791b70d61cdf6dcf6aa7d75ec054901e9716f6d8630fd2d33ddd4e5451f7d2d2

Analysis

max time kernel
95s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
Size

121KB
MD5

15f31492c2df4c04f17ad378fff9346d
SHA1

6d9b75e380c2cd1d7341bae4a5235ac39d228866
SHA256

791b70d61cdf6dcf6aa7d75ec054901e9716f6d8630fd2d33ddd4e5451f7d2d2
SHA512

302189d85d79d48f563ffd232a4bc4d9af7b52d124d6f65428e4976e2429c1e64a1536a0cc0e39b6dca3dec23b2abe06a66c679ab6ad19ca505ee80977250faf
SSDEEP

1536:8Ohop8jDYhC+QLOJh/hh3hPhGhxlqJZ1h+yOuOlXc5FbCpKYykhlSt8cuWDUaUM7:VH/YhQLO3dpY/7St8c9PwFnq

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2179) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jrXn698rs6w221R.exe"	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\AdvancedInstallers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmarn.inf_amd64_947cdd3822225c16\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\xboxgipsynthetic.inf_amd64_9aa94bcf077169a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsvirtualization.inf_amd64_078671a0cdfe2870\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\hr-HR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MSDRM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidvhf.inf_amd64_0a924aec7600dcde\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\setup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\gameport.inf_amd64_edfd5301fe3972d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl002.inf_amd64_9076ffc34f080cc1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmomrn3.inf_amd64_c2314613ba3f3585\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\megasr.inf_amd64_72258921635be994\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrm\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfcvsc.inf_amd64_dfe08f401a2eedbc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetNat\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\GroupSet\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bda.inf_amd64_d32fe6b1c2b7b2a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_mcx.inf_amd64_fcbcc3807cbf63ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ipmidrv.inf_amd64_ddb154dfd1a1c33d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DriverStore\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_hfp_hf.inf_amd64_0c00f8f3a465c9a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppLocker\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppBackgroundTask\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\image.inf_amd64_d2006c0517ddc60c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_magneticstripereader.inf_amd64_86e291110e37418b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_mtd.inf_amd64_2f8cc39571965376\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Common\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthoob.inf_amd64_c6923052f60677d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0416\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Common\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdcameradriver.inf_amd64_43b67cb2258aaa60\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vsmraid.inf_amd64_3d2bbc45931b8232\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nacfkmpbbbeegjll.bmp"	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-24.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\word_art\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-400_contrast-black.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-150.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-200.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-150.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ar-SA\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-20.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-125.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-100_contrast-white.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-125_contrast-white.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Thickness.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle_2x.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-125_contrast-black.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\gl-ES\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1113_20x20x32.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-20_altform-colorize.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLogo.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us_2x.gif	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SplashScreen.scale-125.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-100.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-100_contrast-black.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-200.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-black_scale-200.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-100_contrast-black.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_altform-unplated_contrast-black.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-125_contrast-white.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-125_contrast-white.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-100_contrast-black.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\HelpThumbnail.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-unplated.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\PREVIEW.GIF	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_altform-unplated_contrast-white.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxWideTile.scale-400.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\30.jpg	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlConeHover.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-54_altform-unplated.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\microsoft-logo-color.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-250.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo_2x.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\55.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-30.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-32_altform-unplated_contrast-white.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-72_altform-unplated.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ko-KR\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_altform-unplated_contrast-black_devicefamily-colorfulunplated.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\MedTile.scale-100.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-400_contrast-white.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\stepOut.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.19041.488_none_3adbc9ee201aa4b1\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-h..p-provsvc.resources_31bf3856ad364e35_10.0.19041.1_it-it_b61589958367a2f5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..geservice.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_54a73aad2cc2f922\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..trolpoint.resources_31bf3856ad364e35_10.0.19041.1_de-de_65621a8079a7e44b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics.resources\v4.0_4.0.0.0_es_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation.resources\v4.0_4.0.0.0_de_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-profapi-onecore_31bf3856ad364e35_10.0.19041.844_none_ee6879440a206942\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..stedsignal-credprov_31bf3856ad364e35_10.0.19041.746_none_b6b12c5c6ded6b80\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hidscanner.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_1d66074e17d6cca4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\unifiedEnrollment.html	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_eventviewer.resources_31bf3856ad364e35_10.0.19041.1_en-us_23fed3709cd0dc08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_nb-no_3420e1dc94cd020c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ui-resourceswin8rtm_31bf3856ad364e35_10.0.19041.1_none_40a3e631822403fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-onecoreuap-wlansvc_31bf3856ad364e35_10.0.19041.153_none_20cb28a4512c2591\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userdeviceregistration_31bf3856ad364e35_10.0.19041.264_none_f73adcc603736cb6\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\overflow.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..onmanager.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c1532390997a1957\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\INF\usbhub\0407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-security-vault-cds_31bf3856ad364e35_10.0.19041.1_none_ad5745a3daf6345d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_6c7d1e21f203fb8f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..epassword.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5996a1100d25e4d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.19041.746_none_afaafac6b02c16fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-setup-cleanup_31bf3856ad364e35_10.0.19041.1_none_19dbd572fb07e566\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.scale-400_contrast-white.png	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-partitionmanager_31bf3856ad364e35_10.0.19041.1110_none_56683e3b6f9cb252\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_windows-applicationmodel_31bf3856ad364e35_10.0.19041.746_none_0a53970e320b5e16\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-editions-professional_31bf3856ad364e35_10.0.19041.1288_none_51444fcfcf940a66\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sfc_31bf3856ad364e35_10.0.19041.546_none_852f0a4cbb00efef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wwan-lpa-api_31bf3856ad364e35_10.0.19041.746_none_cd2ef0562669818a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-m..sor-library-unicode_31bf3856ad364e35_10.0.19041.1_none_caa4fa48759c3a7f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-w..omponents.resources_31bf3856ad364e35_10.0.19041.1_it-it_3b81c814fb670787\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\repost.htm	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..trolpanel.resources_31bf3856ad364e35_10.0.19041.1_de-de_deb2d57cbdfd70c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.1_none_913591207b2aaf6f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.Resources\2.0.0.0_de_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..-wmpshell.resources_31bf3856ad364e35_10.0.19041.1_es-es_89e3d34e1eb1ce97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-u..access-unifiedstore_31bf3856ad364e35_10.0.19041.1_none_c11f95d4b927bb6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ntosext_31bf3856ad364e35_10.0.19041.1_none_89e4438cceba3f44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx4-legacy_web_hightrust_config_b03f5f7f11d50a3a_4.0.15805.0_none_49a4a0799311c22b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\zdingbat.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..-input-spatialstore_31bf3856ad364e35_10.0.19041.1_none_b70c43556368ddb2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-browseui_31bf3856ad364e35_10.0.19041.1_none_e6d3ef3685b35397\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..rprovider.resources_31bf3856ad364e35_10.0.19041.1_de-de_1421bb71934b48b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wwanui.resources_31bf3856ad364e35_10.0.19041.1_en-us_c5ccdb2349e6753d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-00000440_31bf3856ad364e35_10.0.19041.1_none_a715f9d3383f63fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-network-security_31bf3856ad364e35_10.0.19041.964_none_b55ac867bdccde4b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\PolicyDefinitions\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-winrt.resources_31bf3856ad364e35_10.0.19041.1_it-it_1b937a88a39d605a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..iders-setupplatform_31bf3856ad364e35_10.0.19041.746_none_2089b26321d4d0d7\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_10.0.19041.746_none_4043fbc711b93407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mmsys_31bf3856ad364e35_10.0.19041.746_none_46bdbf5f725b238d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..talcontrolssettings_31bf3856ad364e35_10.0.19041.264_none_d1ce115a6e50bd32\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..unddriver.resources_31bf3856ad364e35_10.0.19041.1_es-es_23c5b5b431859db1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wcf-m_svc_mod_svc_perf_vrg_31bf3856ad364e35_10.0.19041.1_none_326fa1cc2ade733d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..mon-printexperience_31bf3856ad364e35_10.0.19041.746_none_7f8ee0379cb19113\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..demanager.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_f3a7142773f29e16\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..xecutable.resources_31bf3856ad364e35_10.0.19041.1_it-it_3b3cb7dc698457f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ingshandlers-region_31bf3856ad364e35_10.0.19041.1_none_59441819f0010809\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_80b60da4869a7274\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jrXn698rs6w221R.exe,0"	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\shell	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.1212	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.1212\ = "ELMSMSPLZYRAYWP"	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\DefaultIcon	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\shell\open\command	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\shell\open	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jrXn698rs6w221R.exe"	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\ = "CRYPTED!"	15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15f31492c2df4c04f17ad378fff9346d_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
588068e83ec515a783ad5e2fca1365e1

SHA1
d0ca0b62d814b7918bbbb440e326d0577bd3fcbf

SHA256
684f8e5cb56db933203fa4d8760ff54d40021556e3c2be99c9233a61b85e6287

SHA512
c94afacbf6fe0991c35c21f80c34fab86a81bf402ea1386b034614391ddf8beb4c1c934afe23893ad05310a61dd8aadf4ffb504a139310ba6712515609253ab2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
6565469118f94d3aaae7d6f39c5ccdce

SHA1
92e2aad5d7e0b2c86df2f3b8696ea792cc9b3170

SHA256
88c4411390f3506d90dfb781c0c0d6816f36ddd2a29b140d7baedf9f42a8d2bb

SHA512
767d3d98d10804a4578a86febc24e6f6a1fee58570ed94b716e1f083a0e676392bd66d4a80c7cdfe3a2eb75dad43f7c5d17535b4648c8f046fb5ecf146661215

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
93b9d1f052788336310c6b8e916ce907

SHA1
dc35fdf87ff3b351408d7e963623e4622d6f9d42

SHA256
4fd1256508ad32181320dfa9e9eea05830855d5be2cf607303e9b11124314e00

SHA512
e5f0cfcfeb1e27fe2ddbbe579d63a8c5823bf0b533ce25cfd616063afee3c10607455b987ef16a3f96ae4292c150941ad1388229b13010b1bc07f77b842a9299

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
14b3071827269d5ac4dc7ef820057edb

SHA1
a5e0ced52515fe1985379a82b1f3225afd6d21fc

SHA256
1a86722aa67bfac358aadbdbe000e3e8d2b0e628ac30ad2c60c56aea12489bac

SHA512
a6d8ee747077aa55735a1b5b6f6bc9ce26f532f36dda14aa602bfd653d53ccfcd232386475ff822b707e8c53d2c24f79219a74c66035ef5171907ef6d94a0561

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
82d3eee692f02fbf8a62ee85af1eb46e

SHA1
1ec36a5a959fcd672f7893400df1fa84e8474df7

SHA256
265eadf741c077b9559ae4198544c2ba8dd2450651b197930c39c308a285c9bc

SHA512
67acf91a3a54d3255069551fcc626b5764ada0e8e7ce0b40fd44742a3bfc20c9782c87b6e2d4c43253ef424f9242545ebf8400c8581e5e087f45e691f2a39940

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
d02b4e7fd4359e551e2ef1264d5a606a

SHA1
e38fcc0e73dd9aa9a6dd653ee0f892b41a5d047a

SHA256
9cf4d4f297b21b55d026aa91e7dd3936ceea091fd232eb992d11180af8cc9382

SHA512
20a2292d72aa64f09898cc71cb3b19c36bf25674daad6347c6b6e74a7a01c916f62cd1431ee2404fc63129dfd0f51fc93b41dbb90e5f17e2432ede66f473b699

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
6bd1e40728d99816cb50982eb7c66632

SHA1
43499efb0fa1f0a077612bfa3a4ab1bd92b0cfe3

SHA256
5b45defe6be150661c6dc7c1e0701ba64a9968e97c0da83eeb05b2e6ebf1c1e2

SHA512
6a04e6743b1d0175608201a14002648f3e6c1bbf2e272623fc9d12b709c120f9d825035b965546bda63f23353835fb76eed2fc7159d4a13f725e153bb875017a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
e82895885a535cf527f05fcf83399931

SHA1
3bc9a61c4577018a9053c5671fd65679f0addb93

SHA256
5ca952221dbe20955fc811a661fcf3aff5c087bff7c809b50ce472b14fbd506a

SHA512
3a52d4261ba97d62c06dbc6694e7a837637dae41453a4b5b4176ca18c953e6a84d29d7568cc2de2f115bd9e96c4e12d3c861f8318aa792a1aac0f8222b1f43bd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
06da21cb135d744af5947831bc45734a

SHA1
097e49104da61a823b2559cbb20afade273c9daf

SHA256
f303370cd1b22c492a13a6d94ae8e9a34f7f66026e1e8d8f0429fe3134506a6d

SHA512
23ca3a0e8f6950c64deeae1c6d87e5fcbc5f0b84a2b4771530f5fb46f6405bbff62b7e72329659b1980a3c3bd9befcdf9a81a21cab209d6416d106050db4c67b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
5366b5661d06028ed11ff552e7cf0d10

SHA1
e7bbc8a8b9d92c2e4bbf5cca01956a751f6e40d4

SHA256
29ece5bfdcd271ecf010b71635223e9c400de80ef42e9a55d98386b024242f58

SHA512
25bfef5c414d0cfc864e0cc6fa153210cf5091d3f3d61a2f476bed6074bfc18c63a8031ed9b8eaf14eaed254e531d30af504eebc6aec573e769826b5fbb37fc6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
2806646b354c3b6389890d2b62005a2e

SHA1
415f2d2d0aff0d0b2fd1df487bddba435e92c899

SHA256
eaf9a197f9a67ee6bbd69a6e82edd6127e291916ad93f20875b330367e1522d3

SHA512
57aba1a8a5549a6e42e21a5e3a8e217bfc0268548d067fafee56a881ca97c6ced0be09bebce354037210126d6a25c97c12866c5366363f7f8d315d17b0e5ad3f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
d07f1f773c7239a37e6989f47a35a4b8

SHA1
7db1cdd042308fbff50b5adc615823e61bd298fc

SHA256
894d3481062ea2b05ced3927b80dbe9e3876a095b59f8bf7f2736b1e716c25ff

SHA512
f87c1becd3c400a8344c913c0bd07d22a11c29867e652738c6dcd8c0c0aea633178eb65892ed17b69e92ef779532664b645884532b27b6f313cd37cd8173ca8a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
7b09d0efde2fa1e4d1c03a4ca47fcfa0

SHA1
a48dc4b37cbeb22d739ac896f5acf9ad7e786583

SHA256
691fa4141f7c945d7ebbfcbf6fdc32e116d098702606ed45d9f0449901c5393d

SHA512
3aad2f447de8723fb3c7d8d0860a952d014b80e5cdd925dea04b7cac08580c770754be7614d02ef98d1a5e9f6dbc3f3b20349e3e0fb51c07c92237481049e65b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
4b266f77b905b285a556bb400e293197

SHA1
4ac1057ff26d59e111ed730a50355621490f95d8

SHA256
644839e36dee4640ed33a537839b2bcf982777259e5cfb3a839a17d148feb8fc

SHA512
1ecee53d70d545ccccf5b1b5b849dca257c98f72c871c748e40675f3dd331cdd5c5ccb3b66fcf7453e3304cabccb67c7cd0aabeb04dc0783be17c301b59d3012

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
f110acd3eae34dc4403ea6deafc7cd38

SHA1
733c44b4e7b4700e7dc9b51865a243ed0c6c6c82

SHA256
8dcdb65986c4d82b4d4600171b6b781999fb21883156b11cbbd4f72e168c4f7d

SHA512
ccc9b297484f3ef52fc19b009c470e59629db5c1f629a949e64c63f0550ef54aade57ccec14989a59ca5ea7ba4ec3a90539052c68be8c9fb16e4e7e1dcfeacdf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
89a33753e17e4d04d2de2acfc3a2a358

SHA1
91af23de8e4f719eed5e1b284ae4b97fa8c4acd4

SHA256
1eace4782d25834c8caf9a52320943deb812fea591bcf0933002ded18c88b8e1

SHA512
9871dc63c189ba3b2379372e8834dd97993b50b257e00675fefb7cb9966a4a05105c05c2e9703b89bb9e101b5fa571d65108a3cdb03c4f032878db4e819e4442

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
d812a8b021cdfe65713ad56b269e9ba4

SHA1
4325177942940eaf7b424f4ce5fa042007c1461d

SHA256
1c02faff4533471c3f097aebf9597f7428518b39278c5a2849ba0cedb44afb4e

SHA512
d0551a834289f550947e36ff18b723de2bf5a944c8da2b68668f1a9bb41fc288e2f5fd373fb3a9b565072af666aad7f1c97f05b95afc66354aace9ad33a000f5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
99a587914f86ab5c7efcd1f5d58d4f3e

SHA1
f9e79e9f7bbe24596140254e67adf5e8aa169178

SHA256
9994ec21c43bde31d20ba2743ceeeb959b285062c538563f01b51de690252265

SHA512
246741a96b9efc995ce021b43c99393f4945887860f68dffc5e1a52eba045571127afa734e223f635793a9bd645b4455cc1f92705dde96e765a8a30d65696bce

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
dcc79a6d1967c1b2e26f1d8f1d9ea130

SHA1
23fb39e703c9ba836b83b63df5ea51e134b43b7f

SHA256
5356dc0b950f41e7abc83768ce730d860c90fbbf48ae258728f3c0597afdbe32

SHA512
95821d75253ee7f9eff541b799cb0683e71cce30f194aaf720be258d6eff25ed52aa9d2e200e374272db02558433e0d14a5fe5aadad5e59f0a873ce17c46edc0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
bfe6de96a963108c1805aef26a300b2f

SHA1
bdde4602dbee813f4ad59858a1bea487ba29d226

SHA256
159e03fb8222914a171ffda19502d5d8d87b51c3e396cd19c5dca5fb393a9020

SHA512
7ba6ddaa4338c01fb95d4846287f2741f9200f3e0e7350e14f3ba8f3e152490636296824fc721bf2214d80b41f212bf7977cd572343762378c24316db823e981

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
0dd8467960b859acd3d4eb371dccd134

SHA1
e4e655bfd1a0cad6a0a3ce9ff68bba06d806b79c

SHA256
8972673627aa9aa6095f0f0a7441d8cebef2962eb8022554a49b0bf6b1b88bcf

SHA512
07efb809740541f641aac96f49e78b1ca61f591bd8a21e89111723f033150ff28e5057df4a075b2c29bb1a7a0e42e60b3b078bce8297547363466a4507531dd6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
1c5db16fa2e2020659672c09672547cf

SHA1
70bc6d976007b5af7a318bfa79c62bc3dd4a376b

SHA256
e71428018cda38d5efbd915ce65deb540f97400fcf4443e69e7fa3eec3bee3d4

SHA512
9768f145b69dda56c5cafc72c256a97a980534ca97313bb6ea801fe50b2a2d17909c9f8b47fa907fa8eca2ecc889af2fb7aede9f24dcb16c52e3e4d7e51ce66c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
3762d0d941cc3af2c68c0735dde29c74

SHA1
8dc148b3bb1946d01fe9fc50f68eabcb4dc466ca

SHA256
c7009ce6e2f092345b7bfc8a65ee4c3c3e8fce4177ae0c1f0ea3fb57cb56e43c

SHA512
d0f5d20ef42bcd315558ddf711f04fbd7aadefed6de44627b28b06a465696557ad03b7c8ef01338855b2917d4ff2dbae742e81df104a713ebeb723b617927b8b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
12b68c8d9e14e1660569951da69467e7

SHA1
acd97f6774643f665a717b453bf4c8dfe6e638ba

SHA256
cca7bb933d2e11f01db6df54cf554456b577b0f1b2d10eaac3110e4a0c9bde70

SHA512
d777977ab92e5ad81170cdd06b571af0f50ef59e0efafb101aef64ecac39d8e8ada89f62eb32f32060ccd205ea8821861127fbbcc2b3adf155eaafefeeffe73a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
020abb79fad28ef6e3753b23dd7e0bb1

SHA1
14324e0ce54f542fb35e04c1565c2c63d0e900ed

SHA256
b7ef80a9a604626a866ce24971c83df95c1878d2e4ec6ef0b0c25f31ad348181

SHA512
f26c97f3c668053121e577131d29d183d58d940ae917e48e7ecaba112b9fa6a99b1ea0d2d2e95306f7dcee3e1fbc34575d9e34a2b712a367d438e16fb0016bf5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
df0c3dedca842b8314f3b930a2c8e9cc

SHA1
d028abd45d323b3484cf0f54459c5a0c9a13955a

SHA256
347523e54b079fdd827664cb18bcab74dbaee97e887dec41741b02067ee1d45f

SHA512
5bdd36b9f88f8691130e96443f56eec5253ba1d639f690e65e27882c39c4c153edf6b6a4c310f7b1afc624f41af75477bd168e6e25240d64526f45995953c45b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
408e628bd15570ad235b26ce5814b94e

SHA1
1949c5f93480d02dee6ee93a6a229203b509b1b7

SHA256
606e2fe43478687078c0750deb97100f190b12c9c41fa95022ab3af1c877d653

SHA512
4e95d9e6526e08a73aa956d9f7f30c1ce42ae05796a31239c648280d2797178222e4c4bb0b28be242340ed280cf8f2227cb35766b2a159444b54633cb58b355f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
c149d529f43d6e2aa63906948d4b874a

SHA1
4d8d02228ec69574566bf434bd63173924b8567b

SHA256
ec10a4fd90dfe20dd005f237247b114589eb92873f814819ca043c170b8816ed

SHA512
851e5e9dc926cdac82620e195c7db52373ad72aea2b86e5fd929897c46d30bd041f07a384277131a967372f8e994a431ded2b4b6610dcb323ed4efeca77afae2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
9f03e71f2a2ef38a1422ed5b090c2196

SHA1
674125cd191284b33e34dcc1ec8d7c59d4284b6c

SHA256
424a5e481b1623f416630f706ba8f50e95e85f0ed9368b7fa217b70fdb3bc563

SHA512
e5afebf543e0bd65f8e400f792a2896f18b434fbf9022f58d06aa4a55d386db57af0b9aeabcade7c0823d87665e5dcc79d52c5a0e7a277e06d3a91e30ebfd388

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
d022997476489bad669be03098fe86a7

SHA1
a4f2a4671b19013536fb3609a5c8936ba5308f7b

SHA256
56d01dae8261cc30a55dd0f4828ba5ebebfbbf6dd7e44b0bde57732da0294373

SHA512
229c7f527fe7051fbdc961b404e7a6b25026ee7ea73de9a0aac2444f0ada7e013b1e787f4b81e7fac266f0bba3af0825cefff241650ba9f00e39ec257768e358

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
e19908ab900c04f98e8b37f626c3f7e9

SHA1
7eab0489077315d888f65a58fa407ab6b57c378f

SHA256
2e27e0a43ef94e592898d3cec42adaf2763e4a11f7579fdc69ea7a97acd43c7f

SHA512
eb474fde8a145fe4bb47c4582f6d7ce5abea1557a5c578d066d1b6ac64ab1ea0d2917f1c23bff9cb5a7ca1e23a256e71149ac0d3a5740913f8851c2ac43c037e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
9d93382d94334574b58f2704bf57a1cd

SHA1
0de03884d9ea456539ace3ddf521aabc5c54f030

SHA256
6bbea0cce50be6c04a628ffa2c42b3f7d959faaa2c5bc1e8bd0e94aef6da1b3c

SHA512
e5b9a2ca17ed0e2164fa824db75edce6d694a7c9efb186c0742df04c0f0a3ba3863b5b5dd1840325d1f8351ea628db0a7f928d90badeaffd173c01c10e463dd1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
5736eae690731a2cedcad7a6bdbf893b

SHA1
dfcfb2171a1fd642a52b84f0050a70d686c6d951

SHA256
01551110c47cf182291ef55a86d80b5f5c1fa224573ee03e19836d5cb4d84305

SHA512
e75adc0d492d91d1663cd2d15812ce5817984753d968be95e2daf1a60b79efab560bb2fb631f22157b9a6cadf939abfa3d04933a1d3f413452252ebbe26ef1b3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
2ea31d8552a8743d8ae5a86e4d030102

SHA1
95cf326fa78b119ae3d57f4bb8a11b8d5f790592

SHA256
d3b510971251c712725229923a054f1592d4717801687ce1383b3a32d1de4ca1

SHA512
6e6801fe099b92a5d3f3474e6a808b2ae2ef3fdf7b629af5cb8f7092b348245a0e28c81e6e2013fdaed8bbabf95199ef5e05d51a11ee55e3f4f3612262d5359d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
a7a08f364934cb310ad0a37e851ce49c

SHA1
805f980ddfb2b2d4a6bad5e826fa263ee3c9a10f

SHA256
3bba874bc21b457b72c4bd6f21fd743dbfa09984db64b588809831d8794b0861

SHA512
c5d227f6e926250bf599a4eebc7823b3234e672b775ef2c18dae3dd4a825615436b13011fa4dd0d4d7c6b44cd0fe525b08a78bad740b63cff003cd46a0f2a104

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
60ad5025f19dbccf2163f9311caeaceb

SHA1
dba98be8ac538a71dc6e3f25d3e6a40824ba4c5f

SHA256
06e2630eca0550eb7779f9cda336e884d9d801c3d7d183085613b779dfdab771

SHA512
6bdeb07de46be47934b56641e7c0968adf9e2d86cd6ec8701b01bccfb759497008ad8549c5612e56fabab132640bca1cfcf6c8b30fb426b6bab9842591c16bb4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
f9bf5dfc18d626f7489f491e99d5a584

SHA1
879ee6d32c7eeecd078d3a10c8bbf253deabe951

SHA256
7ec44bd7ea5f2f7b9867a8994d89f871e1656860b34353644e8d6a3f74488f5c

SHA512
702970a032aa9e4e2a41cb5526139defa232b41071aa19d57dcae2964e8f1e1b0e5b4183929e72a590d28221b21c21e298d0f531da10c1e1d8eaaca2d52f4010

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
396fdfcc42ea49876c9f781d4a8cbf97

SHA1
63bdea682c9607c5bad0d69110c7d015545b64f2

SHA256
85d7c1cefcd6a0c44f5e2e9332264bc92b2c9f8bc32a9bb89587985e95fac049

SHA512
d77e134a5a0177f391bd943d8d1fe011fdefd7f08166c0f22af4e0276c2ca10253542cbdc9f98ebae05fa2874e2b27952952d6af08bcb981c7cd760bd1294c40

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
223B

MD5
1ef46aab9e588928fb923bac741f5cf9

SHA1
22564aba4f92b447fdccd7c044255004bc9d520b

SHA256
b763fda35333c16f77f24ffe26e5df21e4b0855c3bb31e4b2ccb03444ee303c5

SHA512
dc7156bf9a51fe466ce39b6ce30d4c65a7ec1b35a56697ca2653305b7ad7ac0a0a45e3f2aaa41ab86ccfb07b75b0b1528db051b3dfadfe7eb13d59b4f03ca0d6

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
ee6740c40c31ab3cf31d8c042c7bf02b

SHA1
b20904171b70799fb8836fa6a7d581bc559bbb8c

SHA256
0725115ba1a5fdec4cd2870117c1a8d58d58a66e9288c376213b241ab5937a37

SHA512
a3a7a61b93a3f3b8267875605725aa5d6f31c649d65039d38d8ec2c43bc136231b98a0d41fa749c999d6dc583720ea388f804f4aa81f91cce32000ee10c88bf2

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
30d3897595cffbc4ade4b247920291a1

SHA1
a40ef3452644f749a5fb1ead5eeab369e581f398

SHA256
d42d4b32b57d6212f5c903fe6c7f23b0eb138145ca5271f31e21375f360b50a5

SHA512
e9fcea330242d860ab56380a436c5a024a2290727a463d56a3b82eac81ac50f175f2981d50a9e3c02a4496b8078ec9e71bb45d8f51d68f20e9285a7851ba2c68

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
a88183ec97ec51976a8611172ab870c3

SHA1
c884abe80ea0b230435140785a24812626c07918

SHA256
cb860dc32b453863522673093028172f5ac547befb2f34caec3a2c235180badc

SHA512
44988c9caa244500ce3b07bf26b22f0f941167e8bfa1afa50a38a2ccfb22bd4583278b0bc4879b2e5c91a7ececb506e6452c5f1ea85a9dcd36de6fa3229bf69c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
c4d105047c17b8313adacd1b0939cc23

SHA1
03ba64d042ae0bc8eb59edddd80cd150fa3be847

SHA256
aef0b984870e35f4f1d2f13d760071cf595b8b1c824970c2427d4ebb213ae983

SHA512
7318535d4332e34963451906470a35fd95cc5a43356184197a0651acb7a07680d3683811ed5f5d960a56e3698f0874de18c7ee12ff65ca1972ee292f6d448ca3

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
36e59d8720ccddde5a53cd14dc778294

SHA1
864dc1f3590adf7b38758b0473ea32b4a6026e83

SHA256
46070e46731c3cd6b69e103b897313477f301ec2033c3095976753079580addb

SHA512
dcd91462753acaa5e1f40222e00d8d34ab51a1f83b400b741ddd714b1cf8125fce30b70a1391c43146585587e84ccf4c31b1c6cdb677573dc3d2d10d6a7e4d98

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
5837af5d32120720b66a847a28d76041

SHA1
a46f06f8d22d121cb917d18d7db51566c5689a29

SHA256
4ac81c5a8ebd09ece09ad8b917d7696de0fbc6fcfa9b12b0e33cd8b93e19711f

SHA512
87ce3489370415cf1f24faeabae7df545e2480a408fb6487a07ea1d64ee1a15c0afd0f45f447ee261c1ad162d75ee323e5dfd942e1b7dc0118f12f1de92d34e3

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
8bda848ead88e5b187828938f60244c1

SHA1
fd56b66427a83ff8048084d58272cc312a03bb63

SHA256
079e793f65075728be86e55643f24dbc9db840b9a64dd0460fe00a8e2b5d3ea5

SHA512
e33159fca86c9b87f7bec493751bf9948f9084c598324c8e6c0b449dbd02fc81a7eb1e2f9451e053d99807359009424d8f9fc65594f2a9117016dea4f73229c1

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
094b80f931feb1d13396beab2e6011b4

SHA1
a20ce334f3a0525adc4480476714a13e2a851aa4

SHA256
cfcde9cf41ebc609cd1c026026dec2d3bec7e5095b6c54e16aa03c75ade82a95

SHA512
d7dd77509ff36596bdb3b1c9b55191285e366fa9997857babbb83de2c794f4aa6e32af786d81d46d83246582ca2247b70ab4d36c5fdec993050c3a5a65004739

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
1d7eff5401cb87b8df04bb7977b07eb2

SHA1
be5ee13ec6da9d083a2af44148c1ba7d31008836

SHA256
66e19d3c85d16abaa4749078885b427e8be65cf29dc1aea7d4275c4c2eb2c0e9

SHA512
55d96b9d0442edeb3ccf2d756d8442c39711cb2516eaba72ec24bc413569cd963d925a6cf5d0d7e1c0e858e1e5bd025b10742286c81a6898463e528a73bf1266

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
ad593d86f1d5863be88d8f5eea5d0131

SHA1
ffa689afd90932e0d94f8a0ed459d5fe225201fc

SHA256
b684856f292db3bba885abd1be815616e9058c2a55b2d3fee8fbc9b7b81e41b5

SHA512
16f90fb157f29b6ddc2d4ece243536bd1a7b50468344345eddb676987961bc2c58ff4786d2c4f833fbb04b9c953a31c0ebefeeeb7536f4d44bc03a4c980c0a71

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
19a1d4eac059a6ceed0d8ac3b0460a16

SHA1
1b1c7bdb5900c0de17ccd35ccee81bc3b74e877c

SHA256
faa153fd29db00e800a007d0180d898fc4a6f50ddfa9f44ca64772b1c14ae16e

SHA512
0f7750f894ca99a51ca4589a44ddb33dc04c26df794a11c7b59279167be68943ce722177ae32bdef4ed5ba63e5504119a5fa3c8e531d1fd0107d5193fd3b420d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
ffde6a18b1c5140a5577ac744e09cde8

SHA1
6d1fe4f5d0b392f1c4ab00a16e0a6f121a99e293

SHA256
0be872f4edab8241f345468f8dd74a01de0db68c8022bc1bcc9762d3291ac03d

SHA512
91657acfaaf9e8ad9b567b615242b74f3533ad7a4410332146bf941976a4a72b9310b7179b5f0ca4fce6fde08a726721d1ad2953bfa4e86081db3d7c8095b8b9

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
6ea48049547d758cb868d33ae8e274c0

SHA1
3b30c0d22ee85be20ee32532bf9b88b531c92863

SHA256
c9a01222f1afbcf3f63ffcfb13fc04cf0b66e446746d1a5946e7c2185185b146

SHA512
af8679f86027e93c407676742b3d8f11e67199734a4b1294ee5e5556bcf94ebf0928a976358067b7b1e390c8fcf2883d1dcb5e6357305be71f66f9f508b41833

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
8b7edb6f325bfee29376267a0d519b08

SHA1
a1e2324f5bca44af5f161d96ab48dff7bed7bc42

SHA256
86a6cd5b7aeaac89350adba1fa99cf22c31ec05ea16858bf0321bdcf09f2a323

SHA512
b5ab59c5172bb1ec2346370785a8ef67eb8e72c9d5998c8094b1ba95c169446326574371418a8d5c6e0ed3b33fef48b9becadb4e9a5e13bea8416183686548a1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
e50d25e85a07942d53613ddb9010fb78

SHA1
3a879840360a308f96f18e9507ce926bedb0012f

SHA256
39462e5b95e88d3dbe468ce496e659f23e88fc02009b15648ca8d7057bc59535

SHA512
6c35720af0048522397e8afe70ca12b07eaef963f367c8e659d5ced05ed969256ebba7b0535397259c3bc708341b233e476b634c08d76e208e694b71c4aff65a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.1212

Filesize
10KB

MD5
7ec765aa9e35ce44121958bf5d4b9731

SHA1
9671034ec6a679f79e857ab8e694cd6ffe779c7f

SHA256
7e4bf2c2e744bdbd9365daf7bdff7b06f79ebc5199ded1aab54c06565e2d39b1

SHA512
0074b0d4120c66a7493ecd2f0a7db12d0e7a3fd7c836bf185bbe11183fbb36ee397a86995074118b87fa7060ccf336b69afb68b5f435dc1bd4026959da94cb97

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
01c3f6e8a6ad6286f79b1ab730214861

SHA1
2876eda1f20ffd2cf8aa72d9487648e18dae781c

SHA256
0da25061fef81d15f9401154c634982ba43c8c82b64173603bd85cd193e5fbb4

SHA512
6a09f6ebf9f6a9ba0c1de9d369b2f0bf866ffd7f975db71adb26aa85b28437ee9b5ac3cba0389c1d45b8a7f08f037630a40eef2968528ac02388d6e7ce010e75

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
8dc4259f2978003ebebd98f2760f4b8e

SHA1
8a54e0843f4d0e00eceb21ac5966a112876bc54a

SHA256
942dc767aca68bd39b0d3620b0bbb49b0c6672c2e189b8524da87b73ecbaf149

SHA512
fd08e0a4c956916f9575b18e7111d56495eb0b3d151f8296ca0b745d12831c5bcb65c8c46e819ea7b3990501f1e52e3728db4ac3a6292101898c3bd316ee2c3d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
a99767a116932ee9133a6ae3de3c6fa9

SHA1
8f1c3ae5dcb7063fa66590a671cc547b3993b4f8

SHA256
e3356d32cc847e401013d829679f3834333751c835f79f99750b54f8b6e81578

SHA512
6583d3e20f99b9eb4fff6dc0d0d7df0086df5ecab0e09d6e84a629e3c2e1c5fbe835c96c57425f15b9750f311cff3dd8f4cd4646e03a63d0db43da88076af06e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
72667033f949bfc2e67483ff7d5b4843

SHA1
d00c1631f4127f76414d0d28d17ce21f1f950590

SHA256
a749d86d0fd6a8e5540015a03b87d9ee0912f1b5a347b740ff9d1c45c3a7e990

SHA512
7316293fae4478acf8ac51c4ab67afd06c4aac8151b0cefe02d04041fd51c7d52639efe3b0213fc8cb1d39538cee50f9e5d81775ae6653b4abb891715f9e4100

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
5973f7a8e307e1086f859cfbb9698a0e

SHA1
b03a930eab69323928c59c492cf5394bd17a1eb6

SHA256
7d0629a6035934800d71236afd8ed0b41a32ff0c7a30ab3b57522d7f0b42ed60

SHA512
d6d48c6971aaaaba5670eee47e26f323e9c9c25a40182d09921d4a04757834b3461edc82d5d1602bbb452d0a59a373e94e71bbf6d0baa1ff64f88242ea521e0d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
e523c4b5ac94b52b9d15fe9caca7deb0

SHA1
1fd5a5f99a9d32dbb9b492919e66469da5abe4ea

SHA256
a894fcad89aac6f5898ee59d6b83c7c98b4f3ac1afc26dd57e448628304c9c07

SHA512
46eb857817557fa0738a47109aa9efed22cb2ef3d03387c2e7e934aa0aaeb2dc971789e64ade190d7041e2310b240aa3b5e84f052d2e9e46438b35ab2b3914b0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
d53b05648aae5a97166e7ef8eb5a75a8

SHA1
6399863d582f45298e2de09670d64469151dbe19

SHA256
50abd33c610d5b860dd84c149ed5947e7c11287fc7058c083a54057c87cb4bb5

SHA512
0e362473bdc42cc442207f5e6eccd3af392d2fc788461bb7e517307775f11c6ee4ae36e47ac477ffcc83fd5f2de43b9dbc015ac378241af9953008de7f5abaa1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
dedbe6c1a1385ff03c0c31fb6aef4b71

SHA1
c000bdc0805a010b391750d2ab8466ff74da0309

SHA256
4985f6e3f27802c068aee2250e2e1acbef72f5c06598950a6661e905da4133c8

SHA512
bdb3ab23f545e6a00e81cb02ad83787f1c3cd255771bce67c73fb65b1e711098493e23ea172d36a530b139b07d790f161278bc45c8c8b0d3267bf35830470c34

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
2fb09813e90c646deea3d31412911904

SHA1
926bdb068f9409850976ba19c3388277d544e6e3

SHA256
4a174cb1fd1cefd840ecfd5c9cf43726e48bafbdf42928e4f1d63f903f49b7b3

SHA512
80f6fbe38e73be2b685d0436b9a62e513aee52874e37c0ff878956c20ac5bfbbabfdb96e2cdbe1082835cd8be0112308abfe665f9d598f24887727f21cf542d8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
6f08313069eaeee0749631dadd9f0ff4

SHA1
0a46538468f42d34fa4398e4d42302ea33036fb9

SHA256
d3d87337bdb9657e09ee19862ac10d306862b766646e6744efb635f39798f987

SHA512
20bc75b47b1c161ae7e7f2daabe011882b53f3480f526e64de8498ad59278ca52ad13553c96bbdbe11b6a3386a57a6c906bb409cd382e0438cb8d75c431e3572

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
c7f9347521b6d085fea344d151602688

SHA1
c4aa31c1a1a2ef71cc637b31e7097730e6f28ffb

SHA256
0925e412112e5b65c868571671d498d77bace2232ca787006b2d89c2bf87fc9c

SHA512
0e40d2f4c19bce7a24ccc848505bd74f7f3b09812eb6d8f5983d9caf232fbd71403e1f3d6511208ed87ef0555257b4bad7f9ef93209d4e074b017af64e989cdf

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
0a466ca14a035377db921fc705752d12

SHA1
28ce83362cd207d236e4a4fb744aba7fd0affb23

SHA256
13e6a5b451637725eae6e3b1da8c51e06f1ed967bcf72815c8b9a81eb99eaefc

SHA512
11a46f2a31c0a131e474dcfd587a90049d757ecabd91561183d415b2de061f704052ded039532793a7e84af6d2c532f19e5904875afd30e02cb81fb2f9ba3947

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
359dba00f8ee07f16630c062f570649d

SHA1
6d7fa9422a9095c5eb34e7a18562c2d0fd71e8be

SHA256
9f3c1ddcf24c6f514785127c59506bf55943220d9d387a807267b80952458a26

SHA512
ee3a0454d05544191f092874dd9a5346f5102303ff2d078819ded115bf0d774db8d706c99d310b23014991439b593d126f80ad15f5aac6d99d0cb29c17bf7b58

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
78f090d15d30eeb1580fb8eafc28fcb3

SHA1
64c74cba088e641564fc322045f8da26586746ca

SHA256
e4f54e6a6d736150d3f80e5440e81ce33194cc2c72d9ec332ccaf36c6b48bce3

SHA512
5b1d54b2473d616ea7c2a8eddbb018e79719c10d7479625d854136af00c80c2b0b5507f4b20c5d253a48ba1d6e0f36838e291367e83c95e1458adb36a0ccfb11

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
e2842bd2b8bf817642d7a0190ba53995

SHA1
06d742d32f82ea4694e2a913e9bc50d071e93d1e

SHA256
b879e08e9109177b8a02e4f8ba8385e0f6e7e67210e413c7ecdabb57d448564b

SHA512
69db8be63435401da288708dcf101be5fedde9447a23d26992e00a4ca13ce3a91c94cd67e79094f683126aa195de25025ec1239c11b61ca2c9698a3ea0e811fe

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
82d1326b695720b6aa8633e496da9cf8

SHA1
f10fcd0c1de0f499de5ea45fb1843d9e990f772b

SHA256
fe15367b301154f19617642b90bbf05f66d1cdcef33f45be4901402687b00a0d

SHA512
b2f34bb496d7d51b7f1622a19fd4963989cc278e15ce0d5f86c39d1c3383f49666426dfbb6d2cf3d9e92e785438097b080b9baeb921e2b85b1c2e0b79a4897d1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
4181ca05b1bef6ec00e2ce3c4a5e06e0

SHA1
7d3d315723e97ced7bfd4c2dd6118e83b568a774

SHA256
c0668434dac576bec43d6b999aa1ecb992c98b8531306dde6ddb74c4ed73fb90

SHA512
a896f36a131a81e503c4bf55df33867cbad3a67bee66fe5a138677ef2ea2ac99da3eba870c07f1572a5499f1961dd509c6152a24bf82279c429a73186bce702e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
fb5818ef3f031dbfafab6bfa0ec21477

SHA1
d03562db1e28c9d24d03b740d4aee1639d9cdf47

SHA256
a521a7f2b3301207cc20431dad069230f8eb330929245ea8cbea32e557a195a4

SHA512
d119c16449f0ae9c500789d29d7915fc7f01ce3087c126a6f0462f998167a7f198f9811d837de7080b991679501394fd4c36e742b5936c92812ffcdf48c37123

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
66ea649c4a529d3043caa72a91d8b339

SHA1
383221a38b6a963174d3b90b5d2bb0c0527594b1

SHA256
de8452b0aef99abfd73c1308d1a2f3979e14304e6ccb925bea9525215bf40b3a

SHA512
7f516eda5f96e289e3252d6d833bf8f680f5e8f5360bdecbdd8f555a8c73cdac0523cde31ea0e0b2af5df829ca086d568052fa0d0ae3fea9dde1e92d8aa7cf07

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
79d1a371cbaab4f5aac2847168b99066

SHA1
4a92ab33418ba701ef96ca96a5a5ef0cb9e589bb

SHA256
faa4c30d216a7bfb67241a1efa0d8535c75e9055f7fdffa415da0f7764df3a58

SHA512
0541995affeefb7ced09330fcbf02afb038911c585c92f5155b423ef5e91e9a5e0ee71b21b7faf22685dc87ea970e00042dca6f4181271bca6b1ff4af12aa797

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
49b030d9a864be6036688954f4fcb7d9

SHA1
b72150f3f39ee081e6b27d710f02240ec754b42d

SHA256
3d0c0d6153a3c2df5d2bd339bbc10438e21f0c0d615acda713a71d375b27cb13

SHA512
6173f0763ddeed8942cf9016b665b34acb9d54559409fbbcad3626f6fefcb87ca9e06a8832ea5a81ee9982a5e0b824ab9769ad2f75ec9a5be74ec788cfe8d672

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
deec98465f5f46103530f919890f5eb9

SHA1
6e6cf055f25091665a4b074b7250b804030a7dcc

SHA256
fe49e96c103242a3327f1dc42fe946be5bf4913b769ba9ed063abb4e0c0fb242

SHA512
1e0e11522f6a9cf33c069893a78d36231e80125b6a3051c6ad982c7a2ec61c2142513c5952d47893d5cb9bec08f1af6f89110ffe27ea5d099c1759a9dc70ce05

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
e5cc894d90e5b5f4bf1a5f51fdc0a728

SHA1
e97bd306a21795c3e129c8ef85e5716ba5340405

SHA256
30eae346f3feb1f848516fc4bf6c3d254bc580928bd8f598091e937a89e02b95

SHA512
5bfef5e4cd5feffe7c7d2102d4d1c0336f174c572678c78c935f25303bd02c7ae8a3a8c44da6bd05af059ad95bd9b6221f9c7ecd98f2f1265c004b75144f6261

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
f73c20ddd89bac1eb8219ac8d64888eb

SHA1
badd6b2d3fb93d26ed3f80970444dcbb2833ffb7

SHA256
5667cca1bc06181600d4d84a4b4a8fc30e5e9c3df2bffac21953bfecbc2c7702

SHA512
90965c0a7d2d936ebcce766999dda7ae687d17e6c1e26e3d7ae6f2f4d0bd065add7a4416318f3f07f1afe770495616a525610e7c2c9471be1be6ab64828f4571

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
b0df8d4ab0d3875e8b7a51e1e4e6755a

SHA1
2cc7abdd314bc1884ea1f9f9dc69ab9b49ff6d3e

SHA256
48b800628c95266d83ab3cb3204d3101b82ac4b382a0ccb34220010d94b184bf

SHA512
da44a9bec84645634f61e33ed2ef3e2a72169cbd22029550da60d5e868c6110c2297d3783e761c81a9c51001e62b4bc049f82c93da197ef64d6b2cc2b97e0491

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
46e68aec120a2dc81e4d0ab5bf261897

SHA1
8c6799f102f7e4ba06604dd179c681681063b3e5

SHA256
375824fd90be5d51de3f72364dc7f55a4bd4943ed0beaf4ba33982b9fb9e44d4

SHA512
5a7abdb049b440d55f9cc20c0a0c86e86252756f29c9270fafeaa2d6f056c7d53b1832c1e234b1f8232300918cae99e52a3451c49085bdc0c3c28c25698cbfc7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
f8cd0b130eb31d43c1c7c1ab07cc0cf8

SHA1
0ae00e64b782a7b5ff4eb3deb52818489bf3934e

SHA256
5b0222cd1d5dee20199f583d83f8d1ad411d8660fecf57c55d7f204e871ab8f4

SHA512
ce114463efb038c391ea5cefd8fbcbb5bbdd89987cdfef7ef1d4481c628fcf425e2edcc289ca4459fc0a113b100b1dd393ef3e86827ce6abc57610ad00eb24b9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
4b371c7f479d53a23c9c7f1ec4d5e4ef

SHA1
780ff6f145182ed182b652ddbea402a480e6a70d

SHA256
65868eca8831fd6655bd4489e329425ebf412ceb939e1ac570aa0fced64374e2

SHA512
7047f0c4f639e29d44c987eae204b358af8fc3b061b89364faa5ad970484747849fc8cfe0fda0bcc8c8d3a9f9f118bc52bb385ff7776afc93a9079d0c3086232

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670753844819229.txt

Filesize
77KB

MD5
0bf6530fcdeaa2baaf5efc1d7641a388

SHA1
82cacac6a338ee9f92b4153519375152935f4b69

SHA256
ef85248a58d6dd176bce94fc4904bea449e57326dff15cf482eea673744f850a

SHA512
75c061cbc462329c5d17a390b72b5e257cf58cc84dbbdfc1b024cfb6cc0bf4ffb0fb05a1a0ba89ec0609de6288560631e690640b5a0c7f9f6a907d935047235e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754404913880.txt

Filesize
47KB

MD5
1ad2897cece67d22ba5b8be07d79bdf9

SHA1
8e8f2933159b47b719018e8861cc51e205303180

SHA256
bacd3bc897d7020c6507a76f577d469f5861f405325e9bb3d58c7fd2a7af488d

SHA512
be1c66ff205a128138614c6d6506a69194fa7653fdd3bc2fe93996ac20cfbe7ec99b94080a681d590680b1994ea166a6cf96e6dc1e6fc339e9857073edb338ef

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670761474704088.txt

Filesize
63KB

MD5
29f0d3940990b5e2141d0bfe52556b5a

SHA1
0eb11d405332896347cb23be7170d98959ea2516

SHA256
1637416efbf3e0500cdb13e7e91cac4a38a8c7edabe93111b5c2a7a226ea0d85

SHA512
ce9b36b9d06effca18ee31e0c850c6407f10cc1aa935fe3c0ed630fa1da68737fcd9b2004d519730ce6b6fe6c1f7edf57d793189f976fc26707b1c162435f57a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670764101374726.txt

Filesize
74KB

MD5
e1c46533ee9bb3363cd7a7c6c56938be

SHA1
fe21fe6650d3cc4588091386c6305214f8103c1a

SHA256
ee79cb614079ef3dad3e0e02515c9ea5ef6f5d84a29e1c3e0fd6cb11b210d6b6

SHA512
bde1357f11d57492ab2a337a11dcc1c45a21097c48fb7b6530150f25d3260469648ed8d31b3005f8dcdd7b0235bd5ff50eb120a62ee744675eb1736626d3cdcb

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
ed2efb01f22c098f6c1110c30b66d033

SHA1
6b85620e567acfe0ddefd066c8a2864afd53c34a

SHA256
280e6462a0952ac697d366faabbd69adc48c3597cbf3101de4a6f150b798cbf2

SHA512
2837c1e26f113822ae486465a59166ef686ec40e8080192f9218c1ac5042807a542f5c0b1a5f4992c0440b03c2ab0c1fd78791adbc194500d5672f623b913337

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
47b06ae557c13d07981159a2072ad277

SHA1
295b4f5dc86e057b2160d22feb41d0514235daad

SHA256
b7cfc82363ce02f5b4d3349d3c72d9dd41659525c2b0fa071fbabf5ffc2c1a35

SHA512
2a8362cee6a01c94216b1661706d03b0926a93612a6ad20a97dd8924aae79b660cd928ccdc0151ed9402790c5805b9c2be2998352dba5b72e128192310c93357

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
d612dac73790ccc7e72ddbfb6f2a518f

SHA1
dc857fb31a1419e13e372ed21caca1b6474129bf

SHA256
248ae5162063460228feccb4eee6123fd8b334f39a83085f32cfa45585598b28

SHA512
5796862fff4415edf18c0b0619c5b4e987e1c9db4278c35cc46b00c9522d1b0c678e19e2acbce97cbfb0b0a86e0d02f278e11a198bdb1a99982d4de53c7d3976

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
f6d007bd860d6d1b18a1a750cbbe50c1

SHA1
55d280c74f107f6f5a38eb42149a5ce6dbaf0a7f

SHA256
2955dcd1a1990a8240c370b9a39adc40a7104eee5442faf3c05f54f481f7d8d2

SHA512
a4452077d466553ff25f595025ac8df703dae5625c1dee47402227f367a474eac56044404e8a7f8f6ef6de63b79b4fa8d175b9ca11093664c8d90202d8484311

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
5ac4b55c92fd734f8cbb1f3ec59dcadd

SHA1
e139e2fdbdd02bd1986ef4ee5f806bdf64133efa

SHA256
0c61647ac45ef777079ae324d55ad8b1886ed628fbec4db6ba0658f1f1bf623e

SHA512
c60a8d5b9e7d00c4fcd4f783015b66e724ae390db2ee82a50a2d763c90098f154ec614b3cca4d39078c35bac756dbfc235f16991d8a8d49f13742abe59c951ea

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
1cdc5eb33ced5156d7364aa23502f0c7

SHA1
053919b4de728e334c9e98a07eaf4cf0a18dc2cc

SHA256
3c4123cf0a8db89bb356a1e1db0cdb4dc61f8f8fb7266e3be90f407a57fdad79

SHA512
fa660e61ddc7234045ee667f7f26d5c52261535e037989290d786cf7127522fff6ce87e887ef5e1778853275ff2b757a97cf98bf805119982ac000a346388f44

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
a7938bf5343216248268cd3146b4b22a

SHA1
52bd3aa969adef8f348ae78950ab8e5f7b2c9314

SHA256
bfb1225f6c40b2368a86eef7e3205843e45b467fcb809443ca8629282b8dcff8

SHA512
8f24d4fcfcea7c22e07683aeac83510e57ec9c8b9b1010cd8884ed8af155cb7413b136ed11406a9d4dd9abdc9344e6f5e0d3e5e5012ec5ba3bd022c01143cf8c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
4b438d3e0b466dc731484d24a7ab8d61

SHA1
cd1b564dcaa3c647f1e6a7dcc776717b1bc01e0c

SHA256
e7fc67d1ff8e208d39d44913f2d46e9ab3c7525488459ecb66f0e50ab36068f3

SHA512
e73daed557e9d7bb2ca58d92fb7a6e2b561f140eb735336af4d4557f4b1bc994bdcdeb605776c8d38596534c00b8ba4b32af2e0ceec81c25ed06479cf2f3d7a9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
f39c22dec62284b36a6ca7561c3bef63

SHA1
4054c31f49769a9df651f8ccd168808e5e43e665

SHA256
93b9560de045cbb82e7af3ad568ae86be221395861ad73533c0154db7d1f3254

SHA512
c80d75f83c898b3895337cde1cfbb76b766c83b3e5bf8f02fbcf569b3a2bcaa5442a0bcd98dce18a8099ae2f9044e4383767ddf0881a1a2845d3a5fd07c51722

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
83c7e76f5ebcbdef37b265e462ad818d

SHA1
b70ad57e2cb791b42d1edb7010ee415545ddf9e4

SHA256
2338f175763ecc13ff3232f0ea922ed2087dbf6cbc08a39655b3716cb9f6d66d

SHA512
ecb5a5adb4f09d4b633effed08add53ce6c272c5b674026180b3b633e0139e5230b8903714d47452aca27a18ee4872c131a7b6a43a977aa5764b3a3e83552346

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
370b303bf25e17f832da3e72b9213af9

SHA1
b5d73a37fa84744e28e2d5547161856b13a9bb8e

SHA256
1c62957a7126514954bc2d63ad3a0a9f106634d896b0c6108299207d79e5928e

SHA512
abb4efe7c12b951217ca95c629e1dbfa08cf43ec5f43a26650a76321866de389d482af411d906cb3fc76f2d43e9501820b4d036c982d7dfe9fb1d7e15ee6ec7c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
f9f7f8fa083b7351999c21ae1a7d2133

SHA1
94081c5dede0d28f3a26b73d74ee0076150e4ec0

SHA256
e3b2d055ff392c5d4c52ad25b313e6fba5b62452d8d6a27261403c052452fad6

SHA512
ceef4d46469f5cdc710745c9ee2da2796dd4ef8bb8d0f4d1af9e625181a4d685b7be0b114ffd7aff175c58f556c4d115d09feb6f390645f0c32486bb45ce62f1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
da0ec559ced534212182d949e3721d5b

SHA1
6ee380c294643c57182c637898e2fe400a38b327

SHA256
e462fa8831031f7e4b24675f40f3c4a55f380cd12ecc59d193f9b4fa75feeaac

SHA512
93f566e83165e0e94cdd4838b90a842eb14db6befc3ff89d17a7b60d5fa2520502cf3db848c1c9253ae0074f80573d10a19afe4c14716634aa04124da8ceebab

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
fb6040aad3ced4c93b58a953be901cdc

SHA1
0e35d0162268675b6949443273df15f9fea556b4

SHA256
a372ae677e9f4dcf6600fdf1b8092a12f8ccd52cb3c71c8e3ba07b8070211ea4

SHA512
965e0b03d8f3d9a3e523cffc3bf97e7e15b9e53f7656b44920e4a48fad36c755f49b4eaba3331cc3de751a989282133b90054672406cc51694df172ea6004b28

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
846b2a6ae8223bc2628f95f63d05646a

SHA1
d4bbf7554000f9be32d19c31f6ae09d6db4f2caa

SHA256
88a0a4adb9d5e20067be025e8ec81d382dc1bac439027c0a3a2d1354be5bc835

SHA512
47a2e69bd87e5278a8b2e75fd967d7be614a88aa118118b5d9168aa8c2fd629871c4321c37b0b904f95da7c3f5122863ff39e4fe906579e2b204585403b597f6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
a2be23fb50bd260d3e3345a000e18d3d

SHA1
5beb055b3f54f4b76d375b7cb4df1f08dae9849b

SHA256
ace1e2cf32adec9e3f88be6d03bb04d733a6bfbe5134ce15d5c25b9020018e89

SHA512
2d14d7361818c7028e0233990da1389f960c041761cf2c4e8735e38788bd1628f5bd6f2e15168494bbb8e06db3dbb79bae1b2aca7d40f16db0bee202685db478

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
a588bd2baf4e078a24bb87d0d462df3c

SHA1
653903752438ebc20926b5ea8f7841bba616e5d8

SHA256
089efb4637c44a9e8ba02abfbf263851de9b7e9736e5aa111aa35484d99b78f6

SHA512
49479f6150373a40989c8d830d89fed5179e9fc33f9e6c8c8de810cb7cb8c09c206d58af7170d9a4c9b0a8868bbffa91b65f806322d284fc39bf53f3101953c0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
76d962dc6e6fe1e44bdc902c96aec609

SHA1
c402721d365a14e06e06dbfce328eddc159e30be

SHA256
f972ad0844f595cff8f76948dceb99c5e4cd4e3f6c71076b6f6e8702ba60562d

SHA512
5ea2541636ee9b6e043145b513c6cb6ce63b4a6bc3815e5961bdbf7f19814eb952a198ce0f2bdad522865c677c975b0f3b752a7e0768c6c629f8068bf36d6d66

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
66538c23771a68cbd9d7d7c6863a829e

SHA1
cf8e03863283911390ed8a3f5a9f6bed267b365a

SHA256
91d4d2a03ef94d359c82463397a73f4b18c6f3c83441a91c8994464fa64b9d03

SHA512
1e44c948072c7ccdff2219b62beeeaf8ef785b0126618a5fe49f93302665e48ac0149e7f13d004412fbbefebe7832c006b3b54dee88b2184912cff6086ba6841

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
e87fffc7b32b204b6dbd011cc7aa22bb

SHA1
eb2908f88c8a22201eb606428af15d1594cd001e

SHA256
2e0806e45f2bd3da63978c24198ef07e476b3dcdf0fcda9682457bfd03b3c744

SHA512
a89c64ec00154cae7304ad71836d0390b516463b80a1a1082ccb75fdaf527030b96f78c67d35df49350e90872b7fce67969d9ba7aebe33b9d3e200f552295835

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
d910accd1d5e8b266997a8c8f45ba69a

SHA1
588ce5f64f5e7f32810b89ba1501bdd865c8aa5e

SHA256
fcf176993fed53c1a30c8fdae75ca129c6923e798096f42da82ba30c42ba6aca

SHA512
c7faa650f867654f6072ce16a70b07c9f77611a0cd858cf39ae0af9f1d9c7a4e26dee33611661197b31e2956e8c06f94d560e5b5025177c6d280c73d966eac36

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
dd2d52107e71e4da27bb85294ca2bcfe

SHA1
48d9778f07155b5f403206c596ce6a048ce91e7a

SHA256
b200c3a9e3d2699a40ba74bf719364b7b40c0da15b8c74aa62e9b24a96f2a4af

SHA512
43713c1be3bb5b3071946f514999df2c29a2d060fdde66ecb4e0b3253c9decfe922757b5e6dc1408c76480d9e9095fe91222dcb9c3bfcc244e690aeab75bd6f7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
475e2d5797f0fd61f452d4b20c5fd223

SHA1
c405c33743c8260bf653d5cea2cfa9fa72708f8c

SHA256
ca7a30364fb8cf7e8ca38d05d9cce2d3bc13fbcabc6bfc98b3b19de89a182077

SHA512
f06ef55b3daaa34b5949dd34a08a2bd2070dc8fa86b7fd2ca1f6bab6e5b962254633c4eb134a0757d29b9b91645411a98e3ceff25fb3b27601ef9e723cff0c3b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
ade8edce50e7d26af06c24374fe7caca

SHA1
2921f5ce4123703bf87dbc98731f451c71a6fdb5

SHA256
02585d04874c3df0e7fe8ab933481f0b1bd3c0bb713e42b4eb0f38e06cbec193

SHA512
a0f37a1d7636a4858b5b5b6739656ffff14e30b720e2beb09df926fa044b808cf25ffa2b4117dd6480eb7e350396fa785338b1d82085c2620521e9dd3baa3c8c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
541db7d69ac9fec242d3c747c51f5d0b

SHA1
1f5d790fc08554a87b5bf367db52e0041157c330

SHA256
0bc32d165a83cb4ccf01f8244a273bb732b769fa33b9c194bd89d5703fe5eaac

SHA512
5154cb9eff96100f25688555e9aa97f16e97257551ab018799ba501eba8cb941c142985a57c3023f4d53deb7fda2eb21d905ed3322527233dbf5aa891d1c19d0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
dfe170453ab1eeaffab51435e9184e92

SHA1
dbd1f0ec9b924cf5b598a335295086bff68f5b7a

SHA256
0910817c955b79460e055e23c49f4a8327e135989d7137c2b5acaa88b41e65c7

SHA512
3841dcc13039224eb4cec4103419ffdd8908b065481f4947c8abb2cf60e6f9c92afa90046a8bb97f99e0b885cb35f0ec027a04970b03a771b938bfa7e4a77e9e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
acf9b1a4a8a48f596feed0b241b283ec

SHA1
6fe115cd37f041d89674a5e550422dda1821adcb

SHA256
9e8462a7c81654121fb1f5dac208f13af54c3cbf1baf5e56d9c402923e64d6d5

SHA512
06eae94a7e4ab374ae632b94c775dd57272a6619ebaad66a1867d33ba8561233fd8731996e7c14cc762504c35e5355e5da0921a07666e1207ca56ac204660f10

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
d91f847b8647331fc078825480e177c4

SHA1
bd71c289599e7427f81a2bd693d4139ae064601f

SHA256
851d7bb2870d31ca8814e58afc3bf64fd01f1f0286979a58e891e39a5a09cc6b

SHA512
351a1c7a47707b4f5b9c87239c06a1b54e871038f17c5d79898706865fe62a3490a573f7a01160f27196f044a9a9d5002c8198242a945cbc9dc83ba7b27fc7b9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
b0deaba7e2b9c355690484bcb1f2d9f2

SHA1
a147a8a2a7cde5582acbbbbaf2cabf2f4e84f803

SHA256
3eee4fc6a6975d1cecc3cb83471b4be95b3097102f8b2f097be0d14a9fd004c2

SHA512
aa0a0e8d7c4e0b006943018cb52afdbd48cd0d21c7d52319e8d054bfc5b9def393d68f49812ee8bbad2c97822cf587cf3d8eba4c251ac3b2dacfb0dc25ea374c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
793404abcb24b55a3032596312d20f02

SHA1
ecc7c0b6a97bc1cce596d36ce7286a3d95363597

SHA256
39d7b6f24c0f863afb4ed422a54c773f16fea70fc741aee43ec017302ea55df2

SHA512
df2a6dd0d07f2c8ce96ce1001a450e0e43c3051486d39cbb6e701bf762bd5fde374d1338b57de3e8a6836799318aaa2bfd15c36ea724287c01db97aa048334ce

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
8289393265daf2ddb32cc2fae262ad87

SHA1
e34d0e130322a2a10d91d29eeef04635ed904496

SHA256
7040a061d370df4ca9062d05bb38d3a5d38c8ac8b14317dff3d3301dc3cccfb5

SHA512
ed0fce456a7736eb1b8d76ad680646c06846065fd90e44fd5824ea748fa329e3c332238eaab3c5271f3c7fc569e2ad336555106cbd2d8c5c4b68276c8b9eebfb

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
9b314c8275ffc97cde5381932ac78559

SHA1
20ec4ab1358db796ce35887cdbe8e341f2a24361

SHA256
05add3bb463b22cdb1dd692ceb02835e7efbcc0252e03955c76a171f67c7ff7e

SHA512
5240292067289dd50944bbe9cfbe56a8789f90ecfa82c752d71e54df23e377283516c05c72d59d7e5e418e2d9f67023905ec737dd45c8bd14dddbcea10fe5cc0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
f149c0a10a34d2fc374221a301571dda

SHA1
360e5a9e68f84dd99bfa388df06cd8e4e3d1e056

SHA256
13defbe0d7f44eacf06da7426937e93ab8e9e26363642ec3dbc8445044ca99ce

SHA512
6174ed15b74c09766d2364b5efef4f165edd3556f32af3001a9b095ad5163ed822bd71e0590fde94c8d567b146ad6b666524db0a500bbfeea10f7ffce613705f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
ec725373a7cad90253d26652236826db

SHA1
d13839df9938ba891668ac8900166f46da95dfe5

SHA256
02795eb953c31672a46b45f4e9de5644f76ff8c6f1ee17c1eb08bee782f52331

SHA512
3ade3ec4dcac5c026611bdd787d317653b8bedcb42b4b1c0c1f7d6e58f0a6198145ec9cd03f316486e27a8251c8b7fce0d86198342740b6861ac73242e9a6cf7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
650e4d165cd72b21a50603e10b45f812

SHA1
b7e383739381c5fd4b3aff1ed0910ec259d1fb91

SHA256
6f66346cb84789c338e07051ca5c7d78fd363c6e82494fc8c76361c56cf539df

SHA512
3c6b463402fd65591e9d38b47ed239024ffd6016b2f728aba85a7eeebb8962b3ac6188af78596e822999d2cbbf99402c589fe629f9362a5e0a07346bfc27fac1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
b1489b90fb4d9ed3df4f625b628cc1b1

SHA1
9f10f10fccf54c10bb187f7e9f590199892dfb1c

SHA256
543a96e4da5c8d9f6fc7be42f028ca17d7e9fcc6ca8bf6d596d05c676e57e24d

SHA512
192166141d07cf601ac6f79f5d8bd91c6155aab0e0575c17e97ef123c7d18627c5e95d8f7af443c08855643c30bd7b94cf6864fff83d5f4765e516e1995e0a0a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
17227255d24ba47d517caa638b00fb7f

SHA1
0a35001397a2ea360c0f027322d7cc30a9f5ccce

SHA256
5942f946c70deeae7968560d6e2e52495eda129a093b5325d4977311c5ff85ba

SHA512
fbaac274fb2b365a4b3cccf8a07ec278f4e65df6df66a3e38b8b1155ca7ce9e5e291b2abcdc5a6b3bd928ff44c294bf72f46c97ff1f6745aeda97e51cc0b3e22

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
56b21e788593cd96c03740f93031a07b

SHA1
037438eb39c7ecb493d4c672e794b9f793febe8c

SHA256
2431cf989082d697e00bd7cf86113b7f01010ce47eed58802e64f31d90ff9264

SHA512
69870074e2d86a8ebf6a7c0c3cb210312d36244556610d879996cdc2ab0d0e5e1f333794d705013c561ac0b1e34b4908628958c9c01113102ec9d1eeda1d0795

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
b28223810fdc67b22a1d5988b9ecdbb6

SHA1
573c5d48a9c9995f71156a7d487b102e1556d20b

SHA256
68d2ca8565d7a4b00ed530c30a8575210feb05a48ef8ec558e8cc0821d3c647b

SHA512
cb5db36cf57d0930545c559db6dc11d4c0bf5182c5a1e2d207d5665f543120cd6c97d86e08d4cbdd885a6b32c0f486e4b147f40f1039b971d3163a63912f8149

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
f0caf305e02defe3ad5e05e4b9d30ac5

SHA1
ce08d85e74213adbd8c752f96cc02b5bed000b0d

SHA256
b68a5cc4ba226768830f723cdaa01b62198586daf0a856b0500a66acc0a40244

SHA512
5b419eed904fbc98d7122b9ddb8b30d656477322e94e288210b358952b5eac4cf8c1a0d37e663bf5e209081503308d205318809b38d79d72306291d11e198721

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
2fe7cbb1fc1cf335636072d759cc89e5

SHA1
369eb9781b99a4bf815f70ca9bd83e099c20e89a

SHA256
cfebf487a6279b504386f09577b594d2b01498a482c079b4d3d064e68ae97ec5

SHA512
8b99e0c47c94e78cabaa916624766851ed4752714b7049a19effb018f3493f0889d8c38d31c406484494829464e5d2a5b652268bb369fc4125a164945db0a3b1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
64db2496f52ed552c674b99739551cc8

SHA1
ed8437874e1a0d6e5c48e0d8202cc2570bfc7947

SHA256
90a14ecc804d8e95b6552f441f4c20add3dee96fac253cbe7148f2dfe5c78b0f

SHA512
3b3b92d4b616ffa7a27ec23adf6dfc0d9aa331c586962fd37e7764b610f106a3b91b223c2c8d7d17ec13fdcbd6c32dd9c2736818370132b4fbfdf618c1c34259

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
5acb3f94b803eff09a0afe9182d10175

SHA1
f451d68f2c0726a55de82d696bb584791fd26e8e

SHA256
69e3f33b53980f4106eb6fc17400bf35cef963cac6a969b8e1a1c06924838255

SHA512
72f277aebe8b66ba5fe11eb5fb9056392ba51645f0cb34ba03fe6340c42171a011f31e6e13ce72afd1335f5e1414851520cf48218b87a5eec3d76e6e7d197732

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
91f0471bdca06dcab1fcd666974cad5f

SHA1
7634dc6c163f23c6da9cddd149e7ff08dc0b008c

SHA256
5b144671aebd2b84a3378293fd28555358872227ee161b05f0fc1a3713fe946b

SHA512
574ccea26a489c8736b27b642c29ec152aafdc4c9fad6aa5d68fafbd5fd17761a0087e9fc75fb7e28c8be251296e340b5e69a7b92d30c27513952b0c84760165

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
ff8280866925ff69a56007a5193dbbfb

SHA1
1ec97af2751677a89a4adafc015f9bb0856d9df9

SHA256
6c7495b1889b7dfec14457c8d51e78caca8c921d9f685b3d1d5bf98335a24b5b

SHA512
8c92d4141a88fe45bcb09f9ccb31dac169f609945912ca9dda9d89848b7c7cc55bd5b4d78164efd70f02e783ebffe82ac48ca8ca85a2db587a48f1443d7e489c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
d975f540105b454253430dac6aa55e19

SHA1
cf993a583858ca0eb9482fafe5619544aae0267c

SHA256
54b171517c9162699b79fbc4e367953344ec0123ce89908c82b0636376f702bd

SHA512
b40be941d7143c595f6afd3d847a1e9087cc6f9dba674e8d2556fa4e44b9c3eb8f701e507210493957b2b74500cf363cc7ff58088abfe9461048a2e439ecf66a

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
6998bf3ac1a0a32f29537621c95061e4

SHA1
98228cc4794164d09aff5c3596a249739d7e5d7a

SHA256
9237896c4504949790ffba3839204cc4e243c1bdcc5408c1a6b5256aa0e89d2f

SHA512
8fe8946013390ec2ace9a50121069528c1a7034a78eadee5581666cfbdd0b70f90e5e800dc78520f26543a0fbf73a7781d1008a74229b4d2782933c0df98fc93

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
43bf6f32c16e9a7d6940786b64c96b23

SHA1
408ca894b6f5a148c4596b91b969d3cce2c51bc4

SHA256
7eaa4cac0d6f6759c93fa0d6374f093dc115d2e527d02b5b2de1444a0f7518a0

SHA512
1da2b77be56fc3ca54d6fa39f85c61a8594e73b067d06e5e43cb50f44df98d3987342c439a29bdd9d8586a066fe4ec93c060d563163ab9dd9d635380ac287533

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
ee1e3d24c0dc9942aa8a7cc342fbbd88

SHA1
ecaba5a2a58e32db50d33bd89262aa2f6d08a7ad

SHA256
86709ec682a37f41e10e3728e1fcb757014b059656688c722a730cd4939f219a

SHA512
e7ed4511fa39535c3ce6ef911c712e3013ce71cef7b8ea42166a8c8326f57d5d87a0e24c68d015c2740daadb85ba59f2c0861cf74f93a8b37d7ff5ae1cf580f9

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
afd2c2ab87d79db056989ccc47e1855c

SHA1
926ba809b5d287d254f2c9f6889e88b182e11767

SHA256
5b5a9d321eeac64d6a567682136c51735a56c1bd559db4fc5fa54ec8792beabd

SHA512
7aac0d164fabb471d3f631e667a712a8b5232f65566b650cabc299d497d93a93bd76fc5f2a18951580a9392a6df6693ef05904623fd90718d25355716f2b2dd3

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
3950db5bfb723f7f35d45ee154e68c4c

SHA1
d8ab41496a1e53c5d4a3ae265cee5878043deeaf

SHA256
6bd81884c4e6462c0f3c9088e4185014859698c9c61a3ee71473fdeda7f47af5

SHA512
7e85f1e986155dd5b1b0f8ce4ac939cee841133483e7ef3e368e62f98c407a28c92494e99883f9fc8ae5887ffb85264144995f66ead0398e83ff92861a64edea

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads