aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4

Analysis

max time kernel
137s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2024, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
Size 12KB
Sample241102-q3xt2synbn
SHA256 aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4
MD5 811de651e578578df251f2600a4cf96d
SHA1 452096d7b12a25f91e3b07154d713111abf24dec
SHA512 9f37bb1df025ee7934976b96b1da84ad869098df777b03e0237a2656ae00166adc29f65d58b75de73e350a598d0a840cdf64dd900abd07b2825d3f8ff20d298f
SSDEEP 192:e/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMC5Q0Je:eebFNw4Pk1itKkpAjjI2YpdmC5Q
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2202) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ZcWGl71Ec9XY4gY.exe"	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\cht4vx64.inf_amd64_b03448ba0b72ec47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsun2.inf_amd64_de323a35134348a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\xboxgip.inf_amd64_90ed6b3fdc759a5b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\xinputhid.inf_amd64_b01c6ccf7f1e23b6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpipmi.inf_amd64_310dc613a7e31ec8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\IME\IMETC\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_a2bfd066656fe297\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_c62e9f8067f98247\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcxhv6.inf_amd64_f1a7a2fbd6554d60\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_683fd853c8b8a4db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wsynth3dvsc.inf_amd64_1a08a3b6cd493e1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_bluetooth.inf_amd64_7e49a68f06c14d10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_69b5e0c918eab9a6\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\storufs.inf_amd64_a7a5b507fa22251e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wudfusbcciddriver.inf_amd64_a084e687a06b255f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\lt-LT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\wbem\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\amdi2c.inf_amd64_d7ae71f8eb52c084\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidserv.inf_amd64_c20a3bb7ac1cd207\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sisraid2.inf_amd64_845e008c32615283\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\spaceport.inf_amd64_6383331cfa0a32be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\CimCmdlets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa3.inf_amd64_ff37da248ddd748a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvpci.inf_amd64_86afbe8940682d27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmvdot.inf_amd64_04863374c9db2052\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\virtdisk.inf_amd64_9a7f42b85c7def50\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\pl-PL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Examples\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_memory.inf_amd64_6fa9664593233d6e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ksfilter.inf_amd64_d5c8b2a031c7d5c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl008.inf_amd64_c0d977e565fdc839\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\IME\IMEJP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\wbem\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\F12\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fdc.inf_amd64_fe3599e7eac09e7f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netlldp.inf_amd64_fbd4bbbad72f0e6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_cnl.inf_amd64_f668309b543472eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_5e0fbd01da4f7c7b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrgl.inf_amd64_19bd1d6c2b642b6f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smrvolume.inf_amd64_1d430c5b72323a1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmrock.inf_amd64_9b13bcc1f320d1ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wsdprint.inf_amd64_b616bed30e8928ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\SysWOW64\Dism\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-125.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-32_contrast-black.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleWideTile.scale-125.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSmallTile.scale-400.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\images\PaySquare150x150Logo.scale-200.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-150.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-80_altform-lightunplated.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40_altform-unplated.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\images\Wide310x150Logo.scale-100.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-16_altform-unplated.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-black_scale-100.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-150.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\AppPowerPoint32x32.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-100.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionWideTile.scale-100.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlInnerCircle.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-256_altform-unplated.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-32_altform-lightunplated.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-24_contrast-white.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-400.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-30_altform-unplated.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Program Files\Internet Explorer\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\Weather_TileMediumSquare.scale-100.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.targetsize-16_altform-unplated.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200_contrast-black.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-36_altform-lightunplated.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerMedTile.contrast-white_scale-100.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sv-SE\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-125.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_contrast-black.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d8.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\core_icons.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-400_contrast-black.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Dark.scale-250.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-16.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-24.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\review_poster.jpg	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-125_contrast-black.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\WideTile.scale-200.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\LargeTile.scale-200.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Doughboy.scale-150.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover_2x.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-125_contrast-black.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\162.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-48.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-400.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..nt-uevwow.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_20a514ccfd86eca0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..k-service.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_6200026647232d97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\TinyTile.contrast-black_scale-125.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..-security.resources_31bf3856ad364e35_10.0.19041.1_de-de_5b36016bf5130202\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-switcherdatamodel_31bf3856ad364e35_10.0.19041.746_none_38fc188849f7d1dd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-xinput.resources_31bf3856ad364e35_10.0.19041.1_de-de_0f4d659f2e746af5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..t-tracker.resources_31bf3856ad364e35_10.0.19041.1_en-us_dbe5c64e00f9d502\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.1_none_03928ee4a9e5894c\Icon_MMXresume.contrast-white_scale-400.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\wow64_microsoft.backgroun..r.management.module_31bf3856ad364e35_10.0.19041.1_none_9992d7a06e9e23ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-eapteapext.resources_31bf3856ad364e35_10.0.19041.1_it-it_6a8428a474581ddc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.1110_none_29d8ec742bfd8b13\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\XamlBuildTask\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001042f_31bf3856ad364e35_10.0.19041.1_none_57d244cde70a8073\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.19041.746_none_428efbd28b482d1c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..ywmdmcesp.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_26dba3f0b0c887d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..iew-internal-broker_31bf3856ad364e35_10.0.19041.746_none_309bd0ec3ecdcdc2\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_wfcvsc.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_f5e3de02779ea798\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wininethelperclass_31bf3856ad364e35_10.0.19041.746_none_0329353d97fc76a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_sv-se_5c4b115fa6f864cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-p..ty-common.resources_31bf3856ad364e35_10.0.19041.1_de-de_1f2227acd5d3cfdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediapolicy_31bf3856ad364e35_10.0.19041.746_none_2b52281297de22ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..vercommon.resources_31bf3856ad364e35_10.0.19041.1_es-es_88e5c83f93ade61c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.1_none_03928ee4a9e5894c\RequestedDownloadsCloudIcon.contrast-white_scale-150.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-twinapi_31bf3856ad364e35_10.0.19041.264_none_a3937a58f9e08a11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-usbceip_31bf3856ad364e35_10.0.19041.1_none_6524cbd648898bff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-m..s-components-jetole_31bf3856ad364e35_10.0.19041.1_none_d122fa6b7804c0c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..chinese-tip_profile_31bf3856ad364e35_10.0.19041.1_none_8a2b738118073bce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-client-overrides_31bf3856ad364e35_10.0.19041.1_none_cf8aac6a925f13ef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-printing-wsdprintproxy_31bf3856ad364e35_10.0.19041.746_none_6f8c9a57df3dff76\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ui-networkuxcontroller_31bf3856ad364e35_10.0.19041.1_none_9553a3077532cf63\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1023_nl-nl_348ed0341bb1fbff\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ie-f12diagnosticstap_31bf3856ad364e35_11.0.19041.746_none_d3dacb61ffa82429\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare71x71.scale-150_contrast-black.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-smss.resources_31bf3856ad364e35_10.0.19041.1_en-us_9a5b45e6fe928308\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsAuthenticationProtocols.Commands.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_hyperv-gpupvdev.resources_31bf3856ad364e35_10.0.19041.1_de-de_be1818c94264e7fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..2provider.resources_31bf3856ad364e35_10.0.19041.1_en-us_1a1a27236b6e0094\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\x86_wpf-presentationframework.classic_31bf3856ad364e35_10.0.19041.1_none_4e3bb73a10c5c0fe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-h..trolpanel.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_0678aa3dfdf37489\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..ardwareid.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_78d154d501264b3c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft.windows.kpscore.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a974336521e05afe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_netnwifi.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_f8c97efa00940c3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_system.addin.resources_b77a5c561934e089_4.0.15805.0_de-de_4b18e79ba2615ae4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\Boot\PCAT\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\PPIRemovableStorageDevicesSquareTile150x150.scale-100.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rdc_31bf3856ad364e35_10.0.19041.1_none_5d25fe15fb8fdf5a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\RequestedDownloadsLargeCloudIcon.contrast-white_scale-125.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.19041.1_none_679d42cd97347ace\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_e86f0a7773d21875\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.19041.153_none_e669b22d011fc6b2\BluetoothPairingSystemToastIcon.contrast-high.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.Shell\Images\PasswordExpiry.scale-400.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\Answer.scale-200.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.1_none_03928ee4a9e5894c\LocationIcon.contrast-black_scale-100.png	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_dc21x4vm.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_3b0f1d19dad31335\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.746_none_199024bb06a5f11c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..cemanager.resources_31bf3856ad364e35_10.0.19041.1_de-de_ae843aecd74a2a2e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-winsrv.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_2cdf3fcd95704082\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-appcontract-bmpolicy_31bf3856ad364e35_10.0.19041.746_none_e2b8c2d751f4912e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-enhancedstorage-api_31bf3856ad364e35_10.0.19041.746_none_b32819b66e95bdf3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..cconf-exe.resources_31bf3856ad364e35_10.0.19041.1_es-es_1f00350857a5f02d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-proquota.resources_31bf3856ad364e35_10.0.19041.1_es-es_b495a6ea1a51e87a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..vault-cpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_db746734769920ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
File created	C:\Windows\WinSxS\amd64_winusb.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_0c799705261979b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PKCONOIIBFRWSEH\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ZcWGl71Ec9XY4gY.exe"	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PKCONOIIBFRWSEH\ = "CRYPTED!"	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PKCONOIIBFRWSEH\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ZcWGl71Ec9XY4gY.exe,0"	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PKCONOIIBFRWSEH\shell\open\command	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PKCONOIIBFRWSEH\DefaultIcon	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PKCONOIIBFRWSEH\shell	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PKCONOIIBFRWSEH\shell\open	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "PKCONOIIBFRWSEH"	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PKCONOIIBFRWSEH	aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe

C:\Users\Admin\AppData\Local\Temp\aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe
"C:\Users\Admin\AppData\Local\Temp\aa0dbc871c409100c8c817383a176fd2dae2b495a654a0d00851ebbc615aceb4.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aic_file_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Size 50KB
SHA256 ef9151c3b9cb88ab6bbc2c4a8897275602910c611168c9d4723d4894e90d1f29
MD5 751e34aa3b5dce693abeddeac0d25a24
SHA1 8a8b6b6369d64eaacde8b2475e3805e2b107d2d6
SHA512 50e3c363e471fd91ed5262f49c9288a6a3a5865f61d4d3606c20527687b9a38e52bd3f7ebb999c86828899449984e25ff7e01402b623cede3fe6ed88dc655fff
SSDEEP 768:mw/KMVSnLY12nQVvDePDSgGyu1xT2aHZvIjimXdvzWeT/apQcThNlX/a26jd1h/j:mYd2Svfys2aHZghvQQQhNlwj
MD5 SHA1 SHA512 SSDEEP

Submit Download

selection-actions.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Size 1KB
SHA256 7b5f49701913d42530c10e1341597ddcf28152fc505ce0409ff38c54b10d4b01
MD5 31dd7d5beb85aaf3b6a3a9fb5cba80a7
SHA1 b81550446fb5587316cbee75b965a82b14bfe8b8
SHA512 f2e92d24ca349b179d52d3ee3dc12cad54cc982ab7f00455ab469fd8af3e1a434eeee82b15f92183c9f3a2fcc4236cc835506de55a1d2cbe5edfbd5374d7c99e
MD5 SHA1 SHA512

Submit Download

selection-actions2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Size 3KB
SHA256 8e835a6bfc4b9e1931c98c726719fd2421a923c390c35259c64cd9bbe6f32946
MD5 626f97289789179740e0326e3cbae476
SHA1 590ef2259eae207bffab25e02c8af82d51e6831e
SHA512 ed4b8f2c0c8b3e193b1018d7e902c399dbfaa83c66132046fe400871f7059a5b82f78ccd8b887c372ac5712e4e5ff9338450cc1b3a24d3fb3c5d3c030852f9f3
MD5 SHA1 SHA512

Submit Download

example_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Size 683B
SHA256 f1e6d2a597a3e6da1897a041fe277d06c3f3138b92549730a801e1f1361bf96c
MD5 877e1af38df375eae7aa9fa8bafb7bc2
SHA1 d158bbe337d85f7cd91bb747d50d369e0b4e6fc7
SHA512 a877ce5f0c9a8996cc2fe62606e193ecb80102edb443334868b61d596e3720db7cf9fc600b01fbbe6bc6b09b8b24398071922c148761443fd1a223ec5a9f5267
MD5 SHA1 SHA512

Submit Download

example_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Size 1KB
SHA256 a9b62b66d80b041db5ba601a0df5f8547e22c657e8270df0d255e9d318efa752
MD5 ed9ff9f675779aad01678cf9cbec0be9
SHA1 f18d5b19a78ce8704c03247d908328ede2a8b4a9
SHA512 fcadaa024fccf2869d7d7ddebbc57fe0ef209147ea449e4fee37bc968bd7f88258f16b3b1b17c5260a196524b084acf89cb63c2f67658e60bd435bcee8161595
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Size 445B
SHA256 7c3a5a29e5e1b8ff421d5a1239198de291ce3206015727aa4e9ee9647a999767
MD5 7ee65a91ce854fa21dab05100ed20ecb
SHA1 d4cc0f488268f5b12e42adf9e887cd9849b6d837
SHA512 5bf6124760345def301d831944c1a953fdacea5579c6355018ad4c4e5f440892daab509d9299b823c1a7475d46c9ea594394142b7c914be210150ce3de3e4389
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Size 611B
SHA256 ac95022c72df011ffe2b703896e33b7b5e05e8d5529d7307f72297230fac7fe5
MD5 79e48e94b49b1c721a72d43b811a6a82
SHA1 6879d18cbedf39da30e09bcd83ee99b35104f59e
SHA512 7cb93e471bc735aee37ffbe43e76b6f338a2bc02a0549238a200fabb438e836a4f5e04b5be0ee77db49f1fb2b2bdbf5f803cd62921f363eb6847efc02f21e87a
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Size 388B
SHA256 b31dd50bfd4a2027f623ec16174488df8a2b4e49a916adf4a55a72fc29829fae
MD5 b5f652e0addecee593afd8b4d9c76493
SHA1 6b832f51b9c4d1eda8e92155df8e59f8de2016dd
SHA512 5337a467ee5bb727171a79dee2cd46c25dc2b20efc8d45027feb4b61341c82afcbc58cb35b6d459efc9dadd3ac9174b0ae00e35e4366de43bfd959e429710a23
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Size 552B
SHA256 fe1f393db2755b66ab556d20fc51a1cdc480cc0412c2473cef74f27113284293
MD5 ccf668e8b1d23f42ac06e3c4ef4dd692
SHA1 287788fe5fed765456796df11f92e25f9b841f64
SHA512 d977322bac5d8ce408353916bf982776e20dd445147537c355f9fa538f3882c0ea77a226695d8e60cf7a0b2a75530cf8941650247f202b823d0896ddaae5f9b6
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Size 388B
SHA256 fab1a905a593067036209f3dd880d23ad67b72bb8865e73b5b343a95a01b2578
MD5 ac03a5c9f344e8707db06ae28425ff65
SHA1 854709856dc1866c6ae3016822d7488cad6c2a40
SHA512 ecaa1fd4bfdc5ed9de6effacc305342eedb06e043cdb451b85212b20b00796e91e35c2db2810ec60000ff938c76606d89c337d328b4800c987c09603ef6f1e35
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Size 552B
SHA256 bd62b9d3718f71e2943d337c6b993b8e00e7e0d02f16133b6542676b8b79ee73
MD5 5964b776ad169b9a4e7fb758c0ca64e5
SHA1 898f1405c3a75e658f2a5af55122a39e78e0345b
SHA512 774e4ba9d64889e55c4749ba7fc30cc2c1f59cf964e5ba44176c917277c52069a647a7aed8542a794bf8eb679e81fdc04f08b89987f188f15c5e672d6b671396
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Size 388B
SHA256 38def57f6d2b97020d58433b5fd29e5fefa1caa4b6cba38c0989fc4866120a03
MD5 71b8ccf69db1e2d67170c5e042ee0524
SHA1 a41604b1334a7b1107c29b0cb53b5f009cb0ab34
SHA512 7bfe9a43b6767d37bc01fe6dd6fe6046e26586e059ac0d6029299ffd6f174c6e5360bb34c8486792f44af6b9260c961a86b59ee47809c9a2fb7975fd47986c72
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Size 552B
SHA256 ab969327a87ce1a9ebb1cee5d2f96bd48698a2cb307a87db9ebdf21ea30b1fb1
MD5 9071c4775692719d95ca64ae0cc3442d
SHA1 1e7030d19efe9d672ad9998153f09cdfb99d3304
SHA512 7855fe74b08304d5886c170d67dabba7e758929570203141dabbaf5b58e32b4f5bc3bb92bb09c5cbad6489a980e21d1dcdc8d6723799b2cccf6cd8da8927033e
MD5 SHA1 SHA512

Submit Download

icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Size 7KB
SHA256 afcc4ebfcceef6c1732e58dae163355a01a9735500f2a28babe15bf23d0e3194
MD5 29ef8f03608df4f8d7d903cf58831384
SHA1 6f067a247f77cfa72ec1f410413a6c92f7d71263
SHA512 10544920ec384397ada52e533e8b19b446ad6846801b38786c4585d90b01b2eb723eb35e11b8343a3502e55c270b9b28fd9a7b77fec48a47d6a9b6d8066d70b8
SSDEEP 192:yEkp7F3DfLemZLESmnDEaVudQ7u0cL7DV/xYxoFWlIz0Rn6b:yEc7FHeCxcTufVGo6W0R6b
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_ie8.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Size 7KB
SHA256 36d476785cd26980c9afa7544de559955b3d2309d7378c51dd5430c8508ade58
MD5 4baed04403e33a3f6fb030105164f45a
SHA1 c49fb65f163c8fdee0ba5b5b07261926e26b4da4
SHA512 afea2e6d6858f993b66e88a3c0e7a68c383502ca3895d3665f37676463051593805297aa86d0fff468f5cf3987dfcf1fca9ee93c1796eacb83e1b91b2b586234
SSDEEP 192:PHPqs0T6AyEoBnAPZH4witRINsbEixEEfFk1Tq:a5T6AyHABHPkRINsoixEEfik
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Size 15KB
SHA256 c31e8910fbda0ea98474e36534b120c5715b43faa109c6b83226e12c31c09934
MD5 2523c6adfb6b655234b4081e26f480ee
SHA1 56f908185d30f88321f3071a467aeee4247973af
SHA512 b87f6a423c402bb71510da0c825e09ca18f3c0bc4b29a09754dbe31569a87ecec27fa39ba0d6918649c55dc99944a4c64249199c7498d61c5d92ac77c9a04c94
SSDEEP 384:7y0uqs2w04sKGsI//rjOivEnXUMKHkgQEZMC:7yD2isKJI//rjOivEENkS/
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Size 8KB
SHA256 ef270b621f893481d8cb65d57f72e4a3f56e408b78294baf2d3b413b06813187
MD5 d1bb593addd8e0b5a2bd16294cadad2b
SHA1 05de3739901fbcdba4c96b87a89400494b368f30
SHA512 142e031d2f5e8b8eac8857cee81c18330451ea50c67e9418a7f3af4196d225419631b37b9453cf0aebf7371caba98c12c6a3c89a10c120890730d19f84074be7
SSDEEP 192:Apovv1945L17yfTrGlXkx+B1ZpWR6PJ9oomewiSKT:31W9ybrGlJB1Zp/h7wiSKT
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Size 17KB
SHA256 f9bd55a0321866b7f7d13e4b662f3b90839a55a9629a549375ada61241468840
MD5 0f4da6e125b4e78b21eb92aa7b62e474
SHA1 6272adee20a0812f30bfa43650cef94ef8736dba
SHA512 f169dd5922a6eb2b4402bf4690270016f7d394c0db9e0a851629d4caf821ff3e225f6c3b165e9bbe4eb2a48d07b7cc1aae59678001da7500865c834bfce0479b
SSDEEP 384:Df0X7LjHPiYi9aOKjMPODyU6NTaSDT1ZjPIGG7JndLyM:eHHP3XMWDsT7DfPIGGddF
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_pattern_RHP.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Size 179B
SHA256 9e948e691c81209f46b0ca5255c312ed688604de4160dcaca6922d7c0a993af1
MD5 36fccaae0d4cfd1bdca3ad140caf90bf
SHA1 14d8c29468d52c6742f8970d64e91392e1041d50
SHA512 fff17d10795d134725d793dc4e9570a124484b991fd84aa29aaa2c520e9c190e871232b9004ed9de13c27b05a1d8a21b210a5c3acea55363bedc18bf6cf4674f
MD5 SHA1 SHA512

Submit Download

bg_patterns_header.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Size 703B
SHA256 ae0b96c21226795775ab2d0368819bb50cf42668d3aaaf8fd55f5caf3a5124fb
MD5 cbb8dd483f1813fbe30681b6161a6196
SHA1 3435358091b75ec5d098194d5eaef3a4d13a94be
SHA512 ff0f7f52da86a9777ed19706504002a9fcba99c48d6275bf8fdf2815c891b3111ffad66218d4d883ee3a786ac9a7ac7e2ef37f05fa33604431c579476d424014
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Size 8KB
SHA256 34cf1400f0cfe4b93dbc70e63747c956495a662d5fbc192bf2d67f8cb7dd4487
MD5 f98f58c441c2a44e8b09698e10b29735
SHA1 33070994f57123db3fa30083080333f9da36781c
SHA512 68caaaa30381ebad9425801fdf36d83c211d0ee0774a52eb8fa1a15f1c00cf5370965ccca3650060a533fdea95e8c313b58af406180af4951c27e204818b41f2
SSDEEP 192:2XB6Z69CUmpedVJW6rcTvIMmzR2EwINvdHyfQfnzGkHUV4d:kMZ0Cvwmra6IN/zBHUV4d
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Size 19KB
SHA256 e2212ed615a01605fa940ef5e6c7e137ad44e1a9cefa21ef12d033d3ba36f8e0
MD5 d38ed7170a95725aec5bd053f956c69d
SHA1 a90e589c77f9bc93c69e47f00ab7426fdb213062
SHA512 772c1a4289be05fbe636ef0eee870dfea5d8353add8933549960d353d727c50f9135f661ff2635e3eb89cb43cc5e4ce93538131ef5874cd3af6fe9591ba21406
SSDEEP 384:A1zFAhAlOvL4VtCYIHW9dpNtV18JXZopNph0qOMhpLa2:A1JARj4jCYIHqpYlZoX7LpLx
MD5 SHA1 SHA512 SSDEEP

Submit Download

faf_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Size 6KB
SHA256 91abd36269ea2f9ae4da795563dd60f94db2de609ddacb8e28e2564941c36161
MD5 f3ab93ba85de92988630595687bd975a
SHA1 951d8083ed79e4bf3fddd22f514f7922264c95dc
SHA512 f7b23d3c90e688aa156a960d9a33eaae7ccdb2f905ee33bc2fae71d1bb441352a38e898509675dc073390cc8dd314bfbbf2618496df0851d98d675bc5531c9a7
SSDEEP 192:Co0KLAdFHhiHQCfeyf1wYg+FBoOdwEjwN:F0KLA7SThf1HuEju
MD5 SHA1 SHA512 SSDEEP

Submit Download

bun.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Size 2KB
SHA256 ed5895a1f737d78e5b6c8664e22b8a1f660bb4a839eb48c46df22604e914182d
MD5 052b20925fd38a0688510561f0620a43
SHA1 f4393b2a7c5f9e505a19b447cfdf9c22f4cd54d2
SHA512 04d23278cafbd528561e0db1e83215903164a03bb9934477e57fcc68ac9f5cc1a4539273ec04a805829cfde89ba66d5624c61244f157423f0fc4056a53e9ad7f
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Size 2KB
SHA256 980d827578bed1386696f77187e924f2315992fd3deaac30a07c64141787495a
MD5 25b9b6d19edbd56e5812570b708c7ad4
SHA1 96d4f9cedf045bf19ccfb552048e8f11a6e2a8e7
SHA512 2ff7376ac5a3ddb81c2d49ff55a3292a018df9223817f45f0bb4a92455ef84986578245278cdbaf1ab438cfe827c72c23fa1e8054b1f6eb3c8c3267016510052
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Size 4KB
SHA256 79df2dcd0d1097fc19cac233e5eb6ec989ee9f9665aeda877934facd0b9aad8d
MD5 f86e20107cdad2f9bbf2e85af9633fc4
SHA1 a6e8187552243b3eef0d5eefd7410c4b8cecb400
SHA512 5e8ab813018cf2ce8e939cac4940bf4beb76466d00d93648d32d1707a7896c9afb9419ac95fbd46d563ee019c7816156f321317a05ebb146b3b7663ad9923722
SSDEEP 96:rb4szYV47cG1p+pIw/kkc0xRAlvSZk+VKZsltOiHO/RXI:qG711Mpf5OlN/ZWtHYXI
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_arrow_small.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Size 289B
SHA256 a31b357b9484b737838eadf6899998e0b623f61a20c6c4f8eaac633edc28ca91
MD5 aa12317adb0658c451a02766a5db383a
SHA1 5e05b234798be34b66d36dfde9c3398a84c6ee13
SHA512 9541ed804573cb4b732b478e275c4843f9f5f5fcb7261ad52d4f9bf73253dfd03e99b3043fe81e403241a04252f7e2879655735cc961ad4d1f5116178215f2d7
MD5 SHA1 SHA512

Submit Download

dd_arrow_small2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Size 385B
SHA256 d19bf83beb5c7f8e5d8e0f1e8711d3a81c8edeeb8a397ad3fb0508077e17ad51
MD5 a970a4f48c46259ed876a28c7d95836a
SHA1 29ffd57b1bdb699ee6eb4247c133a5981e2f4a6b
SHA512 841e1d2feb691dc2dec2ca90e7f261eb77226e7e1c0b761b44fae29370371af4891e9c226da2e3c3a9ab1127bc06eccc2ae76714a7080e8b322d25887c7846bb
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Size 4KB
SHA256 935949e0f67f1f08778d1cccd6edf8f28c27042c6625ddcb8d33dbb1fdfc4dd8
MD5 add7b66d5cfb472d9f8dcb5b8f85027a
SHA1 7f673372e4e7361e45ae62d8e606e17f9c714c60
SHA512 c570438061aec925d846b5a806ec0180d4e3fe30b9e0408fc21d6616c343e984262f148a939a43ccc726afa603754f1d80a1627579f39d81df8a0fcb10feceb5
SSDEEP 96:f0WMqJjjP4LAqYInb1TNjlsVLqkVNqZUlUZ4vPptXEoRRL:MHqJPLavh6QZUFptX/L
MD5 SHA1 SHA512 SSDEEP

Submit Download

nub.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Size 1003B
SHA256 ed599254a0f18d27cd8d5b715278fc24ce1d48ab7b9f93e4e7e1c630a039ce39
MD5 48c431ac39a95728baf53ae5f0c773f3
SHA1 f78d623bfa67ac3f29014262a0a17954f221237f
SHA512 6540e3bbdf1df9f3afbafafc899873895365f6c682ecae97ed192821d39d3d917c9995e618655832091b0946dd28ff650feceb096729af0e4eb547af487445a2
MD5 SHA1 SHA512

Submit Download

share_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Size 1KB
SHA256 3d92bf296d2e7254ffbea778aeacf6b8e6b59e65494152b8c6cb046b8fe80731
MD5 33cad4f7239769cacc593a0508119878
SHA1 291737d8a2c57a9bd56df43aa4075d2763c9618e
SHA512 6990c548e43d16d00bc063991ea86f674a9d7f0dfedeef3ea401715e36f2294385458a81b292b9b21ab30ac0424c34909e300edc01abc29162f8181191077ecf
MD5 SHA1 SHA512

Submit Download

share_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Size 2KB
SHA256 0bf5cbcc59c25c41fc449ba49ac0fc69a873f24b71658e99b768a29cea4dcb94
MD5 a2d0731b9afab736af35ea370448d0fa
SHA1 6ccbce69e51a25ee20c533849f5c40908aab5dc7
SHA512 97f97148a2ff960ed1ae83967c3d0863d9aad2fa7458acef2784b09d473afebf0b8fac6ace99b15cdc5a162d83f6b5834fe76c93032839b4a533d2c6c987caac
MD5 SHA1 SHA512

Submit Download

adc_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Size 3KB
SHA256 1e91fce9e7516a54fd264a6530565992c51ed769112761abf5e8d43673c64f9c
MD5 dbf6161fb400d331a64f5c7e752de611
SHA1 eb85ce762dece680d111adc0f13e3f98c7abbf92
SHA512 3427b3177b655c1ad039b7ef255b0d6f56a61fff52f8f332f7c19e87df9fc5d6aff393b791828a800342f0d722b54bf5f690a04957af1b8581f6cee7f66a9b81
MD5 SHA1 SHA512

Submit Download

adobe_spinner.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Size 556B
SHA256 782961d677038d297b5bea98ac5ac628523beaa617450a0a57ce7a3a69b8ee45
MD5 47ed46ca889a7b96566e26a6146cf052
SHA1 38132c672d7991e14a9a6679e87c60f2fc798d1b
SHA512 f68992e215116225ff4f33337de71b1d83a1d74099927c1aa2d4def87136164ed93179bacb6fdd26e0edd86dfad34c23f4729342ef45c23d24f21f98bfc76dba
MD5 SHA1 SHA512

Submit Download

logo_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Size 6KB
SHA256 1f8c2fbaeac0cd7711c36aa1a4884264ac4f357b79a1bce4ba5198a224502a4f
MD5 dc8d032230ae594d15f83fce02ac11e0
SHA1 ec524e5a730fba7f8384c6cdd685d57bacf3669b
SHA512 651694d2193e5ee83be5f225df8c6c84982080a0a29ea1ad7eb49dc11b9985987486a8aeff0a072288aefd4a9cec2c5d5ca32b62ec62f0630aebd347f28a18ff
SSDEEP 192:XSGwvPm7PwTpRl2/LPeHqsVLpo9TPyCO4:6vPmzwTcLiNp8TPyCO4
MD5 SHA1 SHA512 SSDEEP

Submit Download

sat_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Size 826B
SHA256 627937bc7bac54dec0a20967c55dd4fc1c3b37b4102cb95203436f86ce4182da
MD5 91ae478cac3bf945ba7f2ca42320da72
SHA1 eaf3333c386f76e93643195af57eb5d821a5e13d
SHA512 fb45f9afc12809abae8ccad6d730c29933c63d347c4e8d1c2caed245f7f621fed1fae08032db521bce7cbbd60ec3486c309624d03e0cc8e9171b376fdc3d9a70
MD5 SHA1 SHA512

Submit Download

sat_logo_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Size 1KB
SHA256 715fd382b9550b8fb006778d8c8cac3a60ad9e4cc7a27273e6e89b96ed663ca2
MD5 a6cba54829b485368336b56d830549b9
SHA1 af4523ea690eab517edbb48e0c4c9ae581a9e018
SHA512 d0c8be735a049719939f6802a9bfdd0fcace5abf075d3bd14883a7e5d3adaad92c138ec1e988d0389716094cb40a5e5b21777d69adcc03f526cde0af2073de68
MD5 SHA1 SHA512

Submit Download

DisplayLanguageNames.en_GB_EURO.txt

Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Size 32KB
SHA256 5cc12b93d95a0fc1723450e262e39fc264d1b7b260c5a598c4c1df705f6b212a
MD5 2ebd5a576d0272299cfb1d74b47ab7f9
SHA1 ce14cbab5eba1f78e71f10b25ec850ff6b48fb84
SHA512 3a8bf5be118e9249c50bef7c14e90af4160bbb1bf1b07c6168daff7ce5085e8e2856e57199318ae66c30d4ff2aabee0f0594b765bd5d2798af33d1a2d9a5b098
SSDEEP 768:Zb9jKbyiL/k58NU9CTS9MPALAo8M2Q2ZQcb8S7h19XHBTqKTWqSEVYLIujNAbsdF:Zb9jKbyiL/E8NU9CTSWPALAo8M2Q3cbU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Path C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt
Size 282B
SHA256 74127f4e4e71499a6143e92287aa4da75f50aa281e37ca4c0dfa602a27ac6256
MD5 09b8180df7a10d1cba4fcbe40874ead4
SHA1 a17d19446016123cef9265fbe95ceeb43f6be6b0
SHA512 94930c91ad55243aff9aa3a8e21ef0b2bd1dde67d868f36a7c89ce3505c4e65e8aa6f014e6503b0829540d85991e81636799d82bedcb804374ab5762a7ad05ee
MD5 SHA1 SHA512

Submit Download

win32_MoveNoDrop32x32.gif

Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
Size 153B
SHA256 03f8730ab17c794cb342ccfa3d4e7ffbdc8a3fb45690a5816e7a5b4261431bee
MD5 b9f5cbe76c9d62c63fbcaa784f488ab2
SHA1 748cb7f6be8c8d982d7d2a5754b575b6a4616272
SHA512 05ac89b6ab713539e06456382cd8712672bfdca0bef2da75ad8560bfaf549890a202c1606ea239ad5529d9b740e6da8e3f6fa68fbb481ca626828f3d7ef787ea
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 190B
SHA256 07e7f28c3c49d19bade1af290ae07e03bf0b7d9f547519c3b00d3423c0e0968e
MD5 7eb52575a060c62cc0264573a1766e9f
SHA1 6e7c0a617df29309fb4c499061c0b8a75447aa30
SHA512 06363be2b182d770ee822ad1345b50bad15f60107dc84801baeef92b9998404d477463c8420e77c8b2762c523889979855455c6391da28b5d524a407356ae2c8
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 190B
SHA256 98ed9542c43b1dad9aec07e5b78f4a178367a7b5cc34569c8552faf3ce94c60f
MD5 a80091918feef102efcf3826f0711d90
SHA1 47d6ee507afc176a4674d0fef8a54532ae1f8376
SHA512 6ab4a28791163bc8f301fa82a91eb7b8e03dbabf1a7c91adacd2aee373fbd00c071a00dddf192dc1c62bb7520ec175a956c7664b1dfd5122702d3dfcd8dd5656
MD5 SHA1 SHA512

Submit Download

directshow.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
Size 1KB
SHA256 c0bae8ab0d9761ec3ad65fdcf4f1526a42ef1c19f5a13b77882dae0e4195b12e
MD5 f8546578f718401553809525517cada9
SHA1 e8f0383b44e2fc9fd1c31be627d3efe25609a073
SHA512 cf5f8b304166decee4ca95af5a6946aef149a2af2e4ba893e5529f1f3aacc032ff394e9b5655b56b9807015429772a420692730e81909d13f3c53914cbd1813b
MD5 SHA1 SHA512

Submit Download

glib.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
Size 31KB
SHA256 90f75bfbdf34356aa9df998bb2c16f83c680123b7c84c36709a1f52215be12eb
MD5 090b5fc08ac43348731e88fbee4cb25c
SHA1 fd9c5b4efaacf94f1768e52c9611ce3eb55fcfc9
SHA512 394da2ed4132ba94b4a34ad3c9a4ba00c8e035ed64e2dcd271ffcc582c6b7071b8b97ce803257c880b83d259f9562c76dc5186546ee51d7a69fc42108fb28e26
SSDEEP 768:7DiWLZOk+QyOGBb1oyME/M3cwNOWcP7O/KyxmV0:/iWL0XPhb14cwYWS7OiyS0
MD5 SHA1 SHA512 SSDEEP

Submit Download

gstreamer.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
Size 34KB
SHA256 4eb7acc3729f7a0fc3bee72a0909de6708c3e62b81c22a075a5b2eb19ffa94f9
MD5 e9afb55a7c96e5614c328904412a5c4c
SHA1 a75f3bd873f4c50b54adeefb1ee1e8a963181729
SHA512 bcf099c34e242ff16119b9b95508e0e67f213d2fc8c4bf470c29cd94e11c27176f1e650f2a8f2e0afb60000b823b20ac8add5ad30a4167b16d68c4f08a5915bb
SSDEEP 768:WQtZWyez1vOWLZOk+QyOGBb1oyME/M3cwNOWcP7O/PvQ9u1DL:PVez1GWL0XPhb14cwYWS7OPQ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

icu_web.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
Size 23KB
SHA256 49e00b8bc090144502ef88686d300850508195baf264d78a52a26257c48608b6
MD5 430325779c4f72eabe05ff41cb4e91db
SHA1 354fa0adddc5d32d0103d25076a437093529e0fc
SHA512 bebfda4100983842cd7f7511294710763c3bea76972dc8c7ae0d9ff08b6c63f4b4ea14a9970a94e6cb42e6b143b93326cd2c3bb0b99773f2f249cbde13b535ae
SSDEEP 384:IQEDEPH5vxJsHzl/SlqzFcSMojQurmLjQuuYnwPBFVaU0MBMfPn+3sQjuvdsd1Ry:vEaxJsHzl/S8zJMojtaLjtQp/aUNwP26
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpeg_fx.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
Size 2KB
SHA256 70ecddae93c3e79dd815838ab21930abbab6554ad3ee4e37001ded55d1300ac3
MD5 2918fc5fa9c26cca480d50e649411074
SHA1 16bdc2362b2ded5711f7c6d94d867b9405c1ebad
SHA512 67ef23dfb53f5c4b407165095110873f2ce3111c8ac59136fcc5c6ce11de15d20ee1b6388ea1a35724043a9483648f7af09a6fc85eaccbfb717eb6b60b471670
MD5 SHA1 SHA512

Submit Download

libffi.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
Size 1KB
SHA256 e8e4983810e7bfc0882efb9f8bf06d563466be5aae2c3704ca57bdfaa84629df
MD5 c6f06ecdd7ddfad4a8cbcd55c24f7917
SHA1 e0d799794661e4316dde95f7db5d64c6b28783b8
SHA512 703e2546ff46eb3447c99d9060b4811aaffb23ec375472e94a8b6ccff227605a3cb549508e809bf9f94bd1090d5e7cd5501f89d6216e50195372fe294b0da5a5
MD5 SHA1 SHA512

Submit Download

libxml2.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
Size 3KB
SHA256 c697eec97c50ac718ec0a107845a6db8b2b217a44baa60ea0ed5f71102b0ebe9
MD5 bd023b40f687342ea10f405d520b01ef
SHA1 5b7e4757e03dfa9ff1bafba07a595df5f9a56b38
SHA512 5e72aa7a0c1ba5eaec6f58bd0e9e0a68dd63111b49377f491047d115fccfa71cdbcace03917c5f5e363028a5beb8dba818b5d3ab80bffadf21ff38e248b33a0c
MD5 SHA1 SHA512

Submit Download

libxslt.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
Size 2KB
SHA256 941b76b87f62bf7c0a9bb144db6a284b8f0c91486b2a173de0f278db75a77bf3
MD5 18bf0d6a1b5b737a62003ec7b46044ba
SHA1 234b629120d0e42bb4d78e81f28b87c1fee65afc
SHA512 21138e51435ed3239614602eb1c8fc14ad322f48b1681bfb1f11be2c0a759646702df23ddd6fbc79363d6360492e524831a15069cfa977e65e90164f12ea658c
MD5 SHA1 SHA512

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
Size 5KB
SHA256 2455d90b188b7cf27e2e15d03ebddf4b3b63bcc7b5f7f5fd7a0b515543e864f9
MD5 13a5bbaa4cecf91643cc6cb0df7b8569
SHA1 1130edcbcfd3e0c721090888750f3c735c4b060a
SHA512 8e1fe16a013c19f03680804d56e780f1e829e6e40135798cdefefe60d2c7c99f2f08094805b4843eccd1bd6d899c0710752a90a67b65ebebf2a259a4d0b612ea
SSDEEP 96:7VLU5IU0oIo7Y+KroPrc4UY1pSRfo3vPqA/0caccCkK/046+90FY1ML2IhTsNGLe:eb0wYB6nUY1pMQ/PB/cpK/D6+981/sN7
MD5 SHA1 SHA512 SSDEEP

Submit Download

public_suffix.md.EnCiPhErEd

Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.EnCiPhErEd
Size 17KB
SHA256 d4d2b2cfc8d38796a0ba3c681bc183c2e15a10d5bee625e15b20df8c293e5941
MD5 8b0004f62dd5d925d12f285859ba578d
SHA1 91b0ce744a0b8d7ee3a5de2a80629d30be5f5196
SHA512 722f11a97f1e5b525b1e797ccff7aa3d2a0eb700a67c0fb97454514a1a4737377fa09e27ba61809e5f07aaedb0ed2a38c5d2e14e1c3771cd6b28b86051c9b3b6
SSDEEP 384:gQVvZItNnyLct/66OWunzgIKCxQy6ghl3lPqcjoL5qIYs94/iEDP:gQvZAyLccUO5PbFno1q1zD
MD5 SHA1 SHA512 SSDEEP

Submit Download

webkit.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
Size 320KB
SHA256 2cf618c51c7f52d13e7f3eeefb85980ac305d36ef906f64a02a06754a368789a
MD5 a4bb72ade3a08c06d4c41ef876d0ae46
SHA1 26ed3428e174f3ac59bfafb9acf2663fb26046bd
SHA512 4d8ac7abee80817d2267b94ad57cb242d73e86f79320831f66d9e630412338b82a51924e092489915a90a2c8bd06e2325f854da8b55ec5d47a731124731380af
SSDEEP 6144:KrxlM4pGozRq90phGAYnQMtwWPYWY4HYPQv3GL5wsLAOj:e1MgU0pYVIlCYKgtAOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

asm.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
Size 1KB
SHA256 fb997624ffb2a1dab44630264aaa69ae51241d1e832f94f3cd30cdfb774dd161
MD5 1cb184a9c9d12ca036168cc7f4d14fe0
SHA1 14d0cfeb15a551fbbe546dc3b54a8e0a4bd17830
SHA512 3da5bfba75dc811e93272a9c00aeb4fad42b4b0c3d51e90e9a3e6831859617274c4a7c52cdefae472c74d8c43aee2c2b7e7c1ec61398c766bf5fed3656b0a6ab
MD5 SHA1 SHA512

Submit Download

bcel.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
Size 10KB
SHA256 a86d4023a5e6f4d612f2ebbbed6f7e1617a144182c63a9d6e234c761ca9f035b
MD5 6a6cdf3604c87fe658539e0bf980cfac
SHA1 355ae9ce4c024e3dc1fc852e3f99f6cb531cb299
SHA512 f5a05b20b49963cde77142173213de1f39fbedd4d0de1a4d8a90852aa6128db763fb0cc743b42625fa016bc9eaddb217527813edd20bae21a98e35a0abe99d16
SSDEEP 192:m+bs3RrY4vSgSjyNilPDKzuj3RIOf8UhVdiuJweHTl7NaVQocUKTp6YOMqCOnJ+J:mfRrYVgiV2S9I+8UXJwSl7wCjUY51R0k
MD5 SHA1 SHA512 SSDEEP

Submit Download

cldr.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
Size 3KB
SHA256 9eff37b22db43362165d46bb27982a8ab510e27ad08117c8840208d5e61c4a63
MD5 dbe5beb3a933d9fe8cd4b09c2bef4762
SHA1 0ccd45f82c100e533402194c4678f95773314f48
SHA512 0ec50d3446e25c62a47bcae380579b3a530599005643e895688e03efa1cd7253603209887c7382d3326284d9835c842eabb25c73e3addc4dd1d4bdb8644b61fc
MD5 SHA1 SHA512

Submit Download

colorimaging.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
Size 162B
SHA256 d3c6c98908c29eb9243dcdcea9201e009b35e567c13a399bb174f3c5857f280f
MD5 3e03e9728bcef1bf5b2026f425941b01
SHA1 fd2dfcdd828873460dd16e6dce682cb4eee992cb
SHA512 1ff4e1d6d1090d80383d8d671849793acc76b4cb5ab25c21dec6fff49d52f0a770b8f3c613a5ea10d568f9e6af7d0a15a82ee054c63b1c700ec51456500e7396
MD5 SHA1 SHA512

Submit Download

cryptix.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
Size 1KB
SHA256 261f9215e6379d31816e3081d471395d3503605388de973ca825175dd9f534b3
MD5 9a15e26458369f412c61b7323bba2eee
SHA1 5f742eef93c29e65a754f44743456775f2159d45
SHA512 88d4d14982c32f0fc20c7ce754468ed19c4a9f230b4f897792142163a7b371336a2eb901274365cfc86bb1cf9e573b093805bec18bc1d0be2ac64e5ecc58a6e2
MD5 SHA1 SHA512

Submit Download

dom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
Size 3KB
SHA256 2584457bf66143e24c462ed6671e10560b4dadc5538f65af0e81d40de6a3afa2
MD5 d48df3537753029f4d3e002e314d054b
SHA1 375369a8f758bf33996ec9443cac80c0c0d1516b
SHA512 c2aa0e38e3e0da8f4392dcaa836340ebacf7c569a2730f87a2743af8b567f0d90dc7c47927d3b8215f2b04f136b8129184d1d675c248dcc0bfabf71e300d6aac
MD5 SHA1 SHA512

Submit Download

dynalink.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
Size 1KB
SHA256 2405e967b1039c09350706ce7c02406f6fdc80ea7b1582c13223b16d1645f834
MD5 8fed90287b14af1ecaa9a0683b819134
SHA1 49d5b3bd73a88116b89c636015db2ec2d8b34c8b
SHA512 efc1d26392091c297be2da9892d1bd098f871e6311ceae2f1219123968e893367e4d9e66d0e01771b06923e19c183efc69320ebb29b97ff3a04b6af71e43c311
MD5 SHA1 SHA512

Submit Download

ecc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
Size 28KB
SHA256 6c56ab1e2717b5377250f60c214a8e40aca48195d503bc7d11177e71ef6ca1a6
MD5 e824ed0aaf5b8b61ed916438d89bc583
SHA1 37634a7f370fbc2722ae21658f9c7777a6ed3d0a
SHA512 472bc3797ff991c3ad79bf6b15b12ef8863d946c3977841b7978a578849264cf16403b6049567c2b353c46b17ed8ac5435aab4e8236ec20e81ecadfdd6ab42b4
SSDEEP 384:D6nNb9TdcvyWaoycHtm3+N1qjUDV5KAXvDx5bBdmEywJV4Gh36M4GhUQYMrjpw+0:k9MyWPy9AyU3bxpBdSwJVTwM4zyVs
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebxml.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
Size 2KB
SHA256 85600a7fcfc917ed40be8d440e1edd64a34776d78398e5d8cfcaf72d6c4b217f
MD5 3eb9d537ea183651d80fe0ffa87f2ce5
SHA1 b714a43253e5976682d68fa2ce5fbd876f631054
SHA512 1a65273222fcfddbcca8baa1841cbf1e5db0e998c7092296c57f548ecc217c35710ed1572c3a3e544681d41cf819d156ec0f4762b2d112e506cc6860e2590cdc
MD5 SHA1 SHA512

Submit Download

giflib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
Size 1KB
SHA256 950f083082732683c182719e6111371f034b1642f0344e0ed4bafb6d34413f3f
MD5 9f7d587a1cdd9e9c7059ba5b94a678bc
SHA1 de6d950b0cd9ecd67fec8401796ae8f0e3fb6f66
SHA512 e00a573eea0af05807ba4279761c68bf16f2b311566c1fc0d49b10b23be788d9cd8f939aedb297b4c26a16af3c250efd7e4153e0fb15d18f3adba85f57ef6d41
MD5 SHA1 SHA512

Submit Download

icu.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
Size 2KB
SHA256 abb59025dbcb72d0e0331f79c9543e44a9ce214d15cf71683de19e11b0434425
MD5 e50f9f9554a3e9882918da20b83f079a
SHA1 e0ae49e50a838e050822a2fbd440a0a199c4708e
SHA512 10ea1fa8547173168cb2a38a2e48ab6bf746773c652c37a5f3fc6678d8c115e81466233e957b4538ae1fab306400a99e32eb88fe5708f5afa79cf686707c6cd1
MD5 SHA1 SHA512

Submit Download

jcup.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
Size 1KB
SHA256 49939add67d71cb3293e44d425688f1423f5db5ae94f3ee173084755702f03e6
MD5 3891c8968256f89a7819cffc14a809f7
SHA1 a04e9f2bf4b5b5210d35e4768b9ba8aa0f4a9284
SHA512 a772745150119f5de9638b5d4c08c7c11050ad1dffee1afbe635414ff733092c15c0749c46ebd4fcd99d56bdc1ed6e2210c33f9d8f687c2bd82bfc505856f728
MD5 SHA1 SHA512

Submit Download

joni.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
Size 1KB
SHA256 ae2650d8bfc8c3852107d59a8302db016dd0d869ec50bf4e643e25418ca1f630
MD5 096dca1281d8571f82777a847f62bbe9
SHA1 4766b9f75781616c85564942b1bb9999b4221247
SHA512 364431e9c328000ed19fafc526d651ef672862f4995b757d40985e0d0181100d27b6ad4039a043f84dd236bd84b6799de300d51cb55959a18fad517ba0fa5fc8
MD5 SHA1 SHA512

Submit Download

jopt-simple.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
Size 1KB
SHA256 e52d341b81340a4555bdd101912abfca3c56687fa6346e4286e1ce522d9942df
MD5 f7353e51a872ce0e21e847258ba3a259
SHA1 eabf1d39a5e65f287d591d1688ba2c01fd23a8b6
SHA512 335c23c12b8d6cc962092e80bdf7ffad834020c7061f4ee4439aae0006d20a69fa789158ab04c15081499a028f54aa7c2cf6e0cc51ad018cf1d20042c6821c52
MD5 SHA1 SHA512

Submit Download

jpeg.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
Size 3KB
SHA256 3b45da8d2d213c87b319950047941422a8e773a9f51be50206a7a6f96f4d13ea
MD5 5686d2bda1a7a2da3f5679c58e4247bc
SHA1 cc9e750d5944395382f23d303c438ac26c34d6e0
SHA512 d29f91a634556617edbaa7cf4352e4414af2b778b8d01d35181d086a2ba43107f67f0f50ed06863da9c304524858289fa2246997fb5e4e2b806fa6e7da25ea05
MD5 SHA1 SHA512

Submit Download

lcms.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
Size 2KB
SHA256 528171343dbf5f189e205d9a3d9618a831b8da19c5d82cedf30423959e5439ea
MD5 a71dc257abd21d24bc5e6dcfc9ec1faa
SHA1 6f3cb37a668971fb6a506e237b6288b412c7c2ca
SHA512 37fa240956d8b81ef2e02df50bc6ae9ec44f55025fb9b07cb48eaab1ae464514eee1d4f0a07c751c92ca649b12f25a8eaa661cbc8526dd03d27b94b2be4c5ed7
MD5 SHA1 SHA512

Submit Download

libpng.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
Size 6KB
SHA256 83f73e14e742589796fb7710fa7c487d93bab6fda4efed9502679de87367064a
MD5 1ff5cc91b1f4dcf90fc0d5eb667a9918
SHA1 bacae52b3148b1341df57c447aeab9cec3083012
SHA512 47bd72e5bcd071f84efea2b50a4e38347d9b0402aa29b7547e9e28357a1047042fa317ba7145dfd6fd4725b25953bcd796bc94706ca56f9d20fc4ef57981e314
SSDEEP 192:xYPgI9t+oV9G/gpYaj4JZXhQpmwG5t8tD0FRgF:xYN9t+ozGqYaj4JZxQQD5WtD0Fc
MD5 SHA1 SHA512 SSDEEP

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
Size 5KB
SHA256 46cf3dabb5eeaf2bd50eb3742d23d4b78f9ce6c44fd8c4b193df719d4e999c0b
MD5 6feb190d2f8957cd6bdf7f68dfce1427
SHA1 ef78c94dbfdccc074e3808c455999571bf2d2697
SHA512 ae147bed4dfdde3b1bc5857dbec18e5ee286c7fa96513fb4a7d67f7966b89b39bf04210845f25e8ad77e968206dead906c02e091e731d7f87d7e62b012f7171a
SSDEEP 96:DVLU5IU0oIo7Y+KroPrc4UY1pSRfo3vPqA/0caccCkK/046+90FY1ML2IhTsNGLe:Gb0wYB6nUY1pMQ/PB/cpK/D6+981/sN7
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkcs11cryptotoken.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
Size 3KB
SHA256 2fd1246ffb23527dd75c902f674ba0ad966b3b33bc0ba8db949ce5871f888c99
MD5 49c21549715ae49cc02337758ecae6f0
SHA1 22744359ab9fd7bd85922ade3de140dacc808f2b
SHA512 5442ee5119f95235a931ab2c04f8d424ed1536c760b133739cdc2aa2f1ece91c4162eb5101f360a6cc0ed8d3a8c70ebd0a0006e808d880ff0a51b9da1b130298
MD5 SHA1 SHA512

Submit Download

pkcs11wrapper.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
Size 2KB
SHA256 d61c79e5b8addd71e5903f87681825eef69f6632357d6086f95298304394f410
MD5 6632f2afdaa3287239a8d9cb5754c453
SHA1 c63f8379d44ee5a1cc1692fefe9aa1476585fa6c
SHA512 be6b61ebcf7316539d4cf3d20be6847571efbe8399db4add53055cfd704ecd1baea3cd8a5e1ad305042732b6bea484f7bac53eaeeb76adcc1ae35c22c382e9e1
MD5 SHA1 SHA512

Submit Download

relaxngcc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
Size 2KB
SHA256 0feb4ee08224897acceabb3211e640dea4c2161e231e516faff0161c8dc0560e
MD5 7b5625439255926062effbe8f6a4366a
SHA1 72440b827f5976443b11a4dd3dd940f7201c55ac
SHA512 5e437149f70056ca6e58cb5a6e62e6d70919f3698ad6b01aef59b6eaff2240773c339a69012f904839564782b0bb2373341a189a68787432663a619a92ffb3d0
MD5 SHA1 SHA512

Submit Download

relaxngdatatype.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
Size 1KB
SHA256 9a92ff5b2a13457d146660df88ed2c409f98b4f0ce936064d8b05050223f8475
MD5 4d26dac5e08935499a281b094f8a237f
SHA1 4b8e96759e91cebd4ec3db025051033299868499
SHA512 0b587db1d1811398515c383720cd699a1c0b11d902bc752c78dea056fe0b10464539937841f77f21ca89fd0f938feb4c9b85d671c722de4f34254723fa0019f4
MD5 SHA1 SHA512

Submit Download

relaxngom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
Size 1KB
SHA256 7f5a45fde58aa6872e6b56bd58926c0105d205745882ac986b08964f047ceb85
MD5 30c0b1100ee10220cdecbe7a338c4ea4
SHA1 8d4057f338b83994686ff5e2bac1ed4d9edf5bd2
SHA512 e332d24e0bbca833ef7ef5d7e4ba0c89415f2fa5f057ab46b00defa8b1326ec668f7f9ab31c1be78d9fec5dd24119434d3577ac488c193f03c661e32af042bf7
MD5 SHA1 SHA512

Submit Download

santuario.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
Size 11KB
SHA256 e12b6d72776684d6690f923b2ffadaedb3ec95c67785478fbd27ac89a0e73d7a
MD5 971fe8af710ec9101a0f32eaf6e7104c
SHA1 8ed9512e7ce4ffc8c5a0b42ec9520e28ecd44f9c
SHA512 15f1bd6d6e3d7ea50dcf81b41c3c900a67e1584fac20d27cad13834a6b63d8d166dee5a3ff2d91589139482d715cb6c13e411dc7a81ee6883bb3d4a20142bea8
SSDEEP 192:eQ32VInZsDwZeBFQ2prWdhCLdO0YuVBErEmJnOo0xHL6ymRFlmVl1RxQdarh97pP:em2VCZsDwZMpr+KOmjErEmJnOo0xr6yX
MD5 SHA1 SHA512 SSDEEP

Submit Download

thaidict.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
Size 1KB
SHA256 6265ac58378be735d8971808a88782a9be1b6d17bb9ce1997b801375bcaa8e1f
MD5 069f5d7b7c3781b4be9cca071ca804a8
SHA1 3d65910674915e3a76f9ad4943d6f8fc7ee87625
SHA512 84754419d20d73bb055911186d68f5fcdc7f1549df141a4cc07b42ac5e9a92fd42ab1e11b30079609dfbf1e07dc2e894299557d1cb644f522ae38a8d95b19243
MD5 SHA1 SHA512

Submit Download

unicode.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
Size 2KB
SHA256 a32cb3d0e154aef55a53951af4b6e8d63b7897cff519d6af1d33f9b29c793a64
MD5 86b35b1c2d8c5a8daf12bab6df8a4610
SHA1 1b0babf617e268597a081ca0c10fc4e402a9cbb0
SHA512 74ca9d8bd41fa2c20945e4719bcb11e1f837eabd47c67862fdf734255084c096f4580330a61a0ad6c3a0f65f954dedb17de831483bb5766af2720503727076d8
MD5 SHA1 SHA512

Submit Download

xalan.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
Size 11KB
SHA256 929510326a5b577b2c386b8f352802d12eeedeb8e7d571a6285a39def51298bf
MD5 77629029f967d2d881fe83e26d31577a
SHA1 6e2abe8ec091e4c4f8584ac34641cf41317593fb
SHA512 b35179ac2e64a04caf1a3e6b0a058efdb240b9d20858449bd05c6beea04aff0249622658a773ea55f91b8b9049b20ef78d1f512ec1affb84e739d1eed20e84a6
SSDEEP 192:cTbM7os0SPk3L8dJ8OtTDX5YYjp3MU2cj1MlZVu6wKT8Ad1T7vCp7:cTb8fF83Qd+OtHJV9EcSZVxw68AfLM7
MD5 SHA1 SHA512 SSDEEP

Submit Download

xerces.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
Size 11KB
SHA256 c89284586984b3de4040a06a5eeafaff9f8bbbe7168310ae7b333f6706ace5da
MD5 f0fb6a68043a81f3687baa692da52413
SHA1 319aa21fe9ec8c28c80f24f4c3442bacef03916d
SHA512 8fc5ad8bb007bd795159e6dee953ed27d295bbd643b880dadf5bf5feced33dd5e30844a90c59ca0d582b9cafc3c7e12fd7a6dabda55f9a0dc6d2c98aa97bda8e
SSDEEP 192:7LlJ7PDvuClE3BlMQIrz2P7CB9KCSjx/8GD967HfXX147R1eak8iQ1zONuiI/Xf7:zPDvq3BlMo7CBSpVpo/Xl4V1eak8iPNA
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmlresolver.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
Size 11KB
SHA256 0c47fed4a4343209d9df3cc4009e18e2928ed326429badf37045fd672476dbf0
MD5 887aa1e10e266071ddd0d39fa52c8729
SHA1 7eee19cc16ed0f1de92a1da952748c379abce221
SHA512 7e97ced8044a8b302e32ff70a6c60444aae7383aba87e5869ee162a3cdfa3ca854cab71dbc697818ec64e9d39fe6537339b62a374907d47ebeccfb28ced39c0d
SSDEEP 192:5/p5v/bM7os0SPk3L8dJ8OtTDX5YYjp3MU2cj1MlZVu6wKT8Ad1T7vCpr:R7v/b8fF83Qd+OtHJV9EcSZVxw68AfL2
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
Size 1011B
SHA256 1888b2098cf231e40487ce6255129d3f9974aab9cc1f92e70e754c80e60ccabc
MD5 f02a8895d62a998e70ddbf8c12b5fe0f
SHA1 d387e946447cd0b0fdbdb5fd997728a2722904be
SHA512 a84a03f05b99a846c69b700167156429f55838c3cc1723f2cabb1fa9524f1697c253529ebaab1c5fde873b16e1d033529469c4c252e4390f33001ffcb336d617
MD5 SHA1 SHA512

Submit Download

AppCache133727656060295712.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656060295712.txt
Size 77KB
SHA256 35560275faaf9f639b69565c3b1edc430ecd069906325268fa0467225fde282d
MD5 6e529ec3609bf0b1754ce031a818e202
SHA1 d81a77e231d33820e57e051c2849f42fceb77341
SHA512 f799c0b2760f7f6728e265b41105b7eb531fb2689ca9462c9ad858b052b2aa14d56bfaee51d99679657d5359f8a4fd22ff7cc2b941b7a0867a25d3e203669b26
SSDEEP 1536:oMSWji44i6//bI6i0ijihSmSQmEBubSIqSiKWwe:hS54r6/GHOhSmSJ3bSIqSiK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727656525478361.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656525478361.txt
Size 47KB
SHA256 8b16c12bfce3f44fbff60b215a2b6bf96b4fb4d0747805febbf94575c0fddc09
MD5 92cc348a7e8f7b33b21929d0f5467e0f
SHA1 c5bbaed39a39d4464f5747289b0151abe9090564
SHA512 611fac0b179597bea84163527ceb97b2dd95d27615a88b8feaff429919be3c38aae1f4eab4ba691c8d8b32762d63bdbc1d44e9625f42887241da4452cab1391a
SSDEEP 768:QjQzRSAUNk/LS1DjlpCUJSvrdB4SKg7KUNzuZSN5BqFxEBsSYasbUXix3b:LS7AS1DjlpLSvr34SvKWzuZSN5BqFxpl
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727663169040966.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663169040966.txt
Size 63KB
SHA256 345ef1885e361a1ade793ee778b275746431bdd29c6c8904831ca61ac7d1acf9
MD5 165f22604c644f0f6d7dc7faab93cb29
SHA1 badf83271ddcd27718d539d67ccb932354633a86
SHA512 8bf47fda4b6fc0914e34fd110f08af0ad250ede7306c378a8a79eecd86de66d62e0e0ab1e29985f82cc1214923d54c1ad584bc93585b7a0f1effa211544d9a01
SSDEEP 768:2EJSoX4A5XQAljABRRNZV/TcKoi5E1XhASu17amUWMF3Qizb+:2USfJAdABjl/TrY6Su1cWMib
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727665885684530.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665885684530.txt
Size 74KB
SHA256 98365a419d7384fa288bee87a6c5a4b42b7db9ffd79391ed655ac38afb75a6ca
MD5 50f9d3a2781d60d131323f764abb212a
SHA1 08ea1b0f6720cae67f9edf8e374903a9dc6c7f2a
SHA512 4c4e40576ffff79441c2c1eee0436fab4c72b8b953f814b4958a789b17384ffcaa0030a746bcb012daaee7ed338e6bf08a0bbecdfedfb9796d5f8841965866de
SSDEEP 1536:m62pkEixZSHHgvciWBjSHSsbzuZSN5BgbLq:ukSHHg1WxSHSYzuZSNsbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

File Explorer.lnk

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Size 407B
SHA256 6afb66315a2257b61c5844af6a02e3b72ce989a3814ba2a344bf6ab07f411201
MD5 0c6d17ae3189c0451a7bfc88900bb6c8
SHA1 9fdb1df1130d604faa897f5501a0490714d8c86a
SHA512 65e730d382a2b3dfc6b6e1fab2fb410040deac70ef309f49ead35a1df052892562737f2d926c10e56b069e21715999009e2f6b631d863ccc0a20705a1a292b6f
MD5 SHA1 SHA512

Submit Download

ASPdotNET_logo.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
Size 21KB
SHA256 488d8a612961b51552397f7bf37bb3abc3808dda2ecfec05395e1618e682cfe1
MD5 ff90b3c73b332c9b798cbe3430dfb3ce
SHA1 27c0280c1d3d1d683973a18b6e534a369e0bd27c
SHA512 965516ab64903dd1624ece646a2e559234e6d921cef6d3e062a7922fd5e6ba559519621f2dc67314d0cad156604ccad0e45f096e6063091af00c536b68fa8586
SSDEEP 384:VeWcOkYuRcrdsOiV+cccccLm/22ilgrk3fPCGwpc:VeWcwuRcx4bL3BaU3Cbpc
MD5 SHA1 SHA512 SSDEEP

Submit Download

HelpIcon_solid.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
Size 1KB
SHA256 3146f190dc97e0bfaa64e51503b23aaea5d38e1555c8877c6e84904123a478af
MD5 017ff9eec228ea675edb4c54a62eccfd
SHA1 60b919e778b156d72c332bef3fe8708444a69a7e
SHA512 c0b2bcac4c86b5a92513d7f9b1371a939fd6307ff2385d2db07468e390ac4e7d6d602342ac79e9fac8de8ee315c981cebd1b6e79301b1a1c9e0a44d3a75418d2
MD5 SHA1 SHA512

Submit Download

alert_lrg.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif
Size 952B
SHA256 a82e72edb49d0ea62aea03c428de9cfdbd282e61f5a2aa858c349fce1427b2df
MD5 a765b50362bd043207476503ff1ac3de
SHA1 063f4c4bb556d0c5a5b38b80e4ee9811e1070066
SHA512 dd50263cd96b0065ead1a73c02d84dc4be1beb2050701148312d6c313f40b1154413fa7bb06f05db38fe39baf3ff94a504e3e9c2e7dba35bb44017195b24d039
MD5 SHA1 SHA512

Submit Download

aspx_file.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif
Size 121B
SHA256 3baf872bca6a054c759e53b095d65fea99a987e0c40c65bd354b16da2ab8a94d
MD5 d1a2c97a2f096be740ab49c353952c24
SHA1 511a7f2aeac0635b741c7a52b887440afd1b53bc
SHA512 36361e4b9cee4269e742857c7c03357d06409079b70caed4e74632657518b8ba47c1813de0cf60cfdf261f4bf09bf0a3987fafe705ed40370fa06bcb7aa13cd6
MD5 SHA1 SHA512

Submit Download

branding_Full2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif
Size 1KB
SHA256 eb17812b46daf307e8c638b27e62b1c4aa1b53dbacb0c7185d7a2763e24b71de
MD5 9b42abe43451bdc04775eeb47921fa30
SHA1 d250076c4aee1d04d52a383f5e5853a13a719b4c
SHA512 92344be9408759514c653bff7f3700e0054c33db677b9af0e97fcd75e616bf4398057a530e72134cd3ef1cc1ff7f744383c4bb49da8b8174fba2b378012a386d
MD5 SHA1 SHA512

Submit Download

darkBlue_GRAD.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
Size 8KB
SHA256 f0eadd88b1bf7fa176002de0e5e430c1c8d33fa5954df669dc604074fe6f6f31
MD5 37f34ee5b21c698cc670b4e9115bbd3e
SHA1 f3e542454ccc442e6a9ffa012a3e5d43b36c1399
SHA512 2b01cc8f8d4477037e5519ac2e432b177cf1428a5aaa8d5b4731ce0fc3c1e4912d52f99773aa917eb24401f0aec89bbbc0f0a363ce1b7109397461fde0df60c9
SSDEEP 96:z1SeafOYWcOWEjISAJ9AJY/Br0ejw3tRSt/LOYJeeeeHf/JKE:oeJ7uELAJ9AJY/BQve/D9ft
MD5 SHA1 SHA512 SSDEEP

Submit Download

folder.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif
Size 914B
SHA256 3b4309260cfc2df173b05c310a1095c036959f9bc87f4821f290bfc4ded6093c
MD5 c7fe26ed3a5493dd2e24e0ff4a243dfe
SHA1 4e09cf9a3911045a895f54d375513971c3976ae0
SHA512 0537a046b10ad27364ec4d38d4542e95dfd55d5bedb5f97dc7f1375904e66618ef17c8e858b5c2bee8ebf95888892d2ced2569cb03a38515ae24a670c60dd70f
MD5 SHA1 SHA512

Submit Download

headerGRADIENT_Tall.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
Size 328B
SHA256 1a19845e78078e84b4fd436040c544980d28eb38a2be326873bf34199c525fd5
MD5 1a16b7763bd6dcfbee9034dcf055d991
SHA1 3972b70dc90de6e08011c07c7ae3e48cfe18eec7
SHA512 15691455ccc5d55a31b83660549f463ebc2fbb8656b1ff2dc6c09ca93aee9d3db2c96db1704149e3520ff79d8c325111b6f1a6049ac12619ccb497d4df1f5cdc
MD5 SHA1 SHA512

Submit Download

help.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
Size 1KB
SHA256 73b3fe71ca45d827370f09e338fd65d3a750d3067aed4fd45d032a6a359dc0e0
MD5 15823a28ddb2e4af1e91a73e06d70bf3
SHA1 86889b43ccbd0417609c00df4ad4522145d57cae
SHA512 dbd73873ad2d680425169e25dffe0323324b0277031d37f37d1285dd70b0375eb8c94d93ce3959bc03e1453105c119cf653d80847ee68bc6f2976b0e655ae7ed
MD5 SHA1 SHA512

Submit Download

image1.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif
Size 162B
SHA256 28f29e6799d4a673ccc8973204f86a3006b2d15cd04d51bc33b5788245dab5d8
MD5 1905f8d589e7dc321bff0c88a2ea2568
SHA1 79438541a5bee6cca4a5c5fde4752c6d4cb81483
SHA512 38244ba73f9cd96166cea8b7701df6555bae7e869aaab07d290e5f9178c94f68cc6792c05de328bfe96c9456916304178aa2ecf82097fb2bf703adab0ef76967
MD5 SHA1 SHA512

Submit Download

image2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif
Size 586B
SHA256 52876db08cbe8be9e599cf16733ff153a74e19de854670ab526c3b5c97169764
MD5 4530c9f378ff2b6015379b9ec62cf10c
SHA1 680d951952a68b3ef07332a80ea5e12517cee163
SHA512 89d331dbfa2f768eb2a93fc6bbf89fc06379cdaa95c07bcd924a083f75805b0812111e6bc2563d4139fe58d867ad0e4d0f572ad7452dbec806deea51bdccea06
MD5 SHA1 SHA512

Submit Download

requiredBang.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif
Size 124B
SHA256 c26b8baf5383b881c769551a4d307bdd7b8c7467d5cd9fb67f1429615cb4be28
MD5 ae156564b15c8f30b8e25891e1c6e55d
SHA1 35aaeaf8f9a5fa5975bdc22d44b915b67f84f672
SHA512 a08385569c827a32adce738d6c044e1e9cdf13e3719f9915555ccce86ff86ea400b7a195c0050447ff5f642de2bd2b1ddc85c3ed4263de8f9b5b4c7c5d7ec1ba
MD5 SHA1 SHA512

Submit Download

topGradRepeat.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
Size 8KB
SHA256 509ef3a79c2b23821819c202ffdf7b7c7d6be7c722fc37475bd2e1d0fd2add59
MD5 f5fe5ed615945344a3e8e5e23e5203d4
SHA1 433e3049138c33813e2dad5386393310400f8947
SHA512 3f09dd041f94c3a47b10cbd92e26dbcda0eab4195ef1353ccc387ddc07aac3f229706ce2a4ad5e78770cc1d5a454eb35a18972e0dee6f2014eaed2b372a8672b
SSDEEP 96:L+w/y9bU7nObmTYZPmjgOLk2CrczFrcIgkiWQlbYZjx9x9x9x9xUe9TyvJ0V:CwKRYOjfO9zCIgkibgjx9x9x9x9xU9vO
MD5 SHA1 SHA512 SSDEEP

Submit Download

yellowCORNER.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
Size 880B
SHA256 57ec98eaf9cd4a65adfeb42c802d98c9990b64c64f4eb4829b385df81e556695
MD5 7801dbd0528e6e752bedf197970ce2ec
SHA1 0f95a54ecc456d445f34839228258de975c2d72a
SHA512 1e563721bebee30a8f0fa47e8b8b84349477b8c6c6c6e1bff31b244699e1e321bcbb54e41ebdfb6fce2467de05da9ba9ecade1bedf7aa555567908fb92346b56
MD5 SHA1 SHA512

Submit Download

1 - Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk
Size 1KB
SHA256 0ec2988e49c2ff6bd0755c17fd4117235c14a4186fca2301a8c95fcd56f4fe42
MD5 070e5f17b02d6a28c23503e945acd09a
SHA1 bc826331abd55bf50d68a9afa8f26167e30654d7
SHA512 8e720e8199cc7ebf208d1d72ae54ae58174c08301ce98f3261ab3569ecc0c37b090350a5f7012add4d18b634230a390c9ccc500f5c88e27883e8e9536862a217
MD5 SHA1 SHA512

Submit Download

1 - Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk
Size 1KB
SHA256 184a69713f5e73d41dcce75a35ca3332e9d1dfc6bc43d3dbe6c03f744f087c86
MD5 9ab7bda958f25b29727c95e8e50b98ab
SHA1 c3578da4efb56af30cb058752848363e772f4bef
SHA512 fd05f5693487c431c9c2748d672ae8f6a41e6f5d37f4722616280f730839e1da1baf4722c33ae5f1ac666d1e622dee3b7bf277315e7e1cee5529055eb9de1c64
MD5 SHA1 SHA512

Submit Download

2 - Search.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk
Size 1KB
SHA256 68aa42ced4c63a6716b0845c1583e989508bd46149308456d4f8b3043c6ba0e0
MD5 74483ca63ce42a76a7c6c889553b2950
SHA1 700ecf291f65197b05b9aa3fe12b3c92b3ed6813
SHA512 eb848b3732e4adeb9badab35f481c67a706b7a846e0af0a5ccf5cda2bc2dba08346735ebf218ff415799da43d055f646c2c73ffceca1fb7a5da0a6daa9a4eedc
MD5 SHA1 SHA512

Submit Download

3 - Windows Explorer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Size 1KB
SHA256 9f32b182082bdf0f49e1157a8610e960b9965443c215dd5921097d67003e1935
MD5 3db2ac57c815e2c23b853515171ee494
SHA1 06698306627203a6a603eafd18c462d9b03daa01
SHA512 cfc7babe59439175692b238413a56140185aeae4fe352b25bf79d684cbb73ef6b82d9501cb80137f6602e7273423b065414c2a37ac510ca1445ea9de70d1e5c8
MD5 SHA1 SHA512

Submit Download

4 - Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Size 1KB
SHA256 a5099b855102a65feddf02ebcbaf1657572019e6018054a5c9cfd78b4308952c
MD5 330a024739f54380572e28a2651e4e48
SHA1 26556f4f7685239c772567e97951272577b3ceb3
SHA512 0ba63abed1a1790d2c41d04fa02d7836da2d1d4f389be1bd99298e09f9cc4a000e7bdc6800f68cacf819626dfcf4e6b0695e021abf4f5fdac915fbdcfc15e365
MD5 SHA1 SHA512

Submit Download

5 - Task Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Size 1021B
SHA256 6785b2caa225ea18eda2e66085138e255626d1deee29fc9159b2cb2d234df015
MD5 41d45744032d96684b98232ce169c9c1
SHA1 49d3579636165ff0a9d9a310a49f998635cc64f7
SHA512 3476c9c73db789d21a8355b6baa09cb2925870a38154180cb2fea6158524df3194ba60e069f327945449a3ae29ccbf7b74f4a4d14519f41e760970a9c88687e1
MD5 SHA1 SHA512

Submit Download

01 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Size 1015B
SHA256 12a6d466e94c3dc0a2d8f242244dbffd6e621d683025c1a7ef76cf0276c1e228
MD5 0c58d6b1e17763a5e4e99a3a76440fb7
SHA1 fcf50868c0c8cb5c317338d329e619327a812ae2
SHA512 7eb0ecad097e3b529dfd290e15a7e1d7966ea62af8ab269ae7652a5631dbf397e91735b6ba17208088a02214023a3adbb84e7e868a2e5b9da0598fc6deb3efa5
MD5 SHA1 SHA512

Submit Download

01a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Size 1KB
SHA256 b76cb37e31137bc264366245bd9c5220e62ecfbe405d46fe5b3e2acbe7024d1c
MD5 7d0120c2cb3fce4f159a71bd1626692e
SHA1 f5fc5cd0bc0d9abdab19455aafeb9fa1f3d40d28
SHA512 96e12bdc381306f3dcdce17badf0601f2af47a99d0176e3e2546cb65e217d1c5cf87d34ad1a674dc424b981d5b9dd2f807cefd28f4601aa8dadd613c12d55d67
MD5 SHA1 SHA512

Submit Download

02 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Size 1KB
SHA256 6e72635b8146e32fd7e4fec46dfb1671eb7b59a2c162959e3683cfd089bbed7f
MD5 e14c46524f0d423fce0c4acb8248ae6a
SHA1 d7e56ae1677c21029e54399e93962e6def3b3dcb
SHA512 2302c133dee53484515cb638441c672e37df5792f7f81c53d5e127873e460ad532fef17372089fa57b169806c6a053a4d005a7ffa8d806eda884d32dd2bd5f89
MD5 SHA1 SHA512

Submit Download

02a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Size 1KB
SHA256 1adc9286b47b60902abf476f40305e1129c1ca17755c0fd6cdf8c04de85940df
MD5 63f952ca0ec5081414ceae94060c92d0
SHA1 df5f6edfbf1690d762ea6f1d377e36b2d8972175
SHA512 8d09b570cc5e4e34bf673eff03ec26b4b2180f8cbac8e8c84bb01be8cb80ca6de77294589ef0395df6f0a25eae9fbbb9248a269e3dc591dea67f7391ef4a6204
MD5 SHA1 SHA512

Submit Download

03 - Computer Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Size 1015B
SHA256 6995fba6e6e8b8de5e90d913cb594cd17ec3fc982bb42f98fb8ff9d602136ffa
MD5 50a699931b61e1d87afb493e32fb2729
SHA1 109fb2ecd3c5202b53a004ec2d4da33bee89b5af
SHA512 6d5df842b14301d780b6f7ae380459708789d23b5db5e2601b75b8a2eeefd67058977eb92ed93443243a235cc347d06ab08f5505c0166a172b3e438b097c1564
MD5 SHA1 SHA512

Submit Download

04 - Disk Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Size 1015B
SHA256 bdb7a3dfa33fda22e9583eeb8adfa6c4eeb10e148caeb4cc8d97b0a991680d49
MD5 64d08afb5d184742f6425079150aaa3c
SHA1 07df88e5023c10f30b9ff8ff2c0912f6d79b756e
SHA512 0b4ed1ea533ca01cb2b19de87e149c65ad179e485a94936d187e637134367faa35d630e1ffed49095125fe2d2f4ccb3dc4dfa24247b12cb9e8e5448600bbc84d
MD5 SHA1 SHA512

Submit Download

04-1 - NetworkStatus.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Size 1KB
SHA256 0e99c6b1a65baaaf745da524ad0bc197b3e68e9fabd1244cb5fb48d64fc01f24
MD5 967bd2cfbea4f877b0295a5d8a0812d3
SHA1 75023c85c466c79678f35cb3e5df1d699060d9a0
SHA512 014473b42da6ec13d0563df81e4f14ed3aa3baf377c96335d4fd7bc9571a41bccfe453ff98df37e80ba3747df38642b39d347b8bfbdfe91a6b4b12a9bbc7352a
MD5 SHA1 SHA512

Submit Download

05 - Device Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Size 1KB
SHA256 8284ab0f98071503aae1422645d5d8f04cb8d03c4649556c89cc8ae2084bd9ae
MD5 6c8752ebeeee500a3533476dd0d7f85c
SHA1 7301abeef1d6b726e23cc4a8c8fdc032e820142e
SHA512 aaf2b44a4be281139f6b7a25f07c7cd23501469f871787d597af712c2595c3bf340f55ddfaec2087a3a14035fd8d2321748e83e9778f913113308401be59e736
MD5 SHA1 SHA512

Submit Download

06 - SystemAbout.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Size 1KB
SHA256 a52e1eb97c1cc0c75abacae3849933dc8c21e6e9b2fb7df94bf4d884451633f7
MD5 13ee7b3fa2e72408101af8b901f12311
SHA1 2ad14da20bb91e2623ab93000670175d61e14d0f
SHA512 98926e7ac8e9cb0bb0b99c2f49bc075e9e7e86c61950924b1a12ef339e3907671453b2a6e69d0069a964821b2a572f6464a39208388419036f29897796d9fd45
MD5 SHA1 SHA512

Submit Download

07 - Event Viewer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Size 1015B
SHA256 a54fa001239ea8626f62c9ff9505f6e59413b702853653aa2635db6ee8b87090
MD5 ea440136650b4c9b77b990b6e6884277
SHA1 b3ceb60b2cc6f1ac431e64adc41def625f713512
SHA512 dcf7872186727216160cc3e491f679fbec65eda88f552a07b9fb6e1573ea8b126fdae007d030700c8896dfa9743da46d3c557c6737f8ff5df9410b0e979a21c2
MD5 SHA1 SHA512

Submit Download

08 - PowerAndSleep.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Size 1KB
SHA256 99c7e3ffa5ec693f81b1939a9eeb49b1ec526663960588c4f3474ffbd5fab323
MD5 a0b370e1ddfaff1803afe31c43cce7b4
SHA1 b16d2605a42300edcb8863978b7fbca73f13892b
SHA512 07e59b1e44e7f854f1d82d7fb9fa87e18fb49b55bf41be0d31f5084f0b757c0a79052ee790b1653e0eb7834de3291b7bf671647c20b28012b47949b3d2968a3b
MD5 SHA1 SHA512

Submit Download

09 - Mobility Center.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Size 1015B
SHA256 1f211aaa353c1e9b3949a4c337ff7711b8102729b9f7a4ed7adfd499ee2e2342
MD5 6c98f4eaa810dd870bd96a8e9323f9a6
SHA1 16d4c3b2173368b771823412a4dab86dc1ec44b9
SHA512 5e16aabc285f334bd0adc60b95e260341cbfcfed48d0482746711cd67507a70a24a92eddc19df70c760c792fb5bc0c9e442f69172fd49243c72cd01edd3b8da2
MD5 SHA1 SHA512

Submit Download

10 - AppsAndFeatures.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Size 1KB
SHA256 1b58c294593c03e6ccd7770abad5fd2414f84a5cf929bbf692af2a35319accf3
MD5 0d5eaf0b38142c75ffca321e0b9c7423
SHA1 9d439d04d667153333610aab1008eb79bb5853a1
SHA512 c55a92462a0e6eb8da5252e17d5e984748f8933d2589c6db11a1057aaef03e8f3848d52f44fc8a2d4d8ff1f87be2b38b9becff99ac23590de9cc9ca45bd97a44
MD5 SHA1 SHA512

Submit Download

Shows Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Size 352B
SHA256 cf7a3fb52e0cb775257ce0fd254b95a8ff166e7aa18cd2466e43d2c2a153d073
MD5 8d573412f43fad679675a92a0d5585a5
SHA1 eb6e4ef7054900a51d1a68539bc22ecda5316b62
SHA512 dd8c1f492cb177f855b174b005e9d4528ad99d8605221c8c4edceb65426d6ec98cb93d107d02ff3e9ffc3d3d89958e93256b7a938b8df60a0c9a6e66ca08ddb4
MD5 SHA1 SHA512

Submit Download

Window Switcher.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Size 334B
SHA256 74ec18e6a718b49997dc8ecec92bd14d1609d385fe9980ee9da825dbb935716c
MD5 d46cf1bde09408587f92420c497ed919
SHA1 bef66c48f5742b391f07fcf42b8a2e8428004210
SHA512 6a229345de4c646f3ff4d10bf6ab4c99d596db91490b3347786490b9903b3e5a658168b3f9c944d9a586bae0960822b0f1b28a845eede29a6304471dbd6c5975
MD5 SHA1 SHA512

Submit Download

Magnify.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Size 1KB
SHA256 ca51eb3516761c67ac9aac535fff62416590f0492dbccd5e6e2d8ba6f262f5fc
MD5 a74f826920a62199034234f784201fde
SHA1 c6524c766c21783eb5ad8f0a67204b611cc8c30a
SHA512 2ede13421008daa59840039d45b0f7af71b2498c9a7bceb243f1460461c7c315df013ce14a1a87ecbc26d49579a10d27faa446a0854f57d73915b70e3cc82250
MD5 SHA1 SHA512

Submit Download

Narrator.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Size 1KB
SHA256 b3ba5ab81e324c15d78db838d101b2b485dd88e6e488d4762ffcfad8756714a2
MD5 1039a4064d579d83a13ab94314ba6cf2
SHA1 34b280f560f6de554053acc2fe583f82d9580fac
SHA512 2686ec5921624f293aa68a824dacbe09bbe7165d45a43ee098b35a98c93a83868179b242740e90fc8b8cea471ef2f289b409345f29131f53fa02c865a4204eb9
MD5 SHA1 SHA512

Submit Download

On-Screen Keyboard.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Size 1KB
SHA256 55ee69ae7a3c9c1a9e18e8ba8e2ecc6f0162607a4e7d7d4aee94a52ee267832b
MD5 8611e10231f0de72fb5da94c67b3ccfa
SHA1 1edcebf5d7e1d53391e4359554812f8eca0b608d
SHA512 7878b5cef5219a7625f2886527f02770d59d6c05cd44ca26bb2541feb431468d19427966ebc8cfc5fd118fc62198a629a90227060f5a9efc7faaec8e47bdc1cb
MD5 SHA1 SHA512

Submit Download

Administrative Tools.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Size 1KB
SHA256 3fd20bc7ac429af2dc0220f93d6ae5ea53e199e93ceaa79dab59e57c917a8230
MD5 297887c33ba79f66f2803ab6f487800d
SHA1 2aa7997b3ce16ee7a0c493d8174595b1a461b6ed
SHA512 c4a9cc1e8c4577548dc8529f739c02f69d2584018247d5a922b4b77f7eaef9a288743c7b9d243d6947afdfa0ce0ed7cb49c2654af99b002b8c8f58f507cfb00f
MD5 SHA1 SHA512

Submit Download

Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Size 1KB
SHA256 2501b6869c5dce1d080321d93bc60f581bf660b0f471098cc20661493a868221
MD5 72a0fa27575fe882d9130c83b7141c82
SHA1 8bcfea0bb951ccaa200047d71ca752f78f35cd13
SHA512 fef4303582b2fd6738d6f225bcedf224166127abb568e35f0522358059ded71f03eab1c550cc5396c4332df327c3e95f51eb98d4a969802d4792d536200eb1c1
MD5 SHA1 SHA512

Submit Download

Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Size 405B
SHA256 515baa8e4c160777b4b07467c0f72388f253b58de7c0a663b366bcea64d6d4f3
MD5 03d0d22e53fe0488ed836af80d70ac7a
SHA1 0b02dea5017d8a6f8ec6a4f0e01a0a3386be913e
SHA512 1d28b19e3f49f8ddcb77c0b02b6c242e54c9fe0e3ed7917e2997d8cc60aff5f07ed7e97559161db1eaaa61ec95142618691b906468c884518b82f89f07a68985
MD5 SHA1 SHA512

Submit Download

Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Size 409B
SHA256 a3ecb3e9d970b063c23648e857e4bfd491f595a81a4ecafbdd63a78b5e9ac229
MD5 5529a11d5d7a7eb324f9950e0f01b136
SHA1 e44b31fd29c942dcee81d96a2a772e5248271467
SHA512 1ff51414b742d557cabad8f30147893b3e7146a890cb964ff81a9ffa7855db83f5a83070fdbc7ad0f10ab55e99252b584544bbced0fbaf3ec4532bb121790931
MD5 SHA1 SHA512

Submit Download

computer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Size 335B
SHA256 dddb7f97219ba8a35ed42b49aec069f1436209585fd5f578563b84fa5ffee0d4
MD5 551ec907fd26013c36ed9fe91e12a3cf
SHA1 59671a31c158dc9ffdebf32412d36a935d4ef800
SHA512 93f6aed3aa0727aa394c48dcc07f41fa7639970953512306d0df05270ac10b66cb8f3077af9dc1fff66e95799674b42790e0e6fd0b5fc00a7b74a05cf11ce08c
MD5 SHA1 SHA512

Submit Download

Windows PowerShell (x86).lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Size 2KB
SHA256 aa7b1b7407acbb511ee8929747f5beb5503fc33ad117697c1912ea2d106a4e59
MD5 5ba06148365274215671973681992dcf
SHA1 1a0361ab37b9940005fd977c6bded5a2bbf3201a
SHA512 d031433918a4dda2771b777cfdabace39cd031296d0b7f81ef7d002d0763e2f939313eda37e0ee6783581d6681caa523c861f68fa320889c9bf0947e7991d49b
MD5 SHA1 SHA512

Submit Download

Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Size 2KB
SHA256 003549a0af7f37c137ee8a2f09569db17137b476c0c6b12004583e95397a1b29
MD5 d3a5d1e4ba3746a9a9ce780a1ab2c3c0
SHA1 8b9bdedfccd80c814994122bfd76ba04ca478a77
SHA512 f960b89bafa11703ae962ec2073b48cf68cde077b848313846c047308c4585022449ba3343f999fbfead6a209c8a68b01ab81a354be29079ffa10700d9aac241
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 fd3e8af2ea5c4d12347b595cff6d8664c5bd5e70a7e75408089a3288fd074c12
MD5 35fb3d528ae394c2dadb28b94b0985e8
SHA1 8c82340a75658858fa1fd2f9b274d70e4bc9dfb3
SHA512 362fbd47650812421107922ac2f510d5946a520dd08063943f694a114f55c3e5d7f03f7d9347a803bfd7c1b265c2aa4dfa7bd652b0de3ed25fbce6a708a965d6
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 b9232a0045bf577a2aae7008f491c031b9ff60a07e7406c106d0f44c2dad6f8d
MD5 d4f5b256be1b7b53ee7436e565e62917
SHA1 04e6f3aecd333599e646f3e71922f192417f7d43
SHA512 a9d8834ef2427cbdb7b95010662484b59c83a84b552b724a0a6b015908239cbbf329ac4facae8c79632e6ddb47888ac520645899f04a22927767a82ea180a333
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 f1ea71ef72063919f2ba9d19ca960f17f19cdf897e93b2870d92312fb9fea5b3
MD5 715ff5f8fdec11fef1b44dd3654afe9c
SHA1 2965d3627c64eea41c3c84421e9114b8e3b6a03d
SHA512 509c9099cd3a6f00b3338806dacbe1287e457099b212ce1f3e6bc55252957a73d157ed9c28cc4468258d7e2ef7204abb0b7c09fbd924ca8ffeb3579430d1114c
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 1f52ebb36ecbce91bbf27cc92916f9978f5b93733be5400ab888e12a702ffb29
MD5 b6d0ae44969a4223862bba821d00f3a5
SHA1 6dcf04097dc8ef31c0f4955c1f4d8cb9bea7f157
SHA512 983c91dd3e592c6c92937cf1659bbc79605104d442020f24d2a805d8a2d2bd3224719033569eab23905272a707fa5e7f49a047298d71f156e8126456e9287596
MD5 SHA1 SHA512

Submit Download

OneDrive.lnk

Path C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Size 1KB
SHA256 79afc08921639cf72ac8dbf5b35113c607244b2a3c35d0e7d68383e74a115588
MD5 159426c169ce7a331034863ba26f897a
SHA1 571cf982ee0c9e95de737742d7c52057ebeb889e
SHA512 7018d97d358d3a57f001317e8893ddb205b775fdc9023509769146ce14f8a8d2af7d39befcc03265fa993b6b87b004933867ba3b767547421fd83cb00c74300e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads