1bbb5709755dea9fa41ddb5c9c809c9d4bfdbc5a1d8227ffb8638b96bcae5733

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
Size

12KB
MD5

0a984388f755cedbef29773a1cf9a233
SHA1

ed5407f8c89976172b67d68ac7bd7c55c2917068
SHA256

1bbb5709755dea9fa41ddb5c9c809c9d4bfdbc5a1d8227ffb8638b96bcae5733
SHA512

0881e6086e73c8b204ecd476a60cfb427939a2781019f2b3c7230e13c01ef46477d0ef49f8b6cbad3aebff21a2c2c193384618ae7b0e785914190fc53d6430eb
SSDEEP

192:59/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRM6H/1D:59ebFNw4Pk1itKkpAjjJs6B40W6Hh

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2172) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\N8J9qTLsbhhP7RS.exe"	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttme.inf_amd64_edc94fc65bef3d27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\CimCmdlets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_proximity.inf_amd64_e42355875c34e406\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdlsbuscbs.inf_amd64_0eb96a1741539c14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\audioendpoint.inf_amd64_4fc4a632c1490033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmeric2.inf_amd64_facbddcbb097c790\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\xinputhid.inf_amd64_b01c6ccf7f1e23b6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpipagr.inf_amd64_a3248d35e6aba0f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nulhpopr.inf_amd64_9839c838c72c0594\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_holographic.inf_amd64_6ab9629b23deb837\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hal.inf_amd64_fd0ae947345ac7bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgen.inf_amd64_977aa23dfab87f15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmar1.inf_amd64_b2ebe9229789b181\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\xml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iai2c.inf_amd64_a77c815b2999404d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmvv.inf_amd64_26dc960cc4c84207\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\gameport.inf_amd64_edfd5301fe3972d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msgpiowin32.inf_amd64_46634fa071d1db0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfcvsc.inf_amd64_dfe08f401a2eedbc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\SHARED\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwat.inf_amd64_3bb2e5702f25a518\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpenr.inf_amd64_20c8782372e47bd2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsonyu.inf_amd64_0e77868deff0b0cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsvirtualization.inf_amd64_078671a0cdfe2870\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_memory.inf_amd64_6fa9664593233d6e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kscaptur.inf_amd64_b95d9f4691816045\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcardfilter.inf_amd64_3573afe136371e51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\battery.inf_amd64_a239bc596073092a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_sensor.inf_amd64_b8789b63cc1d26b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\VSTO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-125.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreBadgeLogo.scale-200.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\LockScreenBadgeLogo.scale-100.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-200.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adc_logo.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-100.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\SmallTile.scale-100.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-colorize.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch.scale-400.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-100.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-256.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-36.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W6.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-125.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-64_altform-lightunplated.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-150.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\SmallTile.scale-100.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-125.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_02.jpg	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-400.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-200.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\3039_20x20x32.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_altform-unplated_contrast-black.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\PREVIEW.GIF	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyView.scale-100.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\188.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-256_contrast-black.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\8080_36x36x32.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-200_contrast-black.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer3Sec.targetsize-20.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-150_contrast-black.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_BadgeLogo.scale-200.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Wide310x150Logo.scale-125.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-100_contrast-black.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\Bundle\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\placeholder.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-125_contrast-black.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Light.scale-250.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\WideTile.scale-125.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\LargeTile.scale-125.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-150_contrast-white.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-180.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-nfs-adminmmc.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_aa7d9df4e8a65bde\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-vssproxystub_31bf3856ad364e35_10.0.19041.1_none_e6ad2dddc94ee56d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\diagnostics\system\Apps\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_b92a768e22c5262b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..i-windows.resources_31bf3856ad364e35_10.0.19041.1_de-de_42c45c23f5becd8f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_c_fdc.inf_31bf3856ad364e35_10.0.19041.1_none_2c4f3d60d08b3df6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-iis-ftpsvc.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_4c361f22f6290673\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-msmq-bpa.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_72b8cfe0243498aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-network-security_31bf3856ad364e35_10.0.19041.964_none_b55ac867bdccde4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..tymanager.resources_31bf3856ad364e35_10.0.19041.1_it-it_eb50ff4fbb34dea7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-m..river-rll.resources_31bf3856ad364e35_10.0.19041.1_es-es_66de9eb387e59f8b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..infrastructurewinrt_31bf3856ad364e35_10.0.19041.1_none_5603222270d30223\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftaccount-adm_31bf3856ad364e35_10.0.19041.1_none_1902e52091544b61\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_wcf-m_svc_mod_svc_perf_reg_31bf3856ad364e35_10.0.19041.1_none_d08d8412763560a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-quickactions-core_31bf3856ad364e35_10.0.19041.746_none_a9a42828b4748aed\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..xtensions.resources_31bf3856ad364e35_10.0.19041.1_en-us_18c4a33dc8ebf6aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ehome-tvratings_31bf3856ad364e35_10.0.19041.746_none_018bd87238d2bd7e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.117_none_7879d5035b0edfac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..ingfolder.resources_31bf3856ad364e35_10.0.19041.1_it-it_f7c7d918e7ff7a40\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5ca00fce9be92650\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1023_pt-pt_c0ec67041f3e7ed5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-audio-dsound.resources_31bf3856ad364e35_10.0.19041.1_de-de_68faa3d70dce9ad1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-bootux.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_43948841cc2b0de2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..otect-dll.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_f50fa1c1963e0b7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ntshrui.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_dd10da12705c6dd3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-printerdiagnostic_31bf3856ad364e35_10.0.19041.1_none_7bb04eb43a16f528\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..holographicruntimes_31bf3856ad364e35_10.0.19041.746_none_d3c0f9e5b7bc5abe\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-sysdm.resources_31bf3856ad364e35_10.0.19041.1_es-es_f64b1de5b9684af6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.windows.d..rootcause.resources_31bf3856ad364e35_10.0.19041.1_en-us_b5767653ca15f4e7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-onecore-cdp-winrt_31bf3856ad364e35_10.0.19041.789_none_4bd2822486e0a28f\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-analog-h2-physicsplugin-baked_31bf3856ad364e35_10.0.19041.1_none_5fb69e670630e91d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..aging-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_36c8e268dd1add23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\pdferrorrepurchasecontent.html	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine-plugins_31bf3856ad364e35_10.0.19041.1266_none_43fc06cabc62ece5\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..dem-voice.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e9af29540d87b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-isoburn.resources_31bf3856ad364e35_10.0.19041.1_en-us_2ac09c611c3c66fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_halextpl080.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_fac7d76278ea7c91\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..plus-admin-comadmin_31bf3856ad364e35_10.0.19041.746_none_0f5a7a011dd08347\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-crypt32-dll.resources_31bf3856ad364e35_10.0.19041.1_en-us_8417eb1259a3fb1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-scripting-chakra_31bf3856ad364e35_11.0.19041.1023_none_8642e441ed71095a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-alg.resources_31bf3856ad364e35_10.0.19041.1_de-de_61a954c5bcc8289d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..view-host-appxsetup_31bf3856ad364e35_10.0.19041.1023_none_bc2fe801d2277712\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-runas.resources_31bf3856ad364e35_10.0.19041.1_it-it_f46ede0868a70e7e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.19041.1_de-de_e38bd2c34e8e1456\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..onplatformcomponent_31bf3856ad364e35_10.0.19041.1_none_6de3df4f441c88cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ftaccount-extension_31bf3856ad364e35_10.0.19041.746_none_daefcf4d749952c4\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..h-windows.resources_31bf3856ad364e35_10.0.19041.1_de-de_bfff1e1167d31931\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.data.sqlxml.resources_b77a5c561934e089_4.0.15805.0_ja-jp_70a332c4f82494c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-l..omhandler.resources_31bf3856ad364e35_10.0.19041.1_en-us_f8d8368a4a6dbe24\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_universalvolumecontrol-model_31bf3856ad364e35_10.0.19041.746_none_1f112a4fb5d16d58\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_fundisc_31bf3856ad364e35_10.0.19041.1_none_31d57c5bda4016d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_10.0.19041.264_none_4082885e41be161c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-directwrite-fontcache_31bf3856ad364e35_10.0.19041.264_none_e28baf2e70308d52\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..ardwareid.resources_31bf3856ad364e35_10.0.19041.1_en-us_4a010c9e43e04bdc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.runtime.windowsruntime.resources_b77a5c561934e089_4.0.15805.0_ja-jp_f1feff9a883f8472\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-ext_31bf3856ad364e35_10.0.19041.1_none_3990ef4a132546c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_10.0.19041.546_none_b400f714c4b791cc\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.19041.1_pt-pt_2c7385b2a7cf26d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-wpfcorecomp.resources_31bf3856ad364e35_10.0.19041.1_es-es_0bb1c6f477773b0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AppContext\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ction-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_7177fba8441cd942\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-courier_31bf3856ad364e35_10.0.19041.1_none_ac801acd225379ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ULYNKUVBFRKPFON\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\N8J9qTLsbhhP7RS.exe"	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ULYNKUVBFRKPFON\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\N8J9qTLsbhhP7RS.exe,0"	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ULYNKUVBFRKPFON\shell\open	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ULYNKUVBFRKPFON	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ULYNKUVBFRKPFON\ = "CRYPTED!"	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ULYNKUVBFRKPFON\DefaultIcon	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ULYNKUVBFRKPFON\shell\open\command	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ULYNKUVBFRKPFON\shell	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "ULYNKUVBFRKPFON"	0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a984388f755cedbef29773a1cf9a233_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
e83ba9dec43007f065e81dbed1d89a58

SHA1
7eb2d06f5905dab5ac5cdb3d257d64001bbda4e6

SHA256
52d4fe072e9507bc82c6ad79fae795b0b6615dc3b74f80a81162ef0b81c3ea41

SHA512
5bd2283c71fd8ddf620665f6c9335cbd6ddfa47ab9fa8fee71b5bff97737e9a327323778d49804197beab16b3361c5c74818d0f5b45f8117e4d3be15905ed180

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
02e4876d100666181fefcfeb603ea520

SHA1
7c55eca7e6ebf59f37ebbee620625e6f02786b47

SHA256
cc44cf3a98338a006fa0aedfbcf8af5bb0a669bad863a9d69186e33ece8a0309

SHA512
bc013295e45d96298484d1080d246b68d82f120fc45401f6b0664459e82b144071f872153cbacf569fa1be74da9e7ff06f11116dc1191383719eb7d367b8e7ea

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
6e95fee4a263704b8a833071bf81b135

SHA1
4df5f55d6db0d391131520240749f91f4023bee6

SHA256
fb6d4aef7169c740c93988a31fe472e5122dbc532f705f08162f040f749cc6a0

SHA512
cf9225c6e77962d845900421fb84b07a810f3b15485f916380697f64181cf71ef7b34b4c3579391bfd5bfdf4641ad9b75ec1ef7bb942c42a6696539717c40a2e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
f60fa16d3bfbd1f028f5ef0e0951989c

SHA1
fb974627f3411399d9f69afe1eb0e9179527a7d2

SHA256
7f364e67bba8823133cb3e57237a69d46afebe7767a5be6b5cc4ff756f6aa78b

SHA512
a737aa9d7c196fbe09d290681787770faeaa2c9a91dd29361b3e3b9c63f33290c6625eafcfe1304a519900935a8b2d15f6cea6c69d9eeb1e774d3a14a1ef1489

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
287618c348964394e62a46b5b9b749c0

SHA1
635098dcff8667e851de46c4cf45f3d4b6b3112c

SHA256
bde2df74af424f0e960d3f8e4801bf94e33b87fcc0281a0a4f690fbbed08e8cf

SHA512
69cb73bb0e172fd34dbe406ce895c8811a0aa353a0d9919b361edaf2fb4f091a3fe3f784bee38465e3f6375441bebd6b8ef200420dc83fc33667c1bb3dec7480

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
c433b3fb747923a9b17397bc714c5354

SHA1
20072ad41ee4d8b26f9368f49891cc2b6179e3a0

SHA256
eeb18a22d276f81a8d7ec44da47114a776b4f58583e34117921023d3a60c4dff

SHA512
39f5211e40a975deeb2a5487ff204b935aca3c659217ddfc4a9a8072a9a1008b98e7bdeafb873855a43719bfc586e3bd379ab1257d7db0297bcd502bea916c55

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
2f0caa3bbf6265e31d3843d48fe95c47

SHA1
8697f537344623e77bc7e79080819593b0adb5cf

SHA256
9370899f09545e8bbe8c9448b71e7622ac1859d62f7d12fd523ab03471cd2f20

SHA512
c806533e65892a49b824b889f26fbcd796b31fbb12ce9a58098165b4bc663713a13ed35730456b797b34c44c26a8b5f176f0de0b595d25c18108c96024585872

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
7eec14daf77f1e8f7c49b96c63d73e80

SHA1
c5819c15ad4510d917531b6aecedda9c8344435e

SHA256
f84dd9f560e218a32d3cce4460b4b724f53a2ca05a83f0881ea4b2dccb7e9fca

SHA512
f81f7fad161c9e62252d174bfdfa44be9a6dd19d990a477e156edb5abb19fbf5614a5ef63168688a28f130adc7698fc04394499e6f529773bf1d8898e6dac8d3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
91bcd0d410260f60e0f9cc3428820b01

SHA1
9a70700993078539cebdbabd35b8f23c997687a0

SHA256
c57e7b756a3c8f09b1e36532958e19e624753747d9227c31dc0529cdda6c09a4

SHA512
8c150f30e8db97631c7c559a5654ec7e2a2d38f1d16aa5a57cdb60e0a672ee8129e9d5e88f50b4919d649a03e5423e8a59c6b9d1140c9ba512dae96f5226021b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
ed16a2fa9cdb5fe7f270bd1c40b7953f

SHA1
b7b67562a8c4d98afa542df8dcde2bb81fd0dbe8

SHA256
458c5ae0cc37c6fe0a067b8c82414b227637a5b83c43157b90b61c5687923e20

SHA512
5efba525adbbe5d32e23b1151cc0940f6d5b6213f6d6d098ce7a58844b2d902991d7946e1386e8294277e76ab02a625c63200d8c4406f0ceb7633bb1493d8193

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
7c8d7560dbe93acc81620c43f1639714

SHA1
5b598b0d11160a9cd9abc0a2f4c3c3b8209b605b

SHA256
aaf6b7a1baa9a5699e9868d922958b6e0e736106d2f59f3f1a5cc989a43fb968

SHA512
691072eee02f562c7e69e355eb710fdec3281af0e8027fb0e14466cc1c829355e67afb6311b70b9da25acc4223cffd29a01bed44ab28c413e9a0cf89d2009209

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
030eba45518ba12a652a10740fcc9d2a

SHA1
4788a151a4de8d02c9e6328b8c682642ea3a96b7

SHA256
ad410f154a5868141ad84928a662626c5209f76c7eb62c59d8106562e535889b

SHA512
7e3100b0cc99fed2239a7efce6c9647a146c4dd2e3bbe7f236104582549858c545966d9fd66b2fcbb27b1fd3063babb9c4748f3c6880225b1d353cee02f08eef

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
ba6313d3802b742c8d320224778da0a6

SHA1
361c127e25af40d2885ee586cdc5dfb0b6177c23

SHA256
c6015479627296066d7e29ca453a3e01a533f190c3f0eb58d87fba3b267999b1

SHA512
abae036d986c49a1a0f47ea2187692421f812e4e49e7e5f2c9cd26bf0843978a450a035b2ee876efb4cdf4588ebeb8b939c2ff87391e90fbf7cefe7cb6f9d816

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
89579f2e627d9afe533d232a367735c1

SHA1
8f051178b1356c98c05779eb546e7dd08a4b8f15

SHA256
5905926b4a2544bc5cacc14ec8be0d8e2fab13e752e960803eacce048816119a

SHA512
e676a01908b1d2b058a93dc3dba4b42287d1f19736be643aefa95c72b414d39f5442098bc6c402f71d50d4847b3ff7a3fcda7c1a68106c59ed3247a54812e156

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif.EnCiPhErEd

Filesize
7KB

MD5
d023b27716b57314f5682abd84795d67

SHA1
ffaca9555253d3111318b6d620d5cb7f8c3dedf0

SHA256
b23146dc0e09fd6e17319dea9a7a78734932f7bf8e5801ffdf9f05a6d1c69a7b

SHA512
c2a88a10709934a0cf08e56dc60a6edb0df874c8f3e95ca1c021f39272d26f9930dabb17edfc56463ce050c657d692476aeabd826c0f7d01499fe1ea12326d44

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
16ab6115d16a3c76a34efad0042ee48a

SHA1
8696369e24ec5d2b0551b3a4e5aed52e20a565c7

SHA256
ac8984876d6be9b7baf154f0a91bd277b196270773032f2f3178a6058aa50071

SHA512
1042ce5e213541db18e3d15c3d236a6760189a238cfabca1472fd79e139e90dea0635e9b1c08d3e4ed22b8b0a3c4122bc614d263c0e0734ec7c5ad2b18cd2504

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
23a2c1ab5242bf45ce7adaac7301bc99

SHA1
4b1bc9f0084c4871b11245ce18d04d184570c085

SHA256
b5ef5d7a63e0bb755c60996b8c3cee215f2e60dc2921c32a138444cddba2cbf7

SHA512
21a72fd5b3b632bbc0b390d816326a3f0785c32e34028355a746fa761583163573e6fe4a4e896333aca6e5316a91b8875bcd12f06c52b14723dfdd37e9f3844d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
84c42243a43e72f3c8398cfca076c805

SHA1
7918af9143de4be75a580242923e04f795d87dd9

SHA256
38dbe5358e315040c43015a4ef9628d79d6649cd1fa23187618c484c35bd5816

SHA512
3759c2ac798691bc89e3f76ea23c5d8455b7642f035646defb58987d07582bfd60054429eef803d4559bedce303d22f46b9b4bbbd85bf2c50375e7dba3e37c8a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
937a89fa7ec054660c92f7b2de8b4d43

SHA1
d06fd0608bce1b0c2f9649b39f3e1ef9e9d62578

SHA256
aa253879ea935cd06e97affae6918c0915c8cb6a3eb72cd786bd17bb1e8176e7

SHA512
ff5a9465eeb170b95acf336064105d3f9bbd8b4625c7e07eeefdfeda3fb5522693ec2e176f3684e1582238b154360d4fbe1dd90a70fe8f3fbd2e7e7fa3eef283

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
326f64330f77f9ad8b5c67875f05e375

SHA1
30a28fc287e9c39c6ab7a05dfc30e35c9983531f

SHA256
9a8ebccbdd27d3a4f198341048b2beb7cbffa7473ad82645cad4f514074e59e1

SHA512
59799e69155c3aaedb35e3b768f38374f75a72e6777a33ec8a189f6cbbabe21879c7ece765100fa930da51861a8a40937e023a877abeeb9c03868b39981e8a39

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
47875e83e0a3a7f817d4768b4d1384e8

SHA1
03fc605527ea2c2a01179c64619ab3c6b419d915

SHA256
cd455314f68f025a0fc82a50ee51e643831d5102df53f4ee57d5892fb7ce24f0

SHA512
0058eeb0ace0fa041e6d6adce2675e49e353924ffa3a2502af6f72c23dbe1ae6b2660478c727cb1d040c8bf25248ff0b3490faeb0e2621f766b494e9f97d1697

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
15523f89d6cb9f5877eb327119a9a941

SHA1
02e53918b7ebc79ebaea90cbcd1dceee1c33f21c

SHA256
a69fe69594b68560ecdc2791e81122e194375fee4463fbc52f52ef21e278e9da

SHA512
d2abd539dbf39b02b5aefc8a5ee48b4e0414b32c26033cbd73f74cec3f78bfdd6e480090e2f8db4d8abf43d178dcf6ff6c6366d83e145445a5be85a246fdffff

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
8a3d408e7d97ae44a9528ce4f3c61d8a

SHA1
98f4f38e5392e1fdcf4fdf2884a2faecd84abfa4

SHA256
7035e87f2cdc2eecfe36d984d8e9ce748020f65f88fb1415a54e1a3872ec841f

SHA512
1f1a6b9c112a429c7128c6270f6b3056e7a4672b0232891d671a927588f4520541dc0651aa02303167838cf61f0b3354705346c1bef668abebcdaacb0ee76657

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
c3bb3ad04d47b6537adccec847eb69d7

SHA1
2e5d80933b14547fc284f61c3e68a2da6fd5c90c

SHA256
2fc94681bde7ddac54b81f8c4d4a5bee50386cf51cab35f6bd9a2b0169900ce4

SHA512
c25b3a5c146fdbd39242896cc627c314b1ef9047340f84009770b2a0c4efd37b2d38c3454376e0c1b13e0386561390c4a4c2b27cf2ca676e2550eded8cc0ea65

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
bf2a931103fa51ab51b8205373314ddd

SHA1
5d57655dc768fd9f8543a8e86ed38c69e066ffdc

SHA256
70837cac8f0a7111594196e8ccc09b307dc49175aa5c090ad4db2e91086a1bf7

SHA512
7bb23450649f61eec317ac02d267af65f5de388777ce02ac20483a289c09c2d20a85055786425648612ca00b6c4127afbf02742e07b447ebd0854b5daa414c13

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
99644768ec7b887830fb625bff169d62

SHA1
36153cc6d200e20ced1a2bb00ab5ac166ebcd532

SHA256
99c37a84e6e49bacd168c6fb6d6d6ff3c3a3c934734cb6aa3ca667da20484bfb

SHA512
951624fdebbaf6537d00dc09b747d318523cc485f2a574e4e4c7630a2b9b91bb9de15f6d5ddfeeb3e2fd14cf96cc734984de5c5536c5e3ea8a71fc13ce0289b1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
cd9917aba99349a4f0cbc9e47dd7103d

SHA1
0a5bdc2404f495d8e9ea38221eeeba8c3f8aed6e

SHA256
433fb4ac3b674eda6dcb1e4d69f50d687a163c89cc05358792bd0491149a4132

SHA512
9dee0d0ee9c5b086ac57f463578afc8a25b41466aa1dcf3234783f69b49edcd4d580fb6c412e3a7844c68d76804ad423157e374e4cc23238df45fb25ef62f3d4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
48c6278c8f189fa187fbbaf2c98be905

SHA1
f82e8d73398fd978f6aef12f41c784f9cef30ae3

SHA256
69fe8ecae4b03b73aa25d2cc8bdba1af598d914489a008097482b7b4f0e00ca8

SHA512
93439eee10c7e5ded57876e6eaf575911f41d1b22809b0ca7c1bb6bccfb2138d455d77e8ac175e0841d1ec1d2fa13717e9ec4ed2a2afdca3a6692d1eada5cd0a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
fb612bfb642a27c2d8fcbe572a6db447

SHA1
c24d445fa3d3409f4f8d04a9d0798326371b2cf4

SHA256
21cb5783c46c378293215544c1c84cf8a19a6d84e3178107959888de1dc4a179

SHA512
9c971f3d41a3db0f23ede93e581effcee06e4798165cf37d45ce6858a0ae5290f8af19552cc6197c6d13b605b04d3f4b62278db6cc2f14f272ba44ad00f23289

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
52833487df8aa818a02a76443f768e45

SHA1
9b4672b42cfaea17aff122228f8ade94d7cbb443

SHA256
bc09ac9dd592b2382a63f9923332bf70908c0d4b3aea78dc026cb5f7fd5d70cd

SHA512
dc0685740c4ca74ae6b47d60923bbbb261e005520929d51be7567d4f9eebe6b849c5a6a0e80de4325ee1b66f8c7da2b42d7deb46fe4fafd5507036e144f0af8d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
ca23b6739f82fc951e667101b918cc5e

SHA1
6c89850aeea8868dffa2d663d43d34669603c7dd

SHA256
e23db0ec200c8d4b9b3135d7365a6b14172d9e32b3788064a67c51594ce32c24

SHA512
ad93bc3f6d457889bc0f129e0dde09cb885d6543efbf7b5616bab7e8ece1bd194e4f4301a9407cbaad50d76fe17ba4677ffd75125b45c98c74639dbb1d83c0d0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
fbdd4d8277fb0d78ad5f8020287b1d42

SHA1
9189031d9809b80464f25c30189ee88d4130e289

SHA256
f967fbae7716c0b52692011f99468d8c959fb954cd62566fe0d7e56b3158324b

SHA512
a3de3e08839e6d8ef2e141bbcb8eaf1c9005f21ed7d65efac9c30892152c0253b5946a0de03cfcc26df8078a40261dad4ab4e942c47db629803208f270906992

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
5bc9dc1ef872523db1a9ad1743b4a9c4

SHA1
77292e7af92217efb22541b475f18f5e928d56c4

SHA256
8bf0c8b3a9aee77c4a5166c49d2b8f82e146a31f1dedd4a6f94da8e9088cb639

SHA512
7f15064ca91615e8b2c4c08829a5a535334f5e6925f8a26b8d1dce04b1bcc0685ca8ddbd3146a483a6031f85a63a4c23d1f3efb2979f612211300e70a181812c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
6329d1d0edb2dffa15b80fd920dc20be

SHA1
a99dfec879f0274455e660a2ce8039e30b1811fd

SHA256
9f7e2fa5a988545ea3707ece21a7574eea5e6a0a5652a28d170a6a5ce25e5206

SHA512
147aa3f1a14f0b6dbb7398f38a591ad74189155b64345ea05939f3b01b00dd56359b3313b1adbc27344f7aec9bd9741b750c8fa4f6686b2d9b31ceadc9993734

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
a475aec89890ed35751ebd9156384215

SHA1
013f373d556684b849122b683c0dd341724000f3

SHA256
8b3699b1c25400fc0439e437ab9f71fa7f332ba5af604e4030b0b36f7a39f6af

SHA512
d353aece4aeab5a99a8c73c99cc1ab58fc34d386b53aa179d05653a6d73c4ae64418470d54cc9b839f80cad150333873c314536d3c102ef93da4c4a2f59121e5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
a84e9bc79957db5fd5c10ca92f73537e

SHA1
ce88f3114c6756f2d6f98bf0fd5ffc3d1fe34956

SHA256
1995390156b9a59c307fa5f0bcebb094a082039684c94465043a5b828d8ed408

SHA512
657eb92cb26d6a018f2f3d37ac6970f115a3732b3f429fb92b01c45321dc9c3cad3d51d6490a0d7cc99015307cc56f152ffcf3c34f8aa5bc427d175a48f76af5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
0bea1291e902ffecf63943aa01c0afb0

SHA1
3468eb18d8f1d75e97bdad0703ef742524b854a2

SHA256
f3d2faa9ed80607bbe4aec0d565b0492ff1c0de7167b7bed4a0394dbc7d16045

SHA512
80c7da0d210de6ef4a919d3118dbc1c4f28e88dddde820f53ddd798160ce170f2022650d4657863e1eef974fab9133e93f9e0b724713e19d6d29949d44c7e4f3

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
b342e931535235c54d2687a418f49f42

SHA1
9410f1757b3f9120156f0df22204de73fe3e6dde

SHA256
242fb663c1c06225e746c64f6aa4a6201b5122e34e8cb3d6e85c6716cbf97993

SHA512
387712a861b744fb11424662aaefaa26a5c69c7277aabee81021fedb55496eb10f1de77e49f0c0a91898bf87fcf59904143550c9b65c6cce89e0f6fc197afb73

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
282B

MD5
69a98ef655778f1cb3764a923acbae80

SHA1
22683321e95c9a631039d15fc49ac5d3e639ac54

SHA256
2ff127d5bc4c7333c8f522aa4b456684eca97c06d452bf7d00b6a99b49b11b0e

SHA512
610fc09f40124e1a74ff303ddd95ad5809679be9e0c381e5d367ecf8e1e137c3da188142de7a2c5fe2b1225e12482245f2b5c417d43d73618108bfb1c32a5ed2

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
36bf038b12a29d7f86a97779c9724b58

SHA1
4b4d27a6ffc111901382060a4ac74b17806f95e8

SHA256
f2fb6b89b104c1a4bc5e529321f00b8a9432d0482583aef6230c1353b8738035

SHA512
6fd1759b6ce4d888e2eff48007e20df512f9259e222105fa3ab21132b4d546346f2bd396ce95af6e8b0d9349231ae9fec118ed322fec85008d4216cea02bc66d

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
1ddfb1edc7a22872917255884f710911

SHA1
03bcc44a15977db454b8e4e84e27d980840e44c6

SHA256
47b4bb2886438c437669a20e69c8f20b0451dd6cfbea22f5960c6718dd2c70e5

SHA512
6e226d869c5d49a212a1dcf57eb3af2b0be0e147d239562ddee96242983fda0b82582f3a72b84fbfaca44c46879c65f6d5fb57ee74c68b272b8d5a37893e05e0

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
0d155a68ad3f96407541ec1fd084d304

SHA1
a45ce67b54c558338125cf00a64037d7b64f7acf

SHA256
0d22790d1624109b22326ab50a93f1458d10b0faa6b649ee015b255058fb514e

SHA512
6c92256a695589d5a552eebeba1b8ce7c3f973e5248db7f05703c00d71579a0adce5ab96c93e5709ada6c8f2d6f08f3b91d6e21d4fa1083f4c3857cfde72c957

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
5d31bad497c177afc5478f0a56e137cc

SHA1
be99796e7b639663d46ee43f66b02724d8e91584

SHA256
47afc436ea3ba0b7d9488cd38d166cf85265d841dc1da3759c76ee913e5bc9f9

SHA512
848f366b134743831f9a6b17726edad0832ba3fedf11aade21bcb78c3a0ffa78cf7fdf95b67bc4f24cb40a1631951465c525a0d34920d124ae7388b735d24f0c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
fe6dc8d8513e9be73862aaf3394ea080

SHA1
15ef8f7b0aba1c90e24e32b2d8d4d2a91bc097c3

SHA256
60fe542ac34dfe0e6ae03f0cc6d5b319b80570a3aade0cd16f48f190e3fcb4af

SHA512
f26a62ac130ce095e44093eb9cc4dc64a4fbc3c55b0c304d9b65ac21f77a8eb19e8cbd0f63bef885b230a430eb20e9086b07f68fb30ca4b2e64ff27b225009b0

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
2d5752e31fd6a55d8db2f2057ed40ada

SHA1
d3ca522f84398d8be29c6c011b937d4db4e65132

SHA256
e53d68cd7643c905608847134c172c49a3585a7e9124df51e0fdf309b187fd45

SHA512
f351c11dae2d85cbfc2e0b0c7a99383092dea04c4d0297adadf36ec94e6c94d9d3c7f0ef8fc0344b8959a7082e3a34ed90b1823a60118e607c715ce26c2fe51b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
7ca6f67ef8ca69c1e03978a5ea8f32d8

SHA1
73273bcbe7fd131f866136a34dad7e21527dc60d

SHA256
42a39fed1c81dcc9a9e9ccb480ae286698b3dfeb0a8d1f67825fc87f499b200b

SHA512
fa0bd1b5eeda1b5edafa7f3d745e9df56cf4577395af4cefad77d7eef130fab08ec78d69f8e1fc1a44d15563c54fc1c2acfbdc943fbd3493103da760522cb7b8

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
b2480613aac01f077861a14c347567af

SHA1
80ba0280a81c7eb5534b67012d0a2fd93e1cd7e1

SHA256
7168a381981d899e438fa9cf8e27a9b8eabff93902e3fdb1bfd3dba6d25ada7d

SHA512
abb0f4282420cd72c9983c523ea8ba591e203d2031e4a230ae12ba64da4a4212efbc478b50dc3e0421661c891a0095ad7118693f3ccb741f956da164e5021d5e

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
f22400fc053d8c44345ef3fd7327722e

SHA1
98b981f6ca91b5b4dd149e6233f8da9940e7138b

SHA256
a2c17a7d79bc1d00ebea961268ca13b4a38b9e8d65be3f75404b80d43896608a

SHA512
29652f7f8fa2776a617a905db46df340eb9b01c97423576737ed5e6e814d21d6af5efd4cb54dba46b85ad42a78bf5a9d75754fd17e4beb424b7d6fc7a2d25c16

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
53335cdcadd4539183fb3136e4417bb0

SHA1
5d2d1c7fb03647c78df64f7d8e9a51f5232672a5

SHA256
ae3ce0dea5d8292535f13449ac8deadc28f9773310ba2268f622d65dd686ce55

SHA512
3fd9ef7c6b1b6697e977251358b04f399ec8ffaef8c9f578a19573af2b36727f7b15f43af3339731a1162ef64293946b562edaeee051b2b04b7cdace8360a051

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
02b3f16ca230bcd94df04b99dfb9890a

SHA1
f2bc7a8a554f97cbbb09044be0815ecd7435a76f

SHA256
2577c9c23a3d9b31060285e057d4efc696eab2363fe4d56e6edaff0793ce974f

SHA512
c1261c8e57e7a950ab9f3adfc0a8bc6f356892bf14385c8990700711dab5f9a2d4f9c46f52b31d7c4f1f58c01de23175dd0e896d8c63f3ecc70c8416f7b819fc

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
92d54a908b2cd8dbf11aeb16eb5a7f98

SHA1
71079fb7325760bd03d9eaa7c4846b5e0e971634

SHA256
8b910bdd6e7d66f0ec0b9ea5a0ed92b409fd24dfcb4dd0d063f55a40c12d8453

SHA512
6111a3f65aece93a2c3cbb6bcbf09a3709f2f939218db7baa39843483b7ae76e760a5d351c956d3bf2dda3e134c7a95b4f2b5468252c66597a36dcae6543ab6a

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
8d69bb183eda56bb6161ff0a872a185d

SHA1
bced82dfb366a4f1e91c80c573e53be825cdf447

SHA256
c4aa271d31e720bd8a8b3235049d010e5e9fe49c1dbc7488007d75078f791bb9

SHA512
11b6ed8802f2a60f64f1f5f40ad86791550bfff73be2bdcde0fadbb7c7408c3cfedb6d10428251795731ec64a19202b2f098076ef78ea095318d36e015812f30

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
049846a784c0880a5933ac4410acbd3c

SHA1
f0cc337f8071322a6aa7e1fb89a4012e847342db

SHA256
26b82d91074425a491057750eb32de118b33d415ff35febdfe721d4bd6e2c789

SHA512
4892826e587ec1eded45963aaf7b98f84a32ff8e8b00667d5523cd8badb727a4efdee0fa916df93d0a73f473992df41b785e0a83ce906141fa63cab3f2514aeb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
dffeac56d81b834903ce4f93066b1b90

SHA1
557f184ac0036eb52e5e824ec2c40d74ffb98fb7

SHA256
7ed9c6db8a46c9af56d8f7d7f0438ac61048416200ddd5dcfa952c55ef24adee

SHA512
190027d22e759d1bf2e719bd31dadffcca73c99631a2ff40368d9658738eb4efa3388b220eb00b72ce97314f3cda965e52a551a7edba970a5454e45c73d77028

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
e75b4ec58862abeb84580c3f59957fe2

SHA1
8bebb9dadffda54715e19b72215cd08b7c520ab6

SHA256
4e161ec03d9d1d7fb1e40d882a926d7ed622143ded1ef94730f440a58df698b9

SHA512
08e9960d11252de1dc7fd7f8f30f8901efcdb9e02dfee8bf222b1cd48b64ae4fdcd2b603265bfc63f638537613de9dd47c7de7c844c10a85cd0e024fca2e73c8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
7e4e421176f8f106b8f11af911417498

SHA1
a6d545a41f2cb84ee2c3cce19980df896589cc02

SHA256
62b724724ffb6b97dd8bdb60d874fa498010213c6ec913b205289d28a4c4e0ee

SHA512
3aca60c692f6690c40952e6a26cc00e434398f11816cd75e260abfcf37681d43581b8e3bc040fbda804d1192d0bf1c4e6a1118e089e11a1acf419670ee7bed1f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
07ef49768421b23cc01298c5185a6ef9

SHA1
9ee31c0f955be73057a2a6aa37c3399343e27aa9

SHA256
334515d548ed33aa106765d783c89f4f26d4c9f0be374bb9363518e949bbb8f6

SHA512
5dd09ff575a860f5567023213d74ddae1117ccbd177ab23d0fb75b5f8774bd3e1d051de8a278c0e96f8e0129bf97bfb46f57263a02e34e9f2e753939874f41e8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
cdadd67a9885224b95882f878c5dda48

SHA1
84f2b7a27d0bdb82352d1d78205c8c3072683546

SHA256
3dc8df951a3f71767843642292235894bddbf571d768bae8f3503e6bacdd4961

SHA512
6c53e403656151e72d14f5a9c6b0b76897f55f2b0ee2d88ec7186b2363e099de6c7894a2266d6cc360811a0926d18dc055e0c187d2d8d521c88e4ba5bf547de1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
282dda34a949220653a8782eba95da51

SHA1
0613124c5056f91aee2ca44740e49633a94c4a8e

SHA256
5eb472fdd40a87c2d10cda93612fb57b8cef6e0efe64ee11f74a0ef795fa2c27

SHA512
e233fd0ad2e859f385eee97000b830f75765eef1cb0905eaf0d7baeba6a45b9157f7e10f3b9a2c8d53f23733ea8fa62eb2d3bb41da548c2915ef0e95002ee9c5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
0e1588dbba81125313026496f1238a62

SHA1
a86c806d1ed4d23bd6ac80eff69744570e4525cc

SHA256
0b8181da05b923d4e906fa045e0d907d0d5df52f4b2693da8a410a4dadea2a42

SHA512
78d0c1a164b5bd024e5731b7e1ea24aee55de8fb05aa4c61488457358b53b84714b3687852653d8ab88c28da8bc12b12f0364532a38fbf7a2598ae7d59e2722c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
27c54fe0e94ddb7e159f148055e53ab0

SHA1
dc4b70ae2f965d5f3cff9fff2130d30e4bce4cbb

SHA256
e42cfb82d4dcfd1dd21a1bb86ea4044488360ccc52ca3bb766849c7aaef0eb69

SHA512
b0fd06583f562e77e74a1fe9c4f7c854e950596faf976da417a843a1e9ee4982c2a5b160d7c151600002bdf574941855a9d7e3dbcd9064c41b2371205dc84ab4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
0c4fa4eeea9f88a23c5dc1bc971602c8

SHA1
6f02887cd7ca9c370d17dbb9e1fdb1440178e9f8

SHA256
02da03f794b648192219615aafbca270764db4d36c70ac3b8ec457f16bc8672d

SHA512
a6c6f6aaf5938d19c9f0f63c9f5d7549620c19cbdc1ed17a490bb66cf1a3afecf8ee7b4bc4090569b3f4bf2948a65d7b4fc4e74337ae42b94ac83293304079a4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
562460c828ebf56d926bfdd45c2c1a74

SHA1
ac1a37b383f644572f04e1913dd9e3f798946bb8

SHA256
dff7a662b5fa0e6e5afaff8c64c6ed196cebdb5ed7ce6bcdf0c99de5e2381c48

SHA512
8abbfd92b8bb8d01b422f5682c4fab1688feec1a82fd698af1bc5a70c142e56061a7a95b41d981b315606da27bca0980d17a6a438d8f5b69e9b7c7c62b952d7c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
5fd92de998fefaf79774344838db6fa5

SHA1
c13c067bd587bf8a67f6a7bd409bf8c9c61670a1

SHA256
4289ed2a25df3b319d6ccc27265491e9bc694a83be845050cba538c2fb1ffca1

SHA512
9fed1449d08258f1f79939fe8f26bbffb840319a02ef7e6a86d3ae9c3b9f10943a94d3364402959ca4a7a5488a887a4d9d652bf432d312d4e336a35207fc01e1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
96df62c6ae97b5b8f03b80572e707993

SHA1
9c56eafeb949568e49c9dc49a18c24afa401fc42

SHA256
8ff5b36be6bc7a78a52802ff576ff8ef5358bc0bd6a64ee8bc88ca8315efb0ec

SHA512
d6e256287d8d37f5fa57fdd2af0d2a9976318b69f159bfe1f508785bf7ce26feb95e662fe9c688d0ec17c373e6a91bf0150caa3132ceaf75f4ce930ec4db0c51

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
f7be30f746e40baae89f4f57c24c1739

SHA1
e76e7975ba9eb46a97e1b3e37581714429384fba

SHA256
d782cc1dcc3354a5b59c023f13f585bb6850e0426f87a8162e482f35204b3068

SHA512
b475805ece070ece222ad1638d6f21028a1357bdaf0e97a18f30a17636dc9eda3efcac034573e1fabff801e942b2524cb095778810e5f2db3160fb13c5e9c957

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
1c2856d3180f14890de28a05ce0b5887

SHA1
f43c3073220da75646ffe4ca6cef186e307342ac

SHA256
fab30e8288713859a699ef9e99c92c0396ec2e82b2076c1af3fdc0bbd2271fc7

SHA512
cc93e69fb057dffbef294806865cddb2d04a84319650c5e749408b4b239af459046b502177b08527f8de3e0514512cac23ca44b04767468fe9e0cdd9c4359f1b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
7dcacbd473470127fc4e079203771893

SHA1
c0f20a992c2184121eb4bf3bceb7b9e90af90409

SHA256
351e497126677eadf836dc36b5ebbde254b0641a1ec23570ba0d44a38a79d55f

SHA512
952fb0df56f2442dd1e46a5576b1d61996ffb1665574654b716c81c6f689c523f816671b2fce8dd3b0a22e4d5e57c2737e74259eaa523c1698694d3f23c6bec4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
ecd32e8f3eff94e950ba3319602e5af3

SHA1
bf3d7152c1d1f9bdfca1a5085aa9ea1ba6f8fe13

SHA256
b5575f0d11b5c35bb12e3fbee649db2337634420b7e4da5bd4c9b09ff0dc14ec

SHA512
c44ac54297e8e65c28693f58a7bfe36332071bb71531acdcbfcabb3a11dc84f09f95b355fd7d4a224739cad131e39f4ceb78634496f34c3f606b705d3a6e5a4c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
98a1ca2f2ab0d42a4eef6f3a2cf3c6f5

SHA1
a79ecd3767787ac9c32a17f5919231ebff02b6cb

SHA256
a63865942c327fcdc2227b7ad3fe06370d7baaf396b34c043c50372a1d48e7f0

SHA512
4479ca8d5c8598e3ae322ec1518bb4c8eeff9825796eb28e6c283e360e4c6b9ac2929b1b15d034bba66bcc66172967b3f78bc85babbf7863388a0965c9aa21d5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
7bad231b2cd5d33b6171887e37dd521f

SHA1
f486af4a94da0d350e43b64eac383b10476caba0

SHA256
6bbee08d315afc7784844339b4259c2b06db7957948a84516db10e38db8684a2

SHA512
715438cec6fe7747db19581b3cfb7d86b80e447aba16b9157c235d3d3a36eb6ab84314699342e8b6fc4e0dfc87c3f7de0748fa62dfb9939d5f34d5b09292e59d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
25efe9291235c58e50e188eeaf79d248

SHA1
e1bf8231e59e5c5439ccdefaaf4458f3d6a8fdcb

SHA256
f239e70ee8e20908a7645509ad841415332dfa86a2e3224aa9cc24da363d8661

SHA512
b3d00f2bfdcc37c02461a3f10731597abf4b66d78e08bf95b1d2ea98e1f91257a48a75e5f0daca229072d2ea109deb091d62fc8e0daa46a1e52c6b482e08c4df

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
ba490fdb91430fc755ef07a7c8875b00

SHA1
26c5076edb7948e6aeb9fbd8b8a3a01c7849d006

SHA256
38e16f1eef98792dc7a6d32ed37c2077a5d16d8e7ef39e0a240bfa756d12f655

SHA512
5536cf38a6fe45852b64355220bcc91f99e08d211c3020692fd29d5e5a8e519e74e8fff77300921cacb323258c6d6814c810029277a3c2b9ab3e1cf5865cd88a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
650f73b4670ec2ad89eb1e1fb86fbc95

SHA1
293525ac6979e95b51e49e88a69288ccaab7bd50

SHA256
09a1932285e38870ef8c023d4af38b92f32229db2267f9b233c5474d9017bb18

SHA512
27aa5057734f2a1684043e1e1d6739e36e94e0bbcc7821f20000680ccaec026b89cbc54a9b4564737d18a63032a78d0c0a6b5509aa62912e8da39e5d0bca1ef6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
68d2c07013dab555e44ae2da76324a0a

SHA1
c54fbc60bd99b95316a84394b5a2a6be8f6dc58c

SHA256
cd82bff9e5deddc216b4f4522058be070747136f66bc434f06c871e9a593890e

SHA512
0cc346a6d1e26008342b61c07faf4eb9ec275199ed7d88052bba1afc0c6a69792c4b501e58cdf04eadd20f9f0ed653f7b28bb6be61ea7ca5509f1dd55efbfc0e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
4317b63bb142cdd1b4b020cb05a2da35

SHA1
bf05276cbd63b1292ab3bdb95e3d8a5bb2016d9f

SHA256
7ddf4822ea2b74e3cc58a1f3ffb5ee7b0c27da345a388f259ab2864c03ba6fa1

SHA512
6a8df35f8bc6b289c2a0f63edf3145d27fa4b7b8739f67dedc373fa898e7dd7a92e5dc660b74ce29cde087d0619940124f64e562b87e6d5bd81bc757be23bf1b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
1f34e3865a1a4f9eddab0f33c1a1071b

SHA1
7fdec6be791b0be2f47bb94cac323e6c0012a96e

SHA256
5b154bfdec353587a436064e17a62806c8479465bb08dae75aeb158b84a86e90

SHA512
6d7547518ee060af5d4a8348bbc8cfd429ba907a454786179ba14c04a80b76bc2907f5e6fe9fa57eca3da32588328ff972bee2e68a6c16c4a4003a4956090825

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
4126d8e5e208ffd023ddf9f01929bc0b

SHA1
b44c457fdad0264adbb5df4589d13f0aaa556761

SHA256
ce38a83950a2d022f47c1ae421d48dc295c130d5c5467d6978f93878714144b1

SHA512
e156167357a6b8c68fae4a1daa5841c8051ded70156f6d44c8b13ab5a6c49f69cf7ce2556c21634549d84b42dd04b99db05f052d1c4c53c190d7e8a6d7905ce2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
cdbfade61ec4d341eb6c928e3f44d325

SHA1
56c8b6367f82792f372517786f74a1e5a06cf7a2

SHA256
9c3743065b3a88d5bd7633fc0d84b818b5ce1c32a5620c4fd7130d663e143d9a

SHA512
7d977bf3efc88d134bc79c58ef0d9403bae4f2e4acf417d103376aa9bcea92eed62193893630ca6f8d304616ee919136842a60dac12f24e49990ff1ecaf0fece

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
2c2dcef2273976e948af0f6dc1a9be01

SHA1
2c88fd1a5027623a7f45f4134a1a06e82eb4466e

SHA256
1dc4099f9048ef0e46f1e377a626a9f10610b9d19c901bbf751c1edf292deb37

SHA512
98353200a26874cd9c355cfcd014ec120c3da3592b990171f10bcdcdf3e4ea0967097d0d61ed6f692752cf421a4ae8d9f14c7323c7feb0ca6d5c11383abc2db0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
886e293edb94da0f744752f5a033f872

SHA1
810a4dbf10cf1863f5c6feabcd2d0c3c30052296

SHA256
2877c2f6c4b7ec60c63a164ffc0283b2b134e7af2a22ac9252a42ec97d7d001f

SHA512
86e546ed1e175f2d7672881eb5613ebe95c58412b9e995c79169fa9cf6996e2fd519d10f9af677468d8c47a5cd470f39e728e90d0b93e0475afe6a3e53e76455

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
03126fd7579ea3f4c047fb2351bcc0da

SHA1
41732835f9d885b4f3c796541dd7d15370efce64

SHA256
efc10abe5d4d4e89f0d2c98281e0327f49b92e68974dcb8648d97937eab6c606

SHA512
0f8877357fae989b73ccea9486d659812dae1cde9c46573b48895200474dad8530e8f7e319ece064ad1c4836594e51fbb608a6a794c848d655cf0eee029778c7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
980dd3dee8bb2a876ea043966b0795ee

SHA1
5123aee4a4fb1d47e2419988f530940044affebf

SHA256
f890e3f0136a16217dc2273ec86a308d7c1555a18e55d8564885322f86dfc8e8

SHA512
48e4a2278fff740bf0d6aa798c21c9752deda0abd187510d87b9726c22c5383002f1eb60c2916dedbad83846e3dbd89a7c95cedd4178d278bc0145067ccee5af

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670753988092688.txt

Filesize
77KB

MD5
98f38155154dd42e8be726647d613d7b

SHA1
d78eee9c756e89287075acea88a2f15dac8219df

SHA256
82dbbbd4954a9e872e877fab92aaa16f78bdc42dd1c6831bd5582c63ee263ffa

SHA512
446fb374e7ea6325d8b816d865efaa94ed5e77842bf4d735f990b448e9689039ed4de16de14abed3027827d2f1910b47caa2c67875bb1b15fdf9a5d8ebffcce8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754513600213.txt

Filesize
48KB

MD5
8d0cd45051c213e72a813bf0adf9a76e

SHA1
2684de63f493e9322ec28d8bc7479fd62018815f

SHA256
fa7cec1cfaf064cef0379e60383247787c8ccc0151361e18a7d93ce2afb2b3b0

SHA512
f685f374972f907ace0ca2027f3f62eeddc5ffa4f7f5c09d6c1a1b14b1951b05841fa07b662d347eb9259ee9f847d50be83dfe47e4a494f9c41fc5e7e9fde121

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670761155176116.txt

Filesize
63KB

MD5
86a748b6fa66a88835d1e0e1e1687e78

SHA1
7b44588977acb19a2dc515737da80e62ef5759f3

SHA256
77393921aa2834db10003cae189bb45a056e10d454aa78bb4dc98135a05ca9db

SHA512
48298581f64e04c8fdf3a8cfe5843c5a7ff3340e190dfed8b6d87a2ad755a1e654362aa1e82fb75d36b1d527e3100e6c933e93a1ea2cff94c35bd9d2002de4b9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670763712487382.txt

Filesize
74KB

MD5
509a088822a6874b7d5059b07e4727bb

SHA1
a9353c416354e4825f960c802535149316241b8e

SHA256
19d976cb5f1f59e5010b10ad1d3c63befb74e3a2fe69eacaeb75c6b7b1635b64

SHA512
ae4cb3960e975d92376f71bafecf930a333793940a64ab24804ed40bed54b3ebedbdd154463988be651e3d6c5723fa4c83a83ec48e5bb365a77e91990bae028b

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
0f005a3a0154e5dfa96e4494e173f6d3

SHA1
757a4653bfd514132c23b753454f149369143098

SHA256
9cfcd3b139f7b734732c11ab5f73431021aa8f76e147ef10cf10adb9fbf18628

SHA512
7b92c5eb6f856129712dff87ac4cef24d6d37923eb5d20b5015f3e1155ba477be21e65b911786b82d5bff92c9d241c3b2d9453bce138a0a66d4447059f283867

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
2e944285ec323d9f65efb8cab5e7edbd

SHA1
60735f87eb93f0c3771947f9a715bf5e2ac800ea

SHA256
8a0d3c01487bec9e1080ac6e2b7b9239f0164a373eaea1810ccd66ad14b62c94

SHA512
128bce706e583df12fb9cfbdf44d9470c05e25faef9169fd64f3c723bd206298bb5568d86cae5d27aab5282d129ad54a4b75634a60f3687d41314870de1ab243

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
5c3f6ccfe25da62ac17f45c69a1075b3

SHA1
9f277ee2cd3909d2cab6f825f1faef798f52878d

SHA256
7f0f92212bbe3d3337b1a949f30e0004252029279232eec8d4a11673d5c1c352

SHA512
aad64f4d66547a1921f3034d40544fd01c0c64af885d8067ad7c8c8d6fc1fd8347d177edc1109e0ce3e69bb77687e40da528efff9ededeb33ce85030a758ca58

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
99619c422c975201c7cd43a8e0a013d4

SHA1
4fa6e288efd53547787ec29979921ceca5577faa

SHA256
b41d5736473cf79e8824f4b69b829827f3ca0da418d493bdd11b65db18e73148

SHA512
7020e3addf9acf65dc7d154c6dce5b63cbe7f28eaec0cc03f5e7d8e1fc6fd95b530e1858d0ac7b69663df494a0d6ea0dda15d608705ce95d5188753dc55bc9b8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
2a618aee250420e63005e7cbe50cfc17

SHA1
0ef0c84266eb23945141cfe02e54eab358a46c39

SHA256
6ffc5e556c1d0ccc7dbba4dd02d22955942fb5a3391489aa8cb6216d74837bae

SHA512
c6cabb98fd551345cf625bd79d7e2a1e691892b4ef937ab35326e02b4cd9bc7746322faf15409612046cdededa5997b6604565b7ec7a1892b46ebb98dd0d828b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
c7ba9291ae66425a8f6c1090c88b55a3

SHA1
97198d797c17795a88c19ee312af79531e5fbe5a

SHA256
84ac479761f6dbc122d227ec04bdbcf11756377de65a100a0c85ea3f3f960bb6

SHA512
32d89f4f6e13114214604ec39a2f63531180ee6baf4f9431dac1f727a8b6c02e840c536514b8da21e17d64f37ac42f57e71e0388b2306878d2cd5171009ad880

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
fc4be620482159007d894a1c26703836

SHA1
289ea8a8e2e25a0495f0e466801ea96cb7b961c8

SHA256
576f86c79b82a04f8a834047e9159cce012f9d238a4362fea99e9e7bd66b69ae

SHA512
4ecc4c17c0436c81c235f1c9d5b0ae14dabc7aefa0d2a93c2ecefc2dcf32b5faf338519fc69d20d94205acbe1f62d3e1b2731dcfbfe1f1c28e27438ca5dbaf58

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
1f97be4f96d2426e13758bd07083c958

SHA1
9877d575f9ef8dfd9229c0ce91a1748bcd5e819e

SHA256
18fd69915ff0cb31b5501c4d6c494ef18dfdcc77cd5859737287151182225af0

SHA512
1115ce3fe225128f222f115d40e51bfeb7464f9f9f3e316d214f89a18cd99cadbdd271197af5cc7ed097548c683ac3bbe12fc24f0e205bacec8b03e43f9f2b96

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
f382140e505f7bd65de5d5df8e37be1f

SHA1
dd1de6098103fdd248123de7b9fe41cb30e79cb1

SHA256
62d3df20c3bfbc12f1615a1eaae78a615d6cf18344902d4c2b5883e9bed3f0bd

SHA512
dde6ff645c7762804b66acd4247ad2894f6ab2e106bdf668e1233010b12ce1b76c0e18f3352e3ceb4c677bd2d8f7b2505263414fef66c8144fd3224d2f02c6e2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
741472b65d1b1166bd0bf64c9ef2115b

SHA1
725f9ad578d46a43cdb6a8fae2ebc53ac72400ea

SHA256
c370948998a9f55f5015506bc957843534de58a3a7361be5add55b136c19e21e

SHA512
99a4ef81257a6202af543216bada82e741b48ace7dfd493871dc5d41f8a8d3d0236c85eb258c93b04772c8cd7138356da365acea4123514bb002ea8a6e235703

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
52472307e20f6d2da14d9aad21f064de

SHA1
3b7cea3028d93ff53c9cad3b3cb0f147ef3825d3

SHA256
e8e533225fff301b03101053450a1158ef5048750b1e4eb154135b8ff54e4592

SHA512
41fd972201339962c2d689fca93b9b30689077b82c282642107daebb19331529ddd14db62c842809947af100e6d1058bdfdfed02fc7f48e6361593b23c09c499

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
6c700b1b514649be6eaa66bdfcf7406d

SHA1
aa3d09680c77280ebbe146877811558d6b791c4b

SHA256
ef3c66adecc3bb03bc1da1da730b087e23322a7846303197aeb74be406d1cfe7

SHA512
3bd017823fe2c6927b266ec197e63bb31842ffbd1ce386e406d050d065b44dc4d3878ddfeeb8bf6e831a40e05fddd60b4964cfc46f6f41782606bb81dc42ebaa

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
3cb2b6776ab9b5989fada625e04b879d

SHA1
d1cd71517ffc2aa855929951c051b028e492bdeb

SHA256
ac6eca520b9205efa3f0faa14dec35814f91633c0a12c7dcab091e580f3ffd44

SHA512
5eff46667b5c3e3e80d3cf6ebb97fad1cb2a3644ac553658e710ec39e35b698f659269daa0120a21a1400a4a8e1687d7d9d7c2e5ac103fbeeb2b9fb715315ffa

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
27acc2e6cb6d0b011d5af6241fd3bbb7

SHA1
b3d1b0a001b1e57bd7ad1d270ae6dc290675f9b3

SHA256
b5bd44f70e08027d5d3b4c7abf9242977414b62b8ba66f86317ccfb78bf32980

SHA512
d13ba712a7a9c8e02e7ab49116dd2be96b2ba8ff9873a06220d8d605474f1c5419a0f84b4172d9836d6b9670680e9c420c07e9ad8f4eaad30d782b5fadfc5637

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
e20209e8853a021f8ec127d497bdd691

SHA1
8a382179e8ae0c9f9045cea6f0efa1a5af8c84c8

SHA256
224afb30cea15171bf6528f3b8f0572547868c32e9dbc02628b0f4185c6e1644

SHA512
1e72d676efc77f15f6302a35cb17723e644276ce336d714b534337abee5d88d58427656ad4cb8c8c62cb243ac63b2411b4a7fe2207bf4df4f234cc1d4cf6c93f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
f1deb536b6b877ee2f236dfe91febc42

SHA1
0f2da22adc2cae7fcb8aaace1f72caf6cbe1652a

SHA256
1bbfd901eca2750a1b21de021bd40802b04a47f05130b69f957a046609b13ce1

SHA512
3484c5241d8cdd807ba3c971a0dfc7b0d006e3747c02467525e686c8d75d1b7e2bdb08c44e025373e44adfac1ef7f514aa5c7b6ecff5b32dee6726398f337b68

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
05efa571f8209bb3365e8fffebaf8552

SHA1
2248259131e6c6a155be76cc1c02d98a67175cc4

SHA256
2942b94b0ed1663ffa4d83e3833a31a7513e03005cef82437f4449e5390e1698

SHA512
77a87779e66a7add74b93491039df6e7127713b57f5973056edf186b5ec85b36af4cc72ff3b4572d6503cca31a9ffeda6769be8db7109727f66257cde6bc0272

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
90e674f8fb0622765af7662d16977577

SHA1
7a985846c84209f67436f656f81c40f621fd628c

SHA256
0ebba4888c3dd12356d7632dfddf6bc94a04f6d7304b600f9b891c1d07b7fcb9

SHA512
9d64cd99b4fa1d3c774dbb82ca19b803d59f3fadbcf136ecec65f13b220da8938b90bc422481ca3778b1d137cbe3e744b5cfa5c6e1ba037271ec7e7d25ee14fb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
5e8804cc7c1b2dff15a8db923e39a4af

SHA1
fe2080602af1543bf97c75d5050e2f24fee224e8

SHA256
e4049155c0f92ebbc8cd27b9e322ecd58fd3d498bcf4eb7df03a0ab4f3190c3c

SHA512
7007efdc0e1dedd648048a8177bbd60b8d17ba4ce47a4d2586b0bdb9988c662cb8b5c76a46fd6d542402f04e703641978f407c5e5bc76b472f2a6d595d6a4e5d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
40c73a5486413ecbdb9e4c681f6b7b77

SHA1
2950d2822f261a987150065b835a3181959f1820

SHA256
ea71a9f60b1b95a1028b18c36f6b66e8670d12061228659672fc3c74bf9c805b

SHA512
2e55e4be55e9baa68e04cbd2dc3c54bf2ef3194c49e15bb0a259b54ebc9da0d6f882d54ebceaa8723e7e0554a4c3df937876949678546e036c918c72041bb2e4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
9c3198e6af8a8d858d8b103a4bfb57da

SHA1
18cd5a0850b0d5ea7aa311c03acce491cfca8bff

SHA256
e3acb14dc395ea24539af4ee6f1113fc97293610d1469b5d6642edb0f11c4527

SHA512
d1fa34bfe6297b70e35c79742c7583e0349cfbfc07be92e52b8203f85d095fafd41ec1945181d4e23e573cd6e65a9965465eed36f46acebc18de78a5eba4e89c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
54716e0c481842d18b04eb7a37fdb042

SHA1
643440bfc604254c1dc4cb661f47579b11bd8f84

SHA256
69aaa359e7c96677c2807c49fdb06c46240952c50b79a2b5b7afaf320e39742b

SHA512
231307d842bb31ecf7a8dec566364c27c29d61b3632514cc54710e71adb346766246857bb91046bae86c1eed54524f17a74768153b3710fcf35bfa92b4f3d00b

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
2fb408fa4e066829075e6dfb2619464f

SHA1
70c0f86d13275c907454c37bac1299f3034d7bd0

SHA256
18d2e0ca13e6b8d7ba690d203b3cd2fce231301b59388de6da59cf697c331450

SHA512
e95a3ba73a2a432e51364dd4dbac30f568ce8b39022c120012ae7fefb94e0a922a39897c8b7861b8cd5ebcb5274ddfaeb1d18ad9c67b7eed8721b28417388a04

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
24d876b8a9ff73ec6bd474cd837fad02

SHA1
d122ec1d3d09d33c71aa40bf5bff9d7f878505e8

SHA256
8ddc4541ba19d636ae7fb933079a2a2f6b53bd68c3b7c40ac1f034f3c0e8ccd8

SHA512
15e986dd51f1f4d01de7b070c92235d2896785bc21c914dae4a467708bf2844caa70df778cbf58312faf048fe905ebff12a317646bb058f9412d15c110feffa4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
f777280ca0b109635b1b17779a506b56

SHA1
9acfdf2e7662de21c9fecb9ea6f03fdd2c306ca8

SHA256
b081fc2bd3e41eef847d7dfb03208be043b6daae61764291820f6a704be58f69

SHA512
f0cc42ffe7bda909d6bde6510fea2dce7b8dbfb143936ecb971fb62040b03ee9dbc97bd111b2215ed500983fab118d1ff83cac376383e1ea9cbcd9de2a597878

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
22eb8a5db127cb970847619cd59c08a5

SHA1
bd3f21477483724bb46b20b1a367641dce0670a4

SHA256
7df0e79e5fd67158bb576b21ba26451bce73ea8c812ea49a6c073b6c44d7fcdd

SHA512
bf1154e2e7a44e4312ed7b12c4fc434678fdc78ecec63717c50762d6b6c7d4535b79fe08080715015f0743d9f3ee198faecc608cbbf3d6377ab8cad6ab1c3e53

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
1ef284e379fb9f36d9325327cd3a769c

SHA1
47a281c2aa891d84b542e1e45cccb4d2c6edabb9

SHA256
063054499c7d2d62d5c50500b56a1d36393a59233b66524eb8efc4d735d25ed2

SHA512
30a26c17910a456f7d812216827a8f6a70e821c2414ec22e3c13a2e0189e39555f5d6dd6787d5837c38fff5e5e095b210b8bf7da59d0c5e35bc7569a201680f8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
42205f780bde35375096d422ba3a844e

SHA1
48df094b8afc72c2fc36d7bdf55ef273d7e56de4

SHA256
d7df6e885b79c26a1d34bbbf1520c99d4cd6ce15025ea82757a2143996481489

SHA512
5b8d45e33f0ffbe83837ee86b373830b432d6bdb6d08ffa708fa52b2999a0e88b990c8dc1e1484ad65a31a0ce07a32382e1cf8eccc7230e2e743b8429e47bc64

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
c0bb8d4770e6082977e7e44889347992

SHA1
15a7f13db5a3b75e7784d19fd3a35ab5507f46ae

SHA256
cf0edc274ed35b0d6b3a812e9bc58175a095d8b6576673eed6ca85317753bde9

SHA512
d38ec43dbbadbd749c1e605b2f40b6d461d4f921c3ddabe5843f04ca5872f8c6d19bd107781e168e4da8b940d4079316eef08821d713530e0e2f60c7ce8cc30e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
8d4a336e7fa3ff67ec8543c86d98b5db

SHA1
a75db807709a67358185e75fbf8eddbe4b95ea73

SHA256
c576ce3c514b41e3699184029a79a4259ae7b33fa9ec8ebf62362ffd144b1696

SHA512
16f8d523018347fd584e166960b53c5650e87578b191c0799e4183e9b904f65de91689b80692bad889571207707676207d5abdab558cdd582af534afa7033462

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
83b093f98e23d3b9f20cf7b8f73b5e3c

SHA1
f36cb73117fedad7408cc05807523fc403cc2298

SHA256
cd9edcd267339e5b309b380cca94610d90acebceceeb1300cd5b5da85c04bc0c

SHA512
4f0587ebea25bcdfb71f9fd0061501b87c369cebed18e46d008002df3e1f032c079cea77c13315dc71dbf6c68a88d6a3098d39554ae739545c0c7377214fda72

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
344b13596ddb0b744664fb9122a7df72

SHA1
f3d3733981667a68cbca17f43e3d2ac67606fd13

SHA256
5d89060e976e8adce138f7585f49d2291e6034ef5be596e2bd1f78b01681e582

SHA512
235cda949fecfd56ca2403a387c78a769261eebf2c40756b58b7013abe90db52f7f4bf305226d0d3ab8013dc150b0e0c34c8dec54034a6ab5e04edeb1e55311a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
c4615bdff14d092f26dc0442458a7152

SHA1
7d0257bce1d9c1496a35584e9f6c3c1f04fbc021

SHA256
f8d3c559fe05db125b6164749a9e8d3825d9c6df6f07367a4b6bd095432a16e8

SHA512
a9a2665ac630151e3df9867450ac2fd52a6f566e5c18dbcf8f0e9459b2ac1e1447623639b9a0e3a6b24ba17762443a0be9a423a84f86ee879f9f2ba0186c2f20

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
37aa3d469dba9c88f7e5e0c19412c585

SHA1
e7e3993fb7c4b2bf901ab001bba3558623d88278

SHA256
a30930b940a1ce721867f0a3a44b03b2e0d6e35a38b6222b80c75f6342344fe6

SHA512
1f36c10bace94680af19996473752ebfcc22dccb80d0679a498c593104f484d8d16f2085a8021d27dcbc3468a67aec4b50aec00376de781f9231ed83e80a44ba

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
557518af52a8006bb81992320a7d9268

SHA1
49f5b6b9ae2227b296df697d955f3cada2bd9888

SHA256
39e33c48afc01475e13d8653e471baeba7d9e5e04552821cb0593fabaad08cc2

SHA512
c95f473b6bad3e2f58fe9ead427dd57e964624582433b637b1247bd3220b97ac8ced5564c069599fe3c2818ad32723eaf9d9f6da2e5ad6b57e07ae900f79558f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
a31bdcb59a32cf7b74227d90fdedbffc

SHA1
15a145f1eda4e687445e179f5fdecbc4046358c5

SHA256
f571ff2e8690511a90ee493818a34a50cd04357388f7595bba1e0390398a97c4

SHA512
b15837b52ef3db959847911bad1c08e96b1dcd75b76dbdafdbaa63f1db29b84645ccaf8a53cbdf437f466a257c780489293f7300425437525cbc64ab8eed3d57

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
985322ae43d64d3a9e339760f1f145e4

SHA1
674e03fecea9e5c75b9d5b51c789ea2c22e66292

SHA256
c6d33acf0ffa5767e49c2d3af081485e2920df94c1ece30b24edbfd0564b46ab

SHA512
a9519fdd29d5def6ade2633f11dc14730f6d5858ce16972d992f8fa453215d30e97b3b35be108366458d02059c282e4d9ceb0ec2316b056f34e6944e22e92524

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
915d0418c001131a55a43d0ed1feba4f

SHA1
09121c5675c0ebe43c02f139ca6a3aa1d6e31bd3

SHA256
e57f78eba5bdb44770ed3ed64dc4b9f09302db3d9045ae956607d4658bc88d90

SHA512
3152957b8c3f50c0adef39b9c5994eb0904995795683abb8d562a77e1103e9dff92ad70dd49de875c52665d870a6af171ba9c409cecd69e317e939a6d0cdd983

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
4c49f654476bef3d2061090088004237

SHA1
8fd8a98d7383a81cea02379dca32589a6fe2e533

SHA256
4c724aac87e6bbaa57003f707581cd9f44014b91a104a7b6aaad470bfb6061ef

SHA512
339c2457bd4253ef1d1931dfb0b4b2279fb57edbe062861134b191ac4d43d3e64ab5a89db5b5f564a4ee7627d87202c26274df6433628d3072575b2c76215950

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
d33b1a11f87c081594583c741cf49b90

SHA1
56260503418678cc4e25b17932a76686c3f9725c

SHA256
a96c44a066b6fa6a99e489ce43ef0c64408df97332ba28e48f470bd15e3cd1f1

SHA512
e60651f31d96a6caea74f88ffde3882a03805f2385f29c83c6a3839ad2a1efbf87c07af250df41184cfbecea8f42d9dd7ae096130f41597a201bb5d9fb810e56

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
34b20334cc5cbbda43f35083d3d136fc

SHA1
4ce4da122cb146b3b7aa6bd9856cae1953922f22

SHA256
af16fdd174e03d99d6187530c8603c30e0226862d828a8bd9586cb9fd223ebd3

SHA512
c219f7ed5117742fe7187251684a4faf6ac4b01586fb2340d70aacf2b2cbf7c0a14fd2d699a0e2cac3e9886950117fdc83d020dee4e2ab01d9302c0aa6ebb43d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
6f3c33d5c019008890865dce4c0f43b9

SHA1
894f49682cacac2db2b3bc1c5128e3911f5a66d1

SHA256
ad93c9f1e10076365aa49cfdb329f62d95e646995c013384fe2a3d8d6076d094

SHA512
2cf21169c620df7d1c0d8cf761bea2d90eb4cbae0fb10e35808809ea7b6076257637d565b7e983de7a2f39c90030b3b617768ece408e77603ec7c274c3221cdd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
bc40c3f32262fc8d1ed3b77d218bdf06

SHA1
323fb2bc93f5e8a2c9c7f765db6153108fce4499

SHA256
30a295dec249671c5e41231778165e2391dde637e853ab13cd815311fba0b530

SHA512
587215b9b3ef324dfa7dde2953812599771ce0539e59aa8ecd4da07b3ec56069f808fb5deb2b7ee7f00ad53263d11112b808b8ed01f19c57e24f05bf3ec50d95

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
1178f5734272663ed3fa2e6f28912148

SHA1
968830449bc857ed043c7361d364de74956bb913

SHA256
21a1b0f03702749c165c4fc594c698b3e8fd67863ad433da4e309dc738a4bc56

SHA512
5c11b20ddf7b139b105aa6d2cdc0c8d9a086e7ae14755e6856e640eeb6a3d1491ed1f62ea2ad867c9ba639311b920c29fba189e54eb6bfb1d56d5e7bd1fa4dc6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
8840653d1abd6af11407dae4ed205caa

SHA1
51412a0e49f93b191fa9a97f38fb9b80a2c50a22

SHA256
174f5da8ef543827752813862e6969f74f17bd75bb4d58f1eb94d21d47f0d884

SHA512
c9c22ce4f9ba92375b3f156ab45e80c9213792db1354b925275c0a8dfae69496ded6c897a8e317ca94f970be64c77e0f79ebf9b5cb8c6d69d58aa4841c0797eb

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
da74589ee5428aa5e78b2607700c2f44

SHA1
03cb8dfd736c5cbf18f68b61709c8d52674fc6b3

SHA256
de1fd0b0bebf2660a89c6381a6aaa1f7fab84282ad45b0445b8390711fa2a838

SHA512
785a51226175824db79bf5149e7af794398ad59ef5a9f1f01ac628d2056ac6010516db3a125a90a56d7af769b5e941f9598046a12f975fba2cf153487cf1211a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
7f336606b461b676f776792449e84459

SHA1
d7ee9ab4a04b68ff46d9bc85c2105b7f8cc40a01

SHA256
ad13efba067a92ab6bb53f09c85152a9a2cae755bec2ff1e242ec6506ceb1529

SHA512
77386d982314ed26411996d8aff0f1718479ec798c389f75117e25e55ce4a6648683152126d51ab1e4e79940998db87bbcedc1e0b7d5986046662f04efa4703d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
87ced09a182fc96acba42176a0abd2b1

SHA1
96cae29e9f8a492df719534e8242b2897cca2a97

SHA256
1637dbf7d6f39efa467401b068255cf52ba8d892e0a9f62245eb2e0a512e195d

SHA512
3c49b2cbe4f0d36b1bad0dd55fde2d53089801f4a158431b6c74225fdc4b18c5fd7044d70f0aef26b854b8440cafe42207dc57f5bac9830317294a6c913fbe41

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
37d24009d59cd391e37a362b98f235e7

SHA1
6f9845cd8877f6270b7c7333568d8b0a2c1728cd

SHA256
10a3d56d68e2fb1a407ea80b1a9efc3280f1ceb97cd3fe8a538a67eb127f066d

SHA512
7532400fa04e1c4b511fa9b5f8748566c7e5f0360a4bd847798044906164d567da61537b2f45ebb6a9cef408b2ac6e8dc9188c6ddf4102bc432d1a244e0918d0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
a727cd4c425dc64b0d781ba84d73bd00

SHA1
f132383aa6edaf12afcf69381bebb5be259e99e9

SHA256
78cfe8a4a15b031c5153e7f0c87a0c2f8b17c3fe3727e889dc43036e3fdcf7c4

SHA512
79e602f6c6469fdc9f353dd813c483c20fb3828b4584dc414d1bd7fd6994e83b5b50f38dd082da81f5465da136c7f9e8f532dbd039a423464a571d2784c41d72

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
3bf6ffeca0b325889b8c7f27d62ddea5

SHA1
af5528a5a44901601e9cf1d31a36e07038526ef4

SHA256
3e92271be07dc8d9162b27b1c8f02ca2d942611cc919aa4df99be21e29c08ca8

SHA512
fc2e01520725500d7e5388bc39336e2d3376e21bec90d839af6108c7b190151035d111c4d1d9d2a35099ef67d63056a673bcb504fc12fa66356463552da4a5de

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
a7b5fad28c995409aae78ed8a94cb566

SHA1
403f7a2ef7a186ffafbdc2b59101e79614c8fa6d

SHA256
d6fc54fb1118e20075c407b075ac512fdfc022bf5613825b57ced02c79cd6300

SHA512
6072a570734ac49021b7c2f1ff6728d1d97da5c588b97cb94a7c1833e30f405ff2564524effb4ff3f427fdcf43c0ab671220ab97acf01aa119ebef4254dbea2f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
0a1f98ad5fd65675180bf653a05f5995

SHA1
1871f73bb54689edd18bedcfb01af83d1cc69614

SHA256
167899468ebfbc8adcfee34d2a7b9d326947301d854e8d68e6e8349cd559200a

SHA512
011e689799d2c516696360d95f7666357ef032d80c1857310da2493603c8dbd3c11bff16db355076d63f6f8c1f17d19dd23af80cd709257057ec4c57a33eddf1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
d83f3cf9572eedbdc48c204f5b001fca

SHA1
edf596cbc39972b58a546d204b6971106b11e183

SHA256
598ae5432221503cc7de3cca3a5527d671b2e6a17e1a2c0f77d3a542b958caef

SHA512
cebeb5e9ab3c612b83b33e1c3c2933247490640b81f4bc24861c9301ce6633777e6b40add3ab5b2a9bad137b2be7a9178c886c0771decce67fa67c03409c1089

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
bc62665788451e60d0259c27cf573756

SHA1
54eb0abaadfee3d822eb2905a8263cfdfa877b34

SHA256
7687e058b08eb21f76049edceff01cf4ccd4bfa9ebf07e0028bafcc172c13fe9

SHA512
42df44678314860fa7fc70ebacd891c20322f58ca55948c4390ce6438e2d5ffae4c6f29928f1be3893947e0251cca27ccb019280c3a1b0236e9118092a7c838e

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
481dbd343e030f2b4fbe29b874f050ce

SHA1
3725dffde2be73df43f838951ebca075e4fa931e

SHA256
4666c0248e1fc9296baa96cc44a90966e434f9ac10e71f0263bdd8068effc7cb

SHA512
410aa1056913cee705c4e42d0d4d9e84af5ca54e7795471d89fafaf037b3559a4d1feb4a89e3777e4dbfad1771b7f8ad304970f7d08f7ca94a2883689ca395b0

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
5d9f4f8aad2bd837dd97f4d61f135bd4

SHA1
41c9df684980c9205b92ff0f3e79562f59efea27

SHA256
13f851ef50facd9e657f38bd3d82c811638cb9423dde0c6ef73c230a3ba99ae3

SHA512
8a53a65464e3938815085b19e9957e7a028bc5864a6f9cca9a61306231068e79685c4e253333645160429f0ad17aed7fca98e8f87d6841e19cae9380c99550da

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
afbfed04cb7bd7fb4a5bf51fc19e4f86

SHA1
eaaf7732c207bd869d5b445e3ced58eeae410c75

SHA256
38c1b4ffe800df09bda3a41c3d47649b8c229e0b485dd004ca7fbddca69ba667

SHA512
ac81c2d4df470922f9e1fdfce36e15691e81dd1501d697c6e06eef60bbc569fe4072f50ab334ae16602c5553ed93010a30048c17de7dfb83b9ad851f2edf94b5

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
e5cf8ae8a1ecf403d0dff4639eed2629

SHA1
4a419fbc15c1b45a6726d2ad665ce81b720d5c1e

SHA256
03bd331d198894416194ba0249da03742396c17a1f07af7658c327333629f472

SHA512
3a6f49c7806c78ad3c0352fcab2b4908e061c8ea0d255d6303668e6adf264860fdd8e6ac0e359687686563208f58f6f44f99fb748713e156f37d5c7efc53a221

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads