1f3cb41b3af5616894a154a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
3632da659fc3bfa0691bc7796aeaa5a2

SHA1
18652b2f0390c6e045cd91eff3e9c6988a76410c

SHA256
0ebb9081be919c72201f0e9f85d939ac65811909e195693fd32bcdad113c4bd3

SHA512
da61517ccf7fed74e4002e498190c0976235f0faea13ed5b4d865193e6a528520588940972c41a942b607d44da4cd46248308fa325c941c8aab5ebaaa8010e62

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
293635e330f9e3af1d43be48f0700287

SHA1
b89104f6cfbf2015fe16e9e8904f4881a6ca38ee

SHA256
23e4dc61e844da465ab0a8d78cdfffcb6b127993b83a3a79a8f06c431ae9e14d

SHA512
91cc5e0bea1b2c29ed4a6057bd236aca501615d1472e82378802e728b0bf96fffe22d43e4ec2955fcec62973f257e36465055d958133abdb01a97b1804489b47

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
cfdfb9041191a6f13a658302689126c1

SHA1
1a01e6171dd5709ea438fec84b09bd94481543f5

SHA256
f6f60ea6686ad96378b849280a3f0883ae2651387980f291b3d6b69b39735978

SHA512
17f41199ee7f968b791515eee4cd8e2021cf994937a37d8e4057e328598bb73a7ee8f15ebab6e3fd6ac27bde5927e65ec79c48723ba68d207cb1e9710ba314a7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
61cc9dcac7fe0ee155dda321c9c63092

SHA1
322f6a2eca7b4fb090408cc814914426396c00fb

SHA256
756a9f6be1d4a603c211dc7683a61f28051009ec3f15b85e1648c8a9d0f19ae1

SHA512
39abff8072318fcf650eb887366fbec0a190c39afbc6d6cdd507d3d53c63c7d532af0668ad59f6e606dd3640a9972f22cd0357e79523a9fa498e906528fa25e1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
4959c6ccd7edadab55f87081f42f74ee

SHA1
cb54a6d573a0d77b1fc1f48cc29ae0aa6a747627

SHA256
278fed930acb37dc88c4b8780593ac01595e75f5bbbaabe67d809a646d34bb93

SHA512
4759749c8442c6b144114edf3765810c667f8d9c66d7a8e006a48c5ff2bb17b72767021173d8dde0c1f0555fdffbc090b0f12b632eb5b79886ada558256f9500

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
c4a441d91f9a25d203c9256f0419cf96

SHA1
dbeb4deb7f35533e96e4a6a57a5cc2a9a967f303

SHA256
a31e767a857b4235946fe7f2823a624160debeb3f1db50727b91ddc1cd888d2c

SHA512
d11278df92db02592415fdd6ff8c95fe6ee9ecdde5e611fba7e030a1ad478d37a27ca447dc848fd462aa296a8ca2d5524e9b9ad2195562972c5493074f4a94cf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
be313f25bed3c3fe643d3e7427e28ada

SHA1
9689e9666430fa1fe22ad403c9622fdcd445260f

SHA256
e9a7f198a4c0b2753f931e0c38e06c2cbe8ad5190a93efa39299d8302b238fa2

SHA512
a5b1a458adc8d332eaf547c0de6b1db91e5aeadc5722a0d7594fa5f3779016efedff95a6f3d15b78cf85ddd01529c45944033b716dcf324050ed663303541721

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
983f83f8ebebb51ea3b4394bb77b28d3

SHA1
132bbdf5d6f09786207a873443a7d94b972bda59

SHA256
5a85b780c39b2ec0665cac04540cd5e0bd58ad9054bea4dd7e5a57823cd2106c

SHA512
05e21bcb2ac75e2b401d0ea13dd07e9d72d7c9a923ec48eb1a6fe0c591d3c7e860606d2dd0b036224fce9e29d983330df205e511d3b01f92ef4404c596360e64

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
61ffc5d74d8327bbc51cf6a815e06202

SHA1
09ef4b846ef2d0b281c28c2c72f6c870783cebc0

SHA256
eaa67f06a2cd0457f3e12a0492b9e140dedadb2a0fa5270f4c4aa2f6982d4f7e

SHA512
9b45cb8ff6eceb7e87ec8206013dfab6e58344edfebd4fa2d2eb26c5d467a15b1fdc6c9b447c30ad20c6e4cd93300f7259ebf245862cee361d9b5cf7c0578560

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
c0a4444931eb4cd21d69051c0aa5060e

SHA1
17537d2a2487b5a179f4396aa1c79bb2edf7871a

SHA256
fddec7f2488733a094c3d63bdffee180b2ae060452ec9e3b2aa1628ff9c1932a

SHA512
ff7a1eb9d2999471412c1caebcf84c419d75280fc78fc1aba9c8f9b83879c806d996f06bc6708b6c18ad368e0f0cdf26abf4f5b378e9bc6c605893f4ab8949c0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
4bc0c1d35091cf4edd0837985419dcd5

SHA1
73e6d998d62e67fe48a4afda1ffc0ab3eec27895

SHA256
efa4fc014f6905d0777a574819ddb36aab9c5caf9a1e4cf2de3f0678e6c66a49

SHA512
08dfcc69442d9023fa82e821742dff7fab348be138e4aa63a28373ec11fb169772ab8b45d6f44f2a4f1149cd41792b8666fe0d3646b94e172acad30f0c856768

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
205b82755b89f5ee3f0c7f6e3f0a18ff

SHA1
706c1b9b69e17f4faa269d9db101efe7d908e10a

SHA256
52d1b5590e0b0d79fdf62d1c0d1a3b9c749df3df1318459e00c857468f78aafb

SHA512
999122f0b916f79aa1c63145edf65e788cde463159aee485ea313b6fd48dab67a05611e610df5651274ec644f1577ed81c8813fcc76961bd79610efaca4eebfa

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
7cf1b0c11871043cdda802bd24a27707

SHA1
a98b7b5f1c5e20c69333ac267ced1da73a5f63cb

SHA256
7f34aa8b594049b88169df5c99dd3f37a3309fe8d3fc6763002162101f6eadcb

SHA512
4da0065fe182f83dee66c1433a47d046bcb3910701cd81d18bb69ff5be44c67dcfc3342195f430b8feb820fa0b69f8ad863d7c7537f17a32f519b0e6d7eafbe9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
03c7783de63a87c9c6fb202eb7078f44

SHA1
233e3b741efa2a5cb6830ffcadb34c33ec8fc489

SHA256
c40c6174851199062bc7b932965f9a1d85acdfd14cd9b7945d6488f78fb92462

SHA512
3c76af6664d3faddcc251f692c1d3cb3e9ac0e5e0a9728aedbf47a0e5a0f7988790c22dd387be61364ca7ceaadad2ed8eb9a3e924f64bfddcad29b6d6cf090b2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
1982ba0d08ac1f36ab50a33a9e3cf33a

SHA1
b6df3255b0d47872dfccc5206632e2c903788ddb

SHA256
2ea260f049bcefd83f6c4442484a9c71bd8648f00d75a4812e6c844e43144098

SHA512
0b842e5764d12696ae32645d477dd69440f381cd5a5e1b842b2f05957ca3f134cfb482273c3c8d86474a692b7043e2fb5432151795d2d018da88b82ca54668eb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
e061824b761d0b846ffbb9404ccf8688

SHA1
9051404d634daf6ba66d8e92da664fda51306bdd

SHA256
3614031c510f978cf003520fc910fd4ee35a358e1c7c1eccd0ff4ca43539c7c1

SHA512
e35881fc31b0279f8bc1d3815de7d241326f1c63704a51c1ca894756e10eb691bb4f42aa35997e3a1bf66091e47d3ba80a431388ae59d97fb7cb1d9d96a6bbe0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
3612a812f2e41e66f0dec149b9e25962

SHA1
51faa97ab299260f7f1fdcac1682806204101cab

SHA256
79a3eb4bec20db080e037b687dc2e663c95aad6eed307011883770b9a7be624d

SHA512
bf59808f20818c608fa4dc5a004f29166a1e33842bf75adec02fb30f74d07137a3c49a65c115e1970ec41a4582fbdaf82d321b2d8770830998caa32bae4d53c6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
d07030cc9855b9ce0bdd449bcdd33313

SHA1
50f0ce0367143404db509d97517056dac3593043

SHA256
579c669c2f5ac3878091abef97b018432599ffb6e103c3d1bf9422f9b1e45388

SHA512
47705a43d3961e389249fe57f13495a4c3d231be8e1e11ae1b2085e6c0351aba47234cee1fa74361d5051456f697822162c0c011a4033d652b783d253423874e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
e5dc3eba874770255d065f006a9878ef

SHA1
412c13bb1e054bff4e60b6265fcbaa32a440b890

SHA256
170d783587eb1323d55c135cc3863ab5e9664d52b98e3eb147e96c672c6f00a5

SHA512
0a9580cd678252aa66c50d89ccce3be8872652becaff885a5650c5884b6f6df533bb31fc5eb5b4945c56032b9e58a86597b26d647c0f3de52d9be35063851c44

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
decd93e3bb6a5232a6827b167951b847

SHA1
c7dd48a0e5cf5c1b66706f66b58adf53b981a3c4

SHA256
0c80c80b4d5df81e6c348407c12af9c98e3759589fcb12196cd475d953f571d9

SHA512
613496d0c884d7d3fb6b273ecbb8b8d2bb32dfe244fc4daa1497c748451b4868222cafc1acbe153aece1640a9eb2a7cac1f3cc5c26c8596ff4be4a382a40f5f3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
08a88d7dca1e5095c102bccd41b284cd

SHA1
d431fc5ed7425180b260e088d6ffcb5246d42c42

SHA256
8f0ecaca2905a5e63aa4b61141a96efe279c8698b77cce8deedda9c637094f12

SHA512
04770136c7dd8522d142c2a09a9fb4ffcdc1c65f4f57497fccafc4b25dd90c00be49a1dbe83d0232195e1c61a4a3b7009e4973a7e18faf040bfb5b34952abaec

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
839d5c74a0cf319f90ff8dc693a8b1a6

SHA1
216a03d1adbf37ef7240044c6d84af5675583be1

SHA256
8d4f0964f6287167c8c7e1c46b6f063959bf39243c941279019865f0983c7836

SHA512
e13e919b8da6b1a21d6218f7a30afe4ea3e1ffa00d3eb7196cef8212c6416933497fe2b78037eb4100edab1dd8b2aad498c29dd07fb6d02ee6b463d3c708aa82

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
5fffa64cb23619260f2661581e290d5a

SHA1
a0149906af7531163d2107bf887ca0f8af6d1b71

SHA256
31b9498d851da04797a715220a2e02bf7b7158d6c0892b447b261aae4757b8f2

SHA512
6953c7fc31fd3122b321cd65d432fecfe3e67ddb0cc1f6268993e75d97c1136fad56405a8503fa1d09d3adc30fb65574c6a7e73200ea04b3d16b81773f36dfbd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
1ff03e00e29722372da0f2fb08b19f13

SHA1
7b8e9642c639cf0886e3ddc33d4bd7b3b43c5630

SHA256
12b3b1c8838ed83bf76ee3968dda93b78098771e3d77fc7e8791606fc034cedf

SHA512
8a16ca6170483a037be626f54878e15dfa1b0023db768eed4bcd25b86e58f550c8d0a3ce4a0151a2d40227367656b9af4d4b7579ccf922ee9d08f1a5cb871828

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
c8d0d711111edc43f2adca19fa4cdfa0

SHA1
37839cddbe2f88604ac4ed0163cdfc36ba00936b

SHA256
d32893afa9bbbb88cdb0ee992243de2511afc0a3d3ff6e463325e510b8892ec4

SHA512
174893a0521243441e1c620ce7e80d4fef722051d090fe8a84f69390467100b1b5ab9979782da404e6009c192da500f437d606dd062fed7f33e28d4a586edcb7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
989df1181047727dd373774e4e6d1a1e

SHA1
afde5c223c010f36cc482ea769f586566b35ecd4

SHA256
bd57fc0e1ce6ffc0d6b10d88f3aee617cb80f94472759838c2cc7d7290b8a3d3

SHA512
97d91d4177783aeedc0db0dc6f9562bdcc3cc168cad0481daa21a006af9b95480ed4593a89ce276314f607ac65abcd5f04f45348944ca8d74343af66b366f171

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
c87e8052c8c4f78d9d5bfa0dd26e9ef6

SHA1
dbcca591196b0feff9700e7bdb0c23015037ddf4

SHA256
496965bb7b10421a852092b4f52be1642ba1f2134b34fdc0cf805b0c34882521

SHA512
691e6eb0d44244f224235da9f93161cb5dcdcc4fbf0fe7f486ed3c3d205fb48da57721c645ad6a535d6a01fae9e1660f37dae797b410a6146cfa5f20465d5b81

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
7abc09e78775e8f11108a8210b7fbc20

SHA1
73bf970fe8aae4c532af9af69f644d2a59adae9b

SHA256
14e140c997c78514f840fd0f3267b13e415185edafc366bdf535f60ef0954714

SHA512
4e5b792742742975b638f5043ae3a9728c40a0ef70b4c55fe405ef46912a31262cd84debb1a631a5df0f6b05f6099c7a7606babe981a512cab4d1196e95f369a

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
210B

MD5
ab9da5ed186b51c64d4eef5afb2e2a09

SHA1
b8220000a28a18c74667236a0c17c52d2ddbb6df

SHA256
4664789a35bf0a204358a5f17ff1949a9656ab90ccee20ef004b65e305b6d745

SHA512
2b2ff33612c0abf492319f30f952b2d2ce9af45e92fda421474725c4cf11d6587500c805460e4cb82824cf920d9e7aa810103ef47bfa670f20155773b1bf1aed

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
29afb79f9f745a70ae3dc62665a888dd

SHA1
abb8cf627612eb9c358aff8f22c00277fd81c9d4

SHA256
c8ced006d22a9cbabe2fcff58392e2210ae953d82fa7af17437244f81d816965

SHA512
098b4941a78935933710b45f512c0badf541f5ad24bb096906d71ce73dea44360236bf896367ee4f9896445d0845c462a1418c646896e1bf0dfffe780f896c1c

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
084c049f36f348d0862a079e9a5f1aea

SHA1
8645e3e38c54dacc65e49b9d8aabdb923c403c57

SHA256
c1393f18793a97239c5184c303f85289cabae9d0780879ce6ff9a4bf57391dd8

SHA512
eb369c73aad47981a0755003dfd4cbb4cec1a2c29b90db13c8fdb9fc714e0e2ecb13928eb3b580892e9e047a465784e60430c646c601c7b60a88bf775c1204a9

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
108adf886b12227ddb0cef3d64bf1842

SHA1
37f9ace149cb2a69167e8b462d460e29bb87cbbe

SHA256
8abd5a681e46e63fbb371dc9819928aac1acac6e3209ff737c6bf4517da20e6b

SHA512
06e1986c7542636afcfd82349322be17fe234bd64061ece69e95fd08dc402b97f119f3f7b93d1581163b47202f5f366a41e702237462a2beb51e53289b164ae1

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
710b99466d37b9e4c8cc008a0aab02d3

SHA1
760575abc1b0503874919e43d16c6eb76f4b0f4a

SHA256
3cff70e41a562d0ea96e6e53f6ee5d229612b6b586bea103dc157958b5ebf17c

SHA512
44eed09c020fb7e8ec2b1b2aa872b0e10639dcfce50b45f3f98bcf743c3c966f9e7018fe4100d628aa6000c22a1f4e36120866808bef32dab98fcf75b7297048

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
78e12523cca6dc03d825a8fcde05635e

SHA1
910125a0e14f9dc25a9f183349de317c82265c23

SHA256
9cb323d054d57b59ac00690b57b80cff398be668b5d7b61e3da6181795e6bd0b

SHA512
4589bd4c1489cdb05e1180724019f2464b49baabb824999b2af2d18bced5248df82d7b3a8004fc226e28f27c75adac2221639bb7515a3679f0d6eec7b1bfa0bd

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
b5c698be70fccf80ef9e2dc6ebb1a501

SHA1
997b6ca84caa3eecfc7a4f54f21d5a318459ee68

SHA256
f55964406fa72677fec4031ee059b2ec9defa196830ee0d914ebf7742b696636

SHA512
87592e6123c0985a1393434a74c6f7c11df191cd4931f3079d8611072928e71b55d3896050503c2a4c3d1afa9527416daf685d2ae75242e4b764238a3ed3d733

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
93425b008d9f06cc2351a8b7664adf5f

SHA1
a95ffd5590719cd3f7d9e2b4147560a70fa8aa3b

SHA256
d5513aa2862561fc831ee80bf4618b4695b9a3f288cf4c833127fbec3322cf4b

SHA512
3eff41bddec7bd2e0735b99ff8834cddb05aad4ed82a8529aefe8b13e31cb534dad70a907fa75b1af42deafcb9be5f92c9716c8ca9e273d7d5afa21c03dc17d7

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
fd19b29ba75371799f32cde9ada63e05

SHA1
979414fa658c879b6d9ac9910be1f7cee9c198a0

SHA256
5dc77d3113b6225e0353644cd4a8968afbcd9cd0de520d9d13d1bf339a935c10

SHA512
8a1a1596ac192fa2ab3bdbb321fd139cb5a64780c3c47408868cc4c3ff67570a0d168e6168a984b0ddb22888462f527063118b87a4df8837d2245b7ddeddf762

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
e2b26005c48a385f7aec501cfe4f311f

SHA1
e36b8af60a301ac02d0b2a91f700cc12d4db1a1d

SHA256
caec7ef2f7e90fff6be2690b66617bf91591fb4dc72c6b34bc23281abeeea9a6

SHA512
06251a740c21fb02f75f61e874b7f471b0b2aaf6f49bccf73c173aa835fe1da6989870ad9b0338d69fc3418a49900ee23534b4aefe126d6206c6b9252d4f3631

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
49643062568c3b51f602e480b0a4ee69

SHA1
0c0e5e62bbae0bd6ec16fca5d4d65aa0dc643955

SHA256
c520513789d1ce19cb658a8df6547151dcb032da8f29950547d8e014598df2f6

SHA512
77aafe2a219b9e1ad60217f126c24908e1a5ddbb63a58131deb1bc7514740557702df2831cd99b49ff02bb4c8c08d4da544895f273061c85c78bcdee0f200f70

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
6c128321b5edb7e2690b1b5b1d1d34bd

SHA1
12866627acf44d386a3d18551c1a1eab83172968

SHA256
f7012c83e7bce10bb02b852e31fab1c989a8a2f98b1f1b20e32268aa73c2848c

SHA512
3371eeabfec11ffb60f1f15c3abba74c9776d4de13e4d0ea8cd229abdc0067f34d1a81d92f8d0640f3ca761adbf37a36e9f2b11e7695901d35a0e87d836ba9c9

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
8b8bd7377315e6426eb4f489e30f0027

SHA1
0b4310acf0a09867a43217f57dec9e2fdd901bf2

SHA256
3316490c90c29bd4809fa9768bbd20fdfe841ce39e4a6d4efaa5689013a55b8f

SHA512
a4cc67ba7aecd5b697a8dac43ab300ef3daa9bb871b8d56b1a898b47e2af83bf29ac648190a70260c17a54e1450a813fdc74ba2a24fc074b8a1470fd42994524

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
e1fda36f7e4a6af955b80d53d8ccc5b9

SHA1
64c203a07fc4c4d2acbefa32fdb9df16c52a9ed4

SHA256
cd66a07830a3d00b3382057a204d8aa018d58b2248ae51e0a57bbadad78dd2cb

SHA512
97217ea78a44951e1e5c763f2379ebaf0c93c90fa0ddcacb9b1f9d4fadaa111887f8a516ff5d1ddd2a2db6c4599bb574bb8007b65349596dd87ba6f5f937c998

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
08a477da42c525a53856c564f162a9cf

SHA1
10a4b3ac0600301cac9cab4bfbaf91511713df38

SHA256
3c970dd15ac6a749c4b5e94a6ed57726c451ecc0d6df419c9f76e856add96a7b

SHA512
24f6b07653021f9763049252fe33bbace96d0eb74193c5d49d8895cb2f503609bf98f92a3ab0dc326f13aa4c49addd90f673866eb80f7884878af1c86cf03f4f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
84897ce97d37a3e83e4ec529f8fbdb2c

SHA1
b18e97433053d4105cbb873d94ffc5ebfa343a31

SHA256
eb00c83f2639301e490468649a9f2cc4e3c63b34dfd3f01ac564539462ae96d2

SHA512
6675b42e1865f4063828b704f645e3e9d6a3c78c8cc42b8af6918106a7751be6fcea751d55f81850963c2a44c95f4b3a360908753959d49927ba0b2b89bb94a3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
f64f0c5bac9004f56ad15f058cc76508

SHA1
bfd3675c9d14ea96d437652a2fbbb88a5d7d74b7

SHA256
4e69f683daf4c05254fffe5345cb0257f750996b6e7a53cbcec4cc8eeb64da46

SHA512
1af7222e07cc4e40b7c34019dfd6f218d8545fa333c574f718b160c8397acdddf335a4f59ad8e7ff543772e7859038c8ea63af31c99267e42bf7ba22446d96be

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
2484095e3f09237304bd787fad4d2f74

SHA1
c8cd632a6251b1f023957954bfaebbb94e4438e7

SHA256
40d61de9e77e43e49475436e749941f15cf60cbc8b2dc16f185a94c1423e02ea

SHA512
2787aa2e5b3332af2f88db02680232f83e2b147adb7abffc07dce3885033cac4dd3f002078225a799bbf98febff2138c64ce2533b3af79bddf72c1c5b3858399

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
f129708ba24a9608df777153b55c626d

SHA1
480e8d8f700a74b927318176305ca12a874b10aa

SHA256
96463e289340de88d3625cb2936e485e556a4c30e905b0e5af654a04eb747144

SHA512
a9400f5f96807e47ce685b8b7954bdcf621789aee84a9cf7bc0ec5193fb7996fb9533a2910b261c0e87510b5cfe6a4ec125db496cf2ae4144765892c3ea1e81a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
5ef6c2545e5f31d641e6d585071bbd7c

SHA1
76cc1990a6747ad357082aa30cbabcba930e9d1c

SHA256
14fd014002ac89f31d1808a53a7c5e8719e33169bf299cb8b80c1007883e212c

SHA512
bef40123361156c8559e9e00be2a422cbfd4005b1ceae0a54c5a72559e8472d9db9921d434afc9780ab0b2ea7cddea6a1b55e2cf221e4810d5ef67311bdbf0b1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
560fe856e0bac666e4548d74003ff8db

SHA1
07983836cd092c22366aaaf2e52a594d885db449

SHA256
9fcbf0a4d4bbb7f03886ef2bd794e3480a13fcde8511e966adb51487fe492535

SHA512
3ac81289175033deef0984b15b1c9f06b02f469702eb6d5f46e91ad8056d1c845ab6603cf129a0ef5e98db898480dadee9222dbe25d95f99b8acc0552578b44b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
d6e4bf10f661c26796486c0a62cba5ff

SHA1
782cfba1d6bb4589141ce437f3e5a7c08ef32138

SHA256
607b3a8c073e66ca26e2d4abbbdb6b99a91401fb1f51f4a940d1de538a2822f6

SHA512
a534974beeb2c4a2ed2f7d01eba89e140bebc74933e626c3365f382058395c53dea3a00ec683c16cbf750a2fa150bc5e746134f0fa05a8312a79b2711451f6b2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
460fedc6379133764ae63b7c7185c90a

SHA1
3f1de98e02fd9518165de1babc1bb658ef20b179

SHA256
16bcb07c1194453261ebbf0ab63758a84338d604d5ac106da63d6973bc4422c3

SHA512
e427c1739a8f073f6a02a420332436fa0760dfde09981161f2273255ca1df59102b2b25c66a666147e48252f9cec1969974a947201d05cb2e5cbaf648c700c73

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
d81eadca2f208e3652438290c601f4c1

SHA1
ef7d2c69751662672c7be2ccb1dd19e15e3ab6e7

SHA256
341910143960cecc33939ab6cef505ef3427d8fc1289674a702d10d154296c80

SHA512
5699fa8864672d6a74f23f26e400325952e794a251e17aa189e9d6377ef68f56f8b36623c69b1bd391225323e997129b13292cd3d2c881427811057783c2ebd3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
0cc8d003878a3a9374fe03f51c3e4fa0

SHA1
4bdceb39fd7307b65a4d8bc35189208ed2dc5ebf

SHA256
56227090d7b5a8809cc65f90c9358684a4b85d3e09d2ab9dc03a9ffc9967f4bd

SHA512
cf5f1d49b1ef733b82e8d09a5b7821a12e28c1c37c96387245f1a714be739b56c3fd57a7b22bb7050b77788115562acdce988cc515d657e8329c8882f208e81d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
ab35fdabb889ff9fcb572360f2f54610

SHA1
44e66696c6bde96fe129d5fcd5051d52a735e270

SHA256
9cc4f1ad89b59a31713368091e50906c06db09bcea53674a8ef285f55ce31fb2

SHA512
538bcb8722beb7d0b058dc33b9aef2d0932cdebd62fe956ff9e7e98c531ceac32a16e72f4ceb07cad9e9af106031a993ecba39dcad274f42db27634b2fd188e1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
1f23c45be7bf0f340830757cb90b34a5

SHA1
137e20de3013f5d4d4b5873dc639a514da1d112b

SHA256
4ff0404b5cf998fe777fef59e3f3efbc49bc6a65dfe78e6b9f628000b46e8a20

SHA512
0d27007c9c58a485f9694d038d2beabd7127b748f0b786b18f4505e2c8c9256fed9872d2e6d47a7dd8882851d7243b72d489f000464de416e6737b1fc7118c94

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
aff642cdecfb9d2e87f41b8897d7e352

SHA1
64a931c3775a223fc3a219b88ebb0ad1efa94f2b

SHA256
ee55449b931ca5bf2b5726dc0639783e3e1070cf24f4bd2bc9413b399b59dc46

SHA512
1e22e960a191da04102b7df609ba5344624d429da5c471a9614ed29a94bdccbbace82a0d38ee7bc5f8d9fbe69a1adac886f4b4ed47cdd11829071407f402a009

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
2a076713088b9024121bc2369977e075

SHA1
51082ac981ee48291932fe6e72ba408dbd2ae75d

SHA256
6fd3eb4d4b0175fbd354bbc1eec0ea0732efe018136b65902a96fb5f388dd04f

SHA512
9408b8bf22c01a48d7403e3d7601fb6db310ac25c25c52aa12a99dfc1d792688ccb6d99dd02d94a13567ed613698ab02be042dc17dbda8609b319d1364eb89eb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
10c1ced93b83a12f787421e5050fe0df

SHA1
0d081e08005bbfb5cb64e04e2a1975966549de34

SHA256
db27b9f86c2d278df5aa439d31dcfa0ce9aa105a6e5a7d23541511c705aa4140

SHA512
777571a31f545cfed7e59575e99f8b72d06445a51d03919d7fe0343cd8e0daf953b47203f58ae8d86791138a45d43d3092c3580fb961fe31cdf697641cb55d7d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
1e9642d46edcd34691517e1b327e15dd

SHA1
1a3193c82f277de501cad50760a1e5bca0d01cae

SHA256
36c42fc36421910d72b31d20454392db7081bd44a0a2444f5637c403df037d41

SHA512
3d1f7bf49caa2a1562bf489a1a820c7c8cc4a5d916c7d2251fc4cc05b7894835aca2cedadfb9626029250fcc01d20517ee256a2042ee34ee65b0265cae978eac

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
e63580c7055d3a3ebc9b9e8b58c0006a

SHA1
dc450ed8e967f99575cc6c61dd7a9fb5fe3d2fe2

SHA256
49cfb566a4850d5c4aff4393a6fafc97f229c00fedda30c820df5b37b4f48a4d

SHA512
6a57fceb13bfed3475ebe7baf11c0ef54b9fa75c17d672f1132c1cb8d49b03f5b661892cbe55352a8798fc26041bb8a4ef35b49bb45a53c8ab2442b6e7fd488a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
0c4f81ac9c0d6f11d84f4b259a032263

SHA1
b0bbb030ee262b15d8142ca480335448b01dfc58

SHA256
15d31fdb09ffd8891aada698f2426a95a742cfe4f0ebeb1b0015a27b83c3e6b7

SHA512
efcc481525061c723fa78ca8ffed990e36a2cd05ba99dbfa782d7a4c4abb7132b81292984a8f8ce822cea099428d82874c3ed5c35b672214c9dba4f5fdaea2cc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
9c18e7d56d760a7ee908be4d514c8d8a

SHA1
9f17b10777afc3a3180fff0452023842bd1c35e7

SHA256
5906cb9a096e99c6d6fb88b08b9172811ea387db18147b028c78ac37fafdc1f8

SHA512
2f745081a8a51b4fc3c1871a407f2ad3fb4a1d25a8ffa040a1daa8f77ee25a517b3110017dca7c6fd59001fb110b69ab0ab3a6c3f269609530e9b17bb329e96c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
b5ab63b4a05291840b6916adc1b58e6e

SHA1
ca0fada5c28c9732f5a60dceaf9b86759c4b96b2

SHA256
ef88f9a7787d13d3f49d033c591d1dff2eb6e7fb05f094ebe476e9120dc5c694

SHA512
07f1a1f78cbfb38fb027e2c0a43b6c46b83fc7c00a02310df8de4ce4d14ece12f16933417aa8320dbb1d99c797750bc4a7b6f14867d679ba045b606a4a7381ad

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
5e168dc1cd61245905178a4eea604be3

SHA1
d9ea59654b9836f118e8daeb80c648ab6ed68f0b

SHA256
b7c9da25595e4dd1037c6b76b0465cc8c9c3a7f41d0bbbdc0fefa49c320b35cb

SHA512
fd7b1f0fdf25ad45fe68e3a8234c008a917a53e1793f28aa57f3695a0bde8158635a640c60366683eb51ecbabb2f8817297b56f7e02d42c241c13aef1c99c0d1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
952cdd13e28a2a29ca2abe7501b8e485

SHA1
f8609c3295ab5d75cac0835259ccae046fab27f1

SHA256
bbc833b505aeb003301704e3d108abb1b873daedb97136a967a669f463bb72e7

SHA512
b060d6863857e3dc6826b5327315364c59140a09ddcb6be28c6b0e0909a24b6740da6e8eb5f9c1c234feab99fae592795ecf9248e48153b5fb0a58e6f1a52464

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
1cfc6b72eccb29b2dbab4032ac213b7b

SHA1
639c105c1aff93a088824bba5eec6d0b96569f99

SHA256
f0538457bb0a894065bf5cd9629c8328162789480b4175e51b9a0f23bebcd05a

SHA512
4d2caa830e934b8ec9c7011b63d4d0fc776d438d7fd4a8650dab45db1b614f137822bf85781339d35ed863a976ce93926e6ddb17a33f3f3bc197023bd2f3ee72

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
dcd07e7c6f1529a1dfff35abb33f5f0c

SHA1
496ae12e19bc875cfb8141d07d46ca6b867098ac

SHA256
00f16f39d3868b96e48f6c50e7b305f0a130b3520a9ec5253cb4b6bd6312206e

SHA512
e96096b8df3eacb31ad6115f9cc9558e37499cbd8307ae51182a353100318b9af3c40586551455b6b5adcab850b843c63ec93cbb5791c1b439165ad1bd5cbdc9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
fafb46f7be03973f5242bac3b08a54ba

SHA1
e0aaae619f445a79a20dede6ab9e8e3d27901db1

SHA256
b7cb3d6ca0bb24b3727ffd51dbefcca52fb8168f5a8290f90f1178ad21677e63

SHA512
4c11a0828b49ffaa4bec7c296841d98c171036a1a6681468160251f2a69bd7d401a0600a31b58b5e7ec55e5efdc756a65d507f227275e20d63b1e7b69b88012a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
d816ae02ed7578887de38d89c6ad32cc

SHA1
46eda38332e492b53da8ea1bb66209582727a177

SHA256
6a9019b7624389c58980537d3cc50f15af0cbb74142159baf828a507e0911f20

SHA512
abc05571bfd18dbe00d1f8a98264022df487f650dc62aefa4e9add4adb281e664f45d252ae738295b0c7cb1363e3f3065ee5dd8ff93eb41b7796ca1ba4c6a370

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
8b413d28bae226ecce682695f31fdc84

SHA1
a3b25c2079d9687bac047dd589e2bc853e9ce7ef

SHA256
00ff74d8e17f0f7830569c8aaa7819344decd53983b400c6036c445442096029

SHA512
79f7acab00d231aa7f28d5a5b683386f29379ff7ec853d582e135a406c44893ae4d313a51c899c3e3dcd4399f1922df4e903e02e3b8b757b221a90744000fc8b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
9a271b90340e7b374cbfc460454b3ad3

SHA1
15bed51937323ec40f6deb02e4ee49db9656012c

SHA256
393b0cca4ef9e3eb64d779e6ce045ad827498dbd3d9950b2cbf5217728199cdd

SHA512
3207b6a979767a41c69446d3ced0a3c133550f0de0106d48eb37e81059f4b6b7913daf141c62e0c69d8da5392985d6b96d36bcbfdb5dbc9fbcd333e452a284f8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
766cbef17ed035ac28073eba5ea50f13

SHA1
3ff022dcc3b6b8a6f537bd7b42cb2b4f25a6a89c

SHA256
a09d038c89d594823e7287efd4b19d30ed56e00999627000274067db55bfef76

SHA512
f7a4e2333196d1e4680b9b1616cf731a444d12df20f9f1f4210b0f501c9a1b0cd5440af7ba9903852b00b63bc905f0f6c806003be05b9dc4600a003287a2ff23

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
770d0bd7bcb2291b9be8b43b797d3287

SHA1
6d6a82c0f16d46dffd26f2219af2cf65f8f55ae5

SHA256
385e70de5dccde755d5b18a54168d14dc754a49a45bbe30bcf8eeec2328c05e4

SHA512
d4d21ba855286cbbd33bee00db3d02102b86178f2ce55f60e045c95b6e334c1aab67ac8b06d5457f4622eda7ab068d50326644ffd09eeb7958cd9a4d2e1bef9e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727661458781162.txt.EnCiPhErEd

Filesize
76KB

MD5
37c59539dcc1d5b1bb1b600014f07886

SHA1
3f5d7b58f53f0614ea7d23cf1f747a0f7515e039

SHA256
a3688a8ff3bdb569863dd3b968eea42712adf30e44d7ae6c7411d70c6fe0a0a3

SHA512
4b7782c16e8bdbda81d5377407722e8cecaa68bda978b8b66899db196e0d9d9e52c661718326fef7ed786cd2cd9c27aae4072557a2ccf7dc23dcfda555d73dfc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663116015387.txt

Filesize
48KB

MD5
abaf000223b4b4990e6e5d715c706cea

SHA1
2c0da79d847d0d7ec3808ff3a9428dfa74af5f9a

SHA256
1dcaac8bbea9c1e105aef5f36c649b8a2a711a646030632b2db8be0f4f381150

SHA512
59f8520fa50191e0014e88bbee71bb0b0d5d8392e384ccac9bb965ef012a78b2f30111f1919f8b7002e5d18593b33985b1fadfb4f825c919131c9bf78b5eb537

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727669820222616.txt

Filesize
64KB

MD5
9ed50b2048df3e79e1dab100a4bd8a2b

SHA1
0d80fb2de5ac4e1768e8e9fd8f074a962d8f32ff

SHA256
948b4f28e238bd4d732da2c1a1fe02d06040e1a5cf43827692bb41bded3ddf9a

SHA512
69bdbd2e98e21b83ba6e4b355c29dc9d04e1a49ac88a168df864a37845ce4e078f3acf704c15cf59821aa81230f67759264dad85bb52257489d20118a380b574

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727672589120253.txt

Filesize
75KB

MD5
bb09a12a219b071dd1832b5a69f2f54d

SHA1
3c94d92cd4a9eebf3dfb971d97ce96a9e088f8bf

SHA256
c322eb926c3924ff7f2bd8a49bff9dfc1b900aeb59cac0064026193b2c8b8b75

SHA512
dcaa5c0c098c94710e73c8bdc7cdd52a222c72c679a91743d06357affa91455700fdda577b547b438479c34b44f9ac4e1ff28ab1a334af3facedfee1f82cb3af

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
db82a27a28abebc68abee58a927e36b1

SHA1
68de66e1622d76e5c125dbe6266b8d731bac4b8c

SHA256
a7ef2b52763d77aeb3531c80f3b86e3e9c66f3198bb2b565fba2a5d3a7709e31

SHA512
68113a31e2ceb6b3da50a8efce6080a14e2768e90ba2f7b916895be483bc39a44be345e84d146708bbd973781c84621183c6a6be5750c82a0db5b177949bd77d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
478bc7fb1e62c56eb647f0b389ab14bf

SHA1
f15aab0f22d2fa8c223df1f1364468136c39eb41

SHA256
75b709a30c0870ff79d3d09b08298374a1127766a632b59d90552606b9a9a8f7

SHA512
6649bec4581a1cbbc62ae53dc9ef41c100a9740073101145e949e66e67ba49003842a0f07febbed19cee7abb3447b466d167eaad6f74ab2bdba23d4efd8ad91b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
fae7417dfdebd87f7a94775c73e52627

SHA1
1d418e20238fb07c220c4fdc444567282f896f5c

SHA256
955a23a02a001ac4b838483fc71ca9d0bfcf4dac10f9c3bf0c1fa5222a4c464e

SHA512
3f3ce0850058270ca4928c9adb319ddeb93a8089c4c3e4e4811281fd7eadd213542257c00ec31eb84030eef8e170067858bba46ac4d4bf173a57a3a5ebad81e7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
016e89f565747a7d1a7b3a7d8837ab62

SHA1
9964c197b04171916c6360f5970cd13eba3c9a2f

SHA256
6cde67ef60a3afc121a4553093f2815259eb933ad7616d3251bf1fa6678d38b5

SHA512
5718ea140f2f1657da81a12afaaa8427049f88f50eab7ca4f605e6ebed8ef82a04b4fb2bef418289d1486766fd7931f768b7e20b626823c3f48d64b57609dbd2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
53fbcf4223a6faaf4067f1db44a04bf5

SHA1
8a76614ea63beea032045ae6acb382b3b5beff88

SHA256
c503ecc783f016516208790f1dac8c144f9312386b382ef3027bb39162178d27

SHA512
c5e8a1872aa067062031a6dd6b5b9f5ff9433cfa53264cd1e32140e8618f9560fcbaee64054e4e86258391ecb96e59a39a5ff92f6028283bafae68e7486885d4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
884cdb8fa3ce2aae101da048a2dcb65a

SHA1
7dc51dc749da5c536bda245749780417781d0a27

SHA256
4c7f9f5e4fc8806b9e55e912d54b7074fe3c2021c14b89266a8524b6d6d6f404

SHA512
6479bb4600fe22969897bc1f7429580f96761790157984599f1248f6edc2cf7082c05b13e8190979c4db6a6cb860ae6903ac460c3ba25f7f65c0efb8e5fdf8d8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
713c82ad2b2d4a6b6e3c48b1cf4bdd04

SHA1
29d8b517438eaca2542defec9e2a997377eda98a

SHA256
9b33e31bd4e9e77e233f2dd68e8de4f3429c595ae8289c278f88faf1500c2798

SHA512
21eaa5118f68ea07b6f53bc4c018d60cf641708737b5c0683d2d73b9348b6433faf69472cebbd8370a5eaf9fea6cf296c2301fdce2817008b338610a7e14d234

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
27698a0ac195829f55586586cc6c3812

SHA1
c96d174e7a88b9892fd938b869ead305b3b1e25b

SHA256
eddef17a6563c1013d9f9de7face2ad059e76529daf0b132dfa2ba66edbfee4c

SHA512
609c9ae7f85a696686fd0738771e387f1bfb3125f8d16ec0c2e7890f49118f2fa559748926de10591445789cde7877ea78dbe51d994b184be34336be24a6de32

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
435a7d0a8ffb995138b68ae1b83b0103

SHA1
6d58d94d2588688f35c0eb74c4f5ba7efc50c091

SHA256
eb363739f1a3552750c219cce7c3412ab5f437ae1ed6cac3b53adf5b0620a232

SHA512
1921f0b80bbcc5019cfc4993072bc7878d9399e84cb20614f807e18f45221c7d44d21fdbee1e30df8cceb0d0f68f0091e49bf1865eebb575ed757d820326757d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
a4858bdfc6a8c2f77c7666b9cba76f0c

SHA1
3d6bc50e18d155c41261435546c028e9bfac5d9d

SHA256
524d28a45b8635deaef0e96cbeb656e30e3c2a3089519d3c0b87ebfe1960c4de

SHA512
92d56756f47453801b0645769a4590fcf2e03847f054f65d875c2c6e891c34b7b379719e8096a804a41bb5e9697fa19dd7e2af79ec1430430db5ae9214140b66

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
a99b9c6bf5d1ff63d1ac0ef972e463d1

SHA1
cda93924ae927936370cb338224d909c9de810d4

SHA256
975da1839bf8943614981938dd62e2603423100c58034fd45438296666de30b7

SHA512
c0dfa3e41fde33b016b4fe82346108f81c17b793ed0b5e802b44919e88bfa17e4adb872aa9c8a4875f6d9c187b78d4932352857ed2fcce63f6b18f17c7e2e219

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
5989bac9a43cc4b5b5a22de974f95d99

SHA1
71f274b84f02eae83c2c3c3af495fc47a61c3ab9

SHA256
af2e8600f159e79955d860a1da9e8b1c62296c7a2489a99eb2ce67269f19df5b

SHA512
ce8fcd7591a4385cc75177d494ee675efbd9be8beaa123950b0d186162c31873fd64b0fb0e3ffd8cc802c5a7be536dcf6df553290be966c34bf8d9a6c9b6ebf5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
7f56946d5a45be825cac8f32d9c4ed67

SHA1
9331a7d122f83d6928a887190ebebf963c77ac1d

SHA256
5902ded570dd007f8273b7093b81c2fcefcb1432566adccbba01307e205e6a8c

SHA512
c50a9bcd709c69370cdfd8bfe7a6f551f9522b53f232cad445102b569a5ac046a42ea8185a69e0478fb1497ee830379f8f49ac54a10b0b0027136e66f03798db

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
a483635c4f2b164cd6d857b19de47df5

SHA1
6d477f60dc4f2f225c51945c05a48ceee7b109f2

SHA256
2cf68461ee0e380cab6054a0f2c67851ad9de5f32e60af00c8817090ed2c5268

SHA512
12b39120d0995b7b6c74e4bb6894ed8ff9a01ac504b0adf3ac4f030107e7587e45b2cdeec5660ded42569ec126ca2f13a392f2c8dab5b10bf8d85a5c62f9c22b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
70407595ef45b9d275e15ed51c5eb31b

SHA1
8fe998aebd97ebeb0b9c62d6e3f9e8c6fe254c68

SHA256
4b7ee53c74631f9955b3e3ae50ad28628c40b7ce412a065b5bd39ee98af7b03a

SHA512
d84642363f4a263bf532a19ff685c807784cf67eb5d087235d4f7d28fe1eadddccd846f6aca230001fd0efc2e16f4aa1fb944d581696c694317db0a23ba1f5bd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
f47a7af6d65bde15a1d1dfe16f2d0ba0

SHA1
012dc88e7198df92273c9a2930aca779ff1046ec

SHA256
eb238989797d4ab61a029fbea8aad931dabe65c808c176375df08d201fbd6004

SHA512
a397d14c10a2d601f89f2401fb4014145b5c188d19068603637aefc388a2aee8f160f5b7d7666eb3b1b424bc4bee0ec8c33543802140947eedb7ac94d18b7839

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
387367947e081b8d0f0568788b15183e

SHA1
c9244514aec2cc2b5edc8a5ee14bf3af5e4845ea

SHA256
a5e577a92dda957cf77c30496e705a1c9bb31596d0b591e30ed89e609365b5ac

SHA512
63b10e9eb91ff46289b15e29d084f22a9f4f604ec4e750ea9d5783d46c6d10f0325da6a8e7f381181517b590c1488f12d7b09b003d14d9e02dba808c50b26bff

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
91fc0152c6bb49e013d67484d8171edf

SHA1
dccb815a191f587d600abe2f49a8f3f7e8fef428

SHA256
7c82e017f7c6adf1b60c69f1a090bf3da356cb8786424957eaeb0ebabd83aeee

SHA512
c57cbdfd240d97f357cc8361e3fb18b70565e072cb18e35f9039bb99665ac85a29ff111fba30e331fdd60651a0bb6776cc880bab034b07517a14e3d9b6a66db1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
2fa39b07efa346f2d985b80b0a284e30

SHA1
8ea0bf221b853337c31ce8348e1e2270370f7401

SHA256
b42c09420c53a158fa4beaa9f6976f5ef16f43757a2d88a33549a4cf5d1ae3d1

SHA512
ee899cba35c007e6c8009e93a374b461918a46780d11c05d1872730843ba39ea419834e368af001dfdd9d21dd082c6556f7c64d8b918ea7e816473eb9edcf09d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
fff49d5bf3add5eb0f190265bd182184

SHA1
f52bd6bc5d3d377d868ec826da7857862c4083cf

SHA256
4d53a0c4c44e8b681fef49a593d674ec77cdcdde2399b84d92b77430d1266fd3

SHA512
916546c88aa8c9b0eb224363eac61268c1d3a5cc8d7d722910c91021c0c489fc8d3d752c21482086556c1b902ae4a7ccd6ae447e8338dacab28757744553713b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
92e3e7e2c0270dad497ff4db3b347607

SHA1
f9d29ee066ca6867ee7904ee24daa81ca867c08c

SHA256
d4352c0ed76342d3c9d4324b065c283178319a0737200ea8a7636ad891b91745

SHA512
8245b17f544be913ef1c2457ae6175e891a088740232c8ffa67acce89222ed514df02a24c8d3944a56e651c5548466c6e5f9a8e3bf611d4e39c86c32353a8547

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
9779f46d8d4145e8a88aacdf45b4db6e

SHA1
2933a63b755e24206f5d6fd4923425c0dee886fc

SHA256
42c2958030392c9b6b1642f869f7f6e82a86be79f8d0e9c501f64edcf9b27091

SHA512
391032797b2ce93ddf0f65237f3089ebf0fa91af1b821c5fe1cb60b4c197968a36faea7f1c086da5d302f1ae4ef7eea1038d2b19e9d546012b0c6013af20e143

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
bbe2e35ce13279d010c29b0613a5e4de

SHA1
3b65992b10a1434bf3f47a9629c36534350bd3a6

SHA256
565c5a01518c8b26ceeb494b85db3ae89d8f396aeb33ec081977b32cd9f834e4

SHA512
fd761fd90bbd3f9da42544ebe2ef236b12da8fd7031a813427a409065c97b319ea2f62ef8d4c340da3ad59679c09c6522a95ab3f8d1cd25db769f37870bb7019

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
407d3d6f4d9dc438a9f5fe24cdb0fcbf

SHA1
4ccf98a7bd229f73eb07d388835d8907233806c4

SHA256
8557d85f4c3c3b7228afa4b5023bc84a55dc837db7afd3437833dda3c38b5d65

SHA512
1fd2f3eaa4a9800e577baebe33c80b53b1b5db642e0e999899ad19ee51774cc63978e4133152938ac94a2beaf948ea6eba0154cde3ed8ed6681c5d77968fa956

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
b0cacf10b3e1eb6b4c777e1bbcd09708

SHA1
8920303e2b8ffff55a9563d1c474389ceb4a706a

SHA256
fd4cba67cf414961c9c6c5e0d2a2667787b33995cc1b1bfee8ad9b371a27fb57

SHA512
c6ce8e2f387820e9a43ae7bdebad3dec9bd5b275127181da66aa2fae2667c074b74da035be92faecf29ef095fa501adb3badcbe89ebd87af2c36301ca503fdef

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
6a6bb07f0692953447e20990b28e2f49

SHA1
a942eff67f7f90e68830a6dbcfebf335b6b25b67

SHA256
bb647c0f47f7a5d95dcd08ed7b21b9b4373fd43635e0e3b7b0e2177641baaf75

SHA512
2b57507bbe6c7783b22c447cb321ef36451d80a29c9e96d1bec1612a63b4556dfcfc2962ef05b62a24f7bc28365522b1528f12408a90c3af9b64c7638c3d0b36

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
4053fe719e17c3fa94618f1b1e3a169b

SHA1
823dd5bc5f0778679b0f4ab9ce989fceccaed4b3

SHA256
7ab20215143726a4fdd7acf489dbd2407062013647e615d683f8650eb7b9011e

SHA512
e2dcb0c241a2f6e9d66d1aa9de2b39d6c735578c60a310b1c14f1162dd63ef9f34bdbed6e74a281acbbcd3fda7415ccd8b284f5933c5edbc43227c154c00511a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
afd6494913ed1599e5ac18343001b3f4

SHA1
4cf04ba995a6f553c866acf7df8409c10d85145a

SHA256
7534d0ed66223b4d8c362b2e604366bf157c2d77e93ab019248a7b711d987d05

SHA512
1f31c12ef2492c9cb898dee19a7590acdc02cf4d3caabdf1522d8ea4a4c1f96754f8e7861b5964dc2d4273d584433bcac94e939b5dfe83734d31ce1cd1b7a2a0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
1e8a521384ded0033d136df43ba39a17

SHA1
d26cbc50d57ce711f61a880649fb40d4f571ae70

SHA256
764297c8c4cf12777cc0c1e48c90ece90b3899296294afe3b947524602b1284b

SHA512
28193f0a438f709ee9cd17c33fa0c93b21338624830a43735d9da18fe9a8b8cb66060577cb4f7d902e3a8a3350eb4933f6da1bb770b7c1c4b7747218b21b3102

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
64e1f4cb3882a30eca58e1e81b932e22

SHA1
1af735def31f13be1ede144561a0070d65a84c72

SHA256
4e4dcb701619a3773a73f08b0248b4d66e87d58d0ba35632dc36ecf31425f8c5

SHA512
7314a1753842d9ed79221b27da68cf7276f6f1763f5e21211daa819fb92e04977319477637f48ec7b2d87f946701b5ecd17d7fe293adca6ff77f074804cf69e3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
d9b91153ce1e46f2a4a9ace7ad607ab1

SHA1
fe2769be7b7845d1f4414caa0c42ade9e14d577f

SHA256
e16816ce92f32f4f8a8df440e44d3c82b28a1ae5fe23855c7c1754fdd06205d8

SHA512
09a577f166f6c4fe86d4b6b8bf6704414765661fe5a30617688c6d04fd43af3a8dadc568a881291ec7d23a11cb78559d1321769567af69cab2f46028963104b4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
2211314486616aa25a7ca24325e2480f

SHA1
c30186c25ed966e4b9371537367a64c47887a8f1

SHA256
697979ed2d567ddafa21eea0ec34a30644a56fa6c91cb340cd401d2b69215e96

SHA512
b4eb893c9c205587ffd157dd4f8e52dce5d05bdccf42782c32284166447597726881839e7aaad155232a306afa6612f0b0bde3c7cc1bb4627a326602bafd4861

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
ef8f08aac5638bbcbaf7ac7391de7ac9

SHA1
2bcd5f3043a744d7d26d1f60039b78828b64683c

SHA256
54f6ba15a7d13501b03efb7044ef291c444181d72350bf8ad4be318b232e2898

SHA512
6b24006531f3ab5c4e6456d8e9b7f81b83334095282d5ce571da0b13dd1712b1e854869c0d1fd4ab27d4399d9ec3fe9baecf442df909b01c9574f3b10baed1d7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
11e57874970e4714f2eacb6ce3f6fbd2

SHA1
60b3826669cf2f8a8790ee2bd1d062a0c96539ed

SHA256
ce9e46ebfbffd6e73b3a410a55918da082a213f18f38e8bd6e23bf317ee7facf

SHA512
07810f273d1094c0f5b36ee8acdf7f3dbd4f6b7316d43440e7a922141d73d3605dd0571c8934071d1c27e4efae1b69d61b10c82caf2dc6f0016fa094ea9a50b3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
be1356a6eb7c1d4d38765d847eede381

SHA1
3d48ec133b53ec141c4de2b0bc22e944b89d792d

SHA256
5f337be882f2d987b58e98983ad9072d5e34e190e71cbace387bdddb49a7a1c3

SHA512
719ceab15eb8e26b8231e0b473349a9b3f2ee8dba94132997bba026294353f025b0e947be1d50df3d3beaa9b507d3056f51a4a96065dc39c8d1b5365c75ca427

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
b64571bc3276acb4b1489579ff9b8e4a

SHA1
8ed9500ae59e1bef7fdb8cffec204bd591810848

SHA256
13832388098ee4e0a82d0f383322ee750b74c354c6ce65dac8ded3a8d64ef2c3

SHA512
e6f7db45476dd17488551e1b1e63d7979885301abd5602aef55f90b500b46cb46b76d7fa58b5fc8cd56e45c12331afa1e65afb5cc47513dafa6917eaeb4a42fa

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
a2d9099a4c00fb2a7b03af11a2011335

SHA1
604398613229387431ad464f41d23b598f83a671

SHA256
e2a6bc6b55eec2e20646a48d352dec4e330009cf7deac7d155ad155388c43262

SHA512
28275215ddd5cb1476c438338515fc27182503492f13e719ff55fa4f37458787e11c9969a68e51467428d87bed2693f77c9221ff994335fc3a89c747e33595db

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
8f867582a29bf65bd82a62dc59fe5c7d

SHA1
e13607803f0fd952f3514e71d3bf1b8d24d32d72

SHA256
4b2207cb9e8687780f7112edcc8463bc16b75f25dc26957d0225f3094c55de3f

SHA512
273d2d25291d3db21dd3aef62d161fd70a66442ace2dda13e48b1d05180e21cc51e0607f7e4ae6d40b815bdd81b0d3c5dc9066af7b9e80652cc06ddab89024e0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
37125949bc211ecf974c69120a39138b

SHA1
d2e5dc4a77d1a849632665395b03c46a0dd3cd8d

SHA256
4d52aa39ae9c91a3806287e064bc20f7afee27faa2369b92693216aa2befb07f

SHA512
2a9e98dd5c2a3da9d56e7955f65117e1b014927654841f8f68670c4648890fbbe7dacc3d4c53d7a98bce9023a066f6d2adeebdcd1c8281d9e8d556e9bf14058b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
78fecd04424c7894a65413788e22082e

SHA1
5c9c4fe6fdd07d4954313b01b82f4c894b3c23f1

SHA256
07c6137541cb2b2c5048cc1b7f11bd22568897f27dd5d146dbdd5be4f5c3e28d

SHA512
80d9e4a1028c7af09e62f29c83eab3d9ae436e4477d57f4231bbb60cac37b9abae2603464487b050952a527455666bc8f5db1516f30c773af4918111fd1c38c0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
67ff8df2e40c68ea9279b92ee7d7cfcc

SHA1
3ce23b73c4318c1b30ccefb23a71b713a5c9bb69

SHA256
2efab761e57ce89919f47898f046936afaf4b90298c47b8696b8c0da1b81d87e

SHA512
78892fee122ea8c14351a75bd8bbc7c746639677ed1d8117ffde5fb3c03693b3d06b6036cfcc81137d76ab3f59b72f0e151bc0711ad2dff56e251a44d60abfc3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
0b5b8f3aaafd1d69bc5de1e395dc9f10

SHA1
f73ead4abff3d8090e9150c2c3c16e72efe687b3

SHA256
aa39eaf3a6d2850dfc7ee8701adb857a2e3a6ccfd7c95618ea3ad9afdc5970bf

SHA512
350ed17755f1bef3e39c8154bb14bda3bf76641f15bf49c6f83f5f4abc0ac956e1f7dd809a308f9c7ce58754c118362a5e8a1c54e1853f59f65085cb7831001d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
3620e683d3a29c1180fc9cc337b3e5e5

SHA1
78401b74d722458c7c285e652c0d9ba32d7006c0

SHA256
e3f09a740ee2dc19b66d942fd63092a6f037e3f93f6f5420e3fa47be58cacdee

SHA512
886bff37a7af53fc8990894633fdcbfbe3415b9dffce5f231c41832fdb61893a5fc7bb54a5c90ac4dda90c51a8c8d00195e97c31867aa0d39d0e877fa38c502e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
8954e7e703e64ac9660d586231d8b58b

SHA1
15d56a9079f3a5cccd6f2315686697f8e428132f

SHA256
26f68b37acefa59c569f055dfc638ea9cdf8665ab3d65a22131f2e0746d80e2e

SHA512
18049294f44fd76ed6f4e18d8622e805f77c2631ef515b8a53cec356181976eed0bbab0340704b745cf760fd72d9f402ad9b684e3103fbdef6db61b31789ecbd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
1d26de8d350ed6fdb742817ac4cd4235

SHA1
5ec13229595ad39d1b6b978131b955c9726f0c69

SHA256
f08365c1d90d4614fd5c312a551c4623f280f4f25dd056f8cb2c87b85eaf1d0d

SHA512
1169d4c95ddb301ff51ab139987d32b4d63675b2cdc431192838d8977a7d5ea78437d73035054c9696f6a413b9b1570c902db14fb5a57a5d03fce084e9bf071f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
28dc6d7ff68265ff3dcaa4ede8ad408c

SHA1
7b1133009a5f3b1dbb4bba28a6a60539db2204e2

SHA256
6d8a408aec4a38866c471940823a582243755657766180396615e462a4d8020d

SHA512
00d62f767a4016612143dd2ee576bfc1aece978435c7392dc4c937d6cede43e901dd308cd0caae00f3390ae54713094a7b8c45bb215a2fcdee8cef66d82d6607

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
b385ef403b0ccf743b722fa5d3973c1f

SHA1
9a6f229f0d8db0703ab90f77b71fada669ca3ea3

SHA256
01564f7dfbdd0a977ca4f6c7a1bbbc6c4c19799f1f773454c2feccdd8ec49dd2

SHA512
17fd05914310bcae5ed013d6d0641be42c75eaa4fd7dba1f608e7ad5e1c2e4933827d2b3ccf76f8becc4a6c14ed54651a036fa1404d768cb4a6c7077d667d7fe

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
38210f4b5b744402ca29fd396389bd6a

SHA1
793f3a57162b1c713beae3621c109e51f0ecb33e

SHA256
15d018e448d3cd460ed121a7a745872e7a34b8da0ae8ddca01fb69792edd9552

SHA512
c3b6ea1d3ec8a4c146c20d2bf2137b33443b78efd53908ceedb4cca40ce4856dff7f96b54496d638efdb04d791a8ba508f9f39ef0ce54991e9c3c0ea1a23c018

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
245ae59e1c77db6e2d46412d1cf9c27d

SHA1
f940b1a7983236bcb7b8b2e3d1f8fbcae1315218

SHA256
e48381ccb3a91b6153a59304f446da46fa24d2cb00d87bc4c16f859e430c5c66

SHA512
16e2cfc1251a0a0da645e8effef75f000cc55eabfd74d2efefdf46a5d102441a7adcc5b23f7526f6efb69e9296a5b019d4d1b19006b9ee5e07e6ed58d3837a52

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
d90e173b1b0a3bae052fa2630315e8ed

SHA1
878aa41f276e730682354f458ebe0b2e10a3b6db

SHA256
ca4c39b9b1fc08c412343b0b4cc236e5c5b22bb2210c035c8efcdfe5ffca3ab8

SHA512
c02514c2d38fd64a5e41460859da121b884d507dfafa3b9f5fb5bad451c12d079c269daaa782bd9885f96877b8dde05c27f5f020a336ffbd18f7c09968477a9c

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
75a5df9c94e0c5a8d5ff43feada7b3d9

SHA1
a62fd2c11f611c7495cd853b2760f15e2dafcb06

SHA256
2aea5eafb5b0e7cbbb1a525ed983b320b1cd6730df20411b60a256c074601494

SHA512
99933d6c0e7a9965f2a38d3fdf99f65974d885802327e573de8b33fbd4076befe083936664d70388c7ff870d30032205383c1124edf26ee073bf0c4bd51ea91f

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
b9f66de9698ee0a2ba3eff82be38a77c

SHA1
eb0c6b0dc138885fe58dfad324ce14b58f98adf6

SHA256
cec4009b4bc52c1e3838f46629250d9c93e8dc0f482e8765153d10f1bc7f5bad

SHA512
a0cf1c63beb6188c6dd54f711bb69f27aa0ad9528dc6711451fd353854c6d764b7ee83edfb195342ab94656160e571db001c313d37aa6f65f8da61d5a2edda24

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
e078191d8990e47ad6a588a6c26251f0

SHA1
e2e36ed26b0fb8ef288bae671029968a0d3034f7

SHA256
59ee0daf174dbb4d5187a8d8cbb8a1a58f7eb47109a11854e73061a3eca2a1b6

SHA512
12d43d5a6b957323739289b6f4b89e31de16066acaacb6d4384278da3ca0fdb2947b2d62971c645e383dfb1e2c830a0ec75f3f6263a4520225bc7ae3178d6d8f

Download Submit
memory/600-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/600-5391-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/600-11219-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads