xorist | bca7b6aee28bdb9e76e868af12c1f59bef0aad5d53e2052fd5ea516b70a221fd

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Size

91KB
MD5

169c60b6443a0869888bd8531bd16860
SHA1

66f17dfe56695a72df59218908d31b94e07f9610
SHA256

bca7b6aee28bdb9e76e868af12c1f59bef0aad5d53e2052fd5ea516b70a221fd
SHA512

70721de477ed8e4aae17d05f1f01dd2e4cac2aa28323ef68dfa4005119f29fa546f98466b5953b4d1014af1074f0bf75342931e69112c66d6372b6187ccf0ce2
SSDEEP

1536:YORS6106666666666666666666666666GkB:pT1Y+

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral2/memory/4456-0-0x0000000000400000-0x000000000042B000-memory.dmp	family_xorist
behavioral2/memory/4456-6535-0x0000000000400000-0x000000000042B000-memory.dmp	family_xorist
behavioral2/memory/4456-11227-0x0000000000400000-0x000000000042B000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2175) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\l81BIMUhkx6s92b.exe"	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp.inf_amd64_614ec8e6e63777b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\LogFiles\WMI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\slmgr\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsphysicalquotamgmt.inf_amd64_796516c18b264f1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\halextintclpiodma.inf_amd64_7f59f2c73a7fab14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ksfilter.inf_amd64_d5c8b2a031c7d5c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\transfercable.inf_amd64_911a60fb265ff111\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Common\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\spaceport.inf_amd64_6383331cfa0a32be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\LogFiles\Scm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthprint.inf_amd64_d3a88fe647d71206\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mausbhost.inf_amd64_34c86c15777c913b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_linedisplay.inf_amd64_a720ddb820f10790\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_usbdevice.inf_amd64_815550fc328ea85b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsquotamgmt.inf_amd64_5f092e2a496f61af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_image.inf_amd64_31731e48047fa274\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\perceptionsimulationsixdofmodels.inf_amd64_acff50a7960b7d19\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pmem.inf_amd64_acec109593aed940\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdpbus.inf_amd64_05ebd3b4422f62ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\storfwupdate.inf_amd64_e57f4de14d125fac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbus.inf_amd64_a192dbf28b4634a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MailContactsCalendarSync\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_camera.inf_amd64_7b52a9607d24ece6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\image.inf_amd64_d2006c0517ddc60c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcodex.inf_amd64_f5594a2af66d11ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sisraid2.inf_amd64_845e008c32615283\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEJP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_hidclass.inf_amd64_b37df5bd0922aeef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpssi_i2c.inf_amd64_8e00e1aed7fbdf70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrm\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_55014eff4ceefbdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\percsas3i.inf_amd64_c17a63dada1eaa02\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ts_wpdmtp.inf_amd64_e0577000b188c16b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_fd2fe159a9daf508\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl009.inf_amd64_3bab34655afeb7e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0015\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsun2.inf_amd64_de323a35134348a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEJP\APPLETS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netdriver.inf_amd64_2d569d832b41b8df\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudio.inf_amd64_fe5b23ea7991a359\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\printqueue.inf_amd64_12d9f43eb5d02987\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TLS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nulhprs8.inf_amd64_e65ae5a38cb839e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_0e2452f597790e95\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4456-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral2/memory/4456-6535-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral2/memory/4456-11227-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-400.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteMedTile.scale-150.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30_altform-unplated.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\logo.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookPromoTile.scale-200.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\SmallTile.scale-125.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-150.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-16.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.scale-125.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-150_contrast-white.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-36_altform-unplated.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-unplated_contrast-white.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-60.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\LargeTile.scale-125.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line_2x.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyShare.scale-150.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-256_altform-unplated.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\LargeTile.scale-125.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\191.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-400.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\THMBNAIL.PNG	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\YahooPromoTile.scale-200.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-64.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\NoiseAsset_256x256_PNG.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-125.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-125.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\EmptyStoryCover.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-20.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarLargeTile.scale-100.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-125_contrast-white.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_contrast-black.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WorldClockSmallTile.contrast-white_scale-100.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarLargeTile.scale-125.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSplashScreen.scale-125.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\complete.contrast-white.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72_contrast-black.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Tented\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-48_altform-lightunplated.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\LargeTile.scale-200.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72_contrast-white.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_memory.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ab2aaf66f38aef7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cloudstore_31bf3856ad364e35_10.0.19041.153_none_9a7584eea3d02b53\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.build.con..sion.v3.5.resources_b03f5f7f11d50a3a_10.0.19041.1_de-de_1c0aa37fdf72b38f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-30_altform-unplated.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-themeui.resources_31bf3856ad364e35_10.0.19041.1_es-es_5e0539a5419440f5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..nkobjcore.resources_31bf3856ad364e35_10.0.19041.1_es-es_0d9992615fe6021f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-c..shandlers.resources_31bf3856ad364e35_10.0.19041.1_de-de_c4b30516e0238236\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.appv.appvclientcomconsumer_31bf3856ad364e35_10.0.19041.1_none_222586830800832e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-onecore-pnp-devicemanagement_31bf3856ad364e35_10.0.19041.1151_none_c285b519477e2f35\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..utils-dll.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_8a1e4c94c80b64f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_nete1e3e.inf_31bf3856ad364e35_10.0.19041.1_none_013962e05f5ca163\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windows-id-connecte..t-provider-wlidprov_31bf3856ad364e35_10.0.19041.264_none_1d6394f3e1a75de8\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-g..in-appmgr.resources_31bf3856ad364e35_10.0.19041.1_it-it_2e7c0328525280a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-sxs.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_ee2672da5fc760e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.19041.1_none_77274ce3b079d8f5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-f...appxmain.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_a8c7c937a9b4bf97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-n..35cdfcomp.resources_31bf3856ad364e35_10.0.19041.1_es-es_a901627f7a5b1ffe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\SIMLockToast.scale-400_contrast-white.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_4af51f0b7c3f8044\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Design\3.5.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\IdentityCRL\WLive48x48.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_10.0.19041.1202_none_86f1a64ecc40a477\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cng_31bf3856ad364e35_10.0.19041.264_none_86ccc606b9fe4762\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_usbser.inf_31bf3856ad364e35_10.0.19041.1202_none_11c19bf5388cd12f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square71x71Logo.scale-200.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-ie-vgx_31bf3856ad364e35_11.0.19041.746_none_b2c9d4a6b8a162fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Windows Hardware Remove.wav	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\Square44x44Logo.targetsize-24.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..owershell.resources_31bf3856ad364e35_10.0.19041.1_es-es_ec5e747915e7182b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-powershell-sip_31bf3856ad364e35_10.0.19041.546_none_50bc923095e2d4f6\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.0.19041.1_none_de12db77684616c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars49.contrast-black_scale-200.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..pprovider.resources_31bf3856ad364e35_10.0.19041.1_de-de_99249eb77b7755b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ettingshandlers-pen_31bf3856ad364e35_10.0.19041.746_none_b5db20c677eadbd4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.web.routing_31bf3856ad364e35_4.0.15805.0_none_c1f4fd9c924ee146\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_fdwsd_31bf3856ad364e35_10.0.19041.746_none_65f678925555df55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-stobject_31bf3856ad364e35_10.0.19041.964_none_32594e47e8be0ae8\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-iis-powershellcommands_31bf3856ad364e35_10.0.19041.964_none_7aeba1bb18a19bf5\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\Assets\SplashScreen.contrast-black_scale-100.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netlldp.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_894e930441677cd7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_circlass.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ee87c6e27c63e82\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..in.deploy.resources_31bf3856ad364e35_10.0.19041.1_de-de_b72ceae7b5436a86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ompat-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_1ea6184230ef3b88\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.19041.1_none_65637d0d99e451f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..sh-helper.resources_31bf3856ad364e35_10.0.19041.1_en-us_a38d7bfae8bfcdba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.746_none_915a78ef54321214\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-onecore-n..bilenetworking-core_31bf3856ad364e35_10.0.19041.1_none_f646dbe4894a86b1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\MediumTile.scale-150.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_whyperkbd.inf_31bf3856ad364e35_10.0.19041.1_none_8a6620005875ccc5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mmres.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_dceab94961467f1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-nlasvc_31bf3856ad364e35_10.0.19041.1151_none_dc560ad6c013e621\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-o..tend-apis.resources_31bf3856ad364e35_10.0.19041.1_es-es_55a09501fcb42814\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_c_swdevice.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_2c528fd7176b0948\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.19041.1_de-de_eed48f384a295479\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-credprovhelper-library_31bf3856ad364e35_10.0.19041.1_none_d1fa919de9f4e874\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_c_firmware.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_23c5286f435fc257\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_c_fshsm.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_15dce1b77cd66bb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mfds_31bf3856ad364e35_10.0.19041.906_none_83b2e84f7c2bdfaf\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Windows Shutdown.wav	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Context.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..in.assets.searchapp_31bf3856ad364e35_10.0.19041.1_none_501fda1ac26a3cf4\SplashScreen.contrast-white_scale-140.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.activities.d..nstancing.resources_31bf3856ad364e35_4.0.15805.0_es-es_02028137a86e349a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-rasrtutils_31bf3856ad364e35_10.0.19041.1266_none_8c3011e8d40ca7c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\l81BIMUhkx6s92b.exe,0"	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\shell\open\command	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\shell	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\DefaultIcon	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\ = "CRYPTED!"	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\shell\open	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\l81BIMUhkx6s92b.exe"	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "HEINWUGFDQLEDIM"	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
f8be2c2dee42d03dae47e122f65d9247

SHA1
6c6189cee8d2d70c2438236c6c7ab078df43ebc6

SHA256
524be05bd5de10c772723ab18b26cc3002d80eabe033562f517b64b4f52873b1

SHA512
c49e68cf2453d2d70c05f69494767dcf0b822af0c22201a57df57851e6106a335a5ec5a778ba8e8325aee0fbac7f998188d1e709f89bcc3a379f231b36acd493

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
9059429341568a2905aebac5b192e128

SHA1
3aba90281466a3b8138d7171040f73444fa7d723

SHA256
b71ee61f093f721e7dc47d95de523c73922dfbfad65128945a836b1519fa5353

SHA512
25aa5bb95bede2814267821c2c74f48fadb247d8d210d6867d93d2e21c30456c17d4b9a990a0059c12c7a2cd380af239cb60992223c95bb7119e44ed144acff1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
057343e93830fb09c8af68e015d38663

SHA1
e1efc2cd9bdcdfb8cc06090bfb964bf254b7c0d8

SHA256
c780da82b6b6086ba12c4da569aa5a26205352858d99d1c9d52032e4c169902a

SHA512
b182424eb76d3c85cb7143c091efc55b5e1f68d86de4223e3e2a48474159511254e3fe6a18a63e3e1f40513da74393028f8f36907138e42290008e78f62cd50b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
a4991a1b5fbec7053f11aec3f23ae984

SHA1
426b0c9bd6b7edc467c0e2568d4a27702d30a948

SHA256
bb257311b7b9365dcd8582f6dd9c7f162bdd3dc7c923246aba620ce12bd6aa06

SHA512
ad8388b690fff10d28e206b6035c77dac2c0e84519100808916f4d105bf99ee6638cfc10ca4c8b6e980cc5eeabdd2ff65eaaa18b16188162d87cb9abbfc17e70

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
21d589e1c2e9064b78879e9b0c93c510

SHA1
01ad6d5b5aa99c1be16d4284d981d2380fb7adbe

SHA256
c16b03fadae086f3452763809e5c78c867580dc3cd4f41a835415722e95e9902

SHA512
b88e399ab84b1b5988c6b47d831447e632e05429136a80095afa2a0073cd99cc412187735e1f5fc8e28a3ad7b00b467059f15a61d1ccfbee368ba09a2a21cf56

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
2e166dde2a7a5f9b0e5747339f677411

SHA1
03c16b01b76df3895679255f94d97ab1e9385cf4

SHA256
930cd7e9895e9df6172514af79be4f4fe08d532ff127ca30dd5011f74d3c3cea

SHA512
887390d4483389ddc661d00a0cad107f46789cf0a86c8576f629043fb3463dada6c38b8fb3f7756fc522ba3b4c3e60971d91be757a1d7086b0b6f809002d7be7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
9964ce7a599244726e3c5adf76b60555

SHA1
e3e9ac557e3315124de1eff8f6ba31b97d2e0fa5

SHA256
90eb74e2316559115bac5274bba0bec70aa82ba27f46f9c756c9e433e411494c

SHA512
7c0a30a2cc915084abda3ec4036e669b7ee41f99c725f96d8f55dce14f880c9c29619bc61cb97b90d3dd42c8298d7d8f6ec0675533006374740d210916824508

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
7ed4b35a9424ace7de01a37e58309a4c

SHA1
22a70f6893b9d3c87def4a670d1ea3c5f23086bd

SHA256
d97ad0fc41d45b66bcaf9e231c9df2c5aff89868fede5ff52175beba4e882993

SHA512
f8a132c41d30da8c6cb17b02e6cdbfa627400fdf9f7191ef3cf689e7c8af0a63cd8c37b610ae7dcb863f1b7bafe44ba6a60a9040073e7a41b14521683adf8f76

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
970b80fbd37c2254f4634f334cd7e868

SHA1
b50500e6b0663ccf52f1b3c2c3aa0fffb0708f42

SHA256
c93b21c5131ca4f2e4a87387aff8155712ea7e662f7f12a9a4dd92cba8a7851d

SHA512
d6dcbe173c2b66ae3b1ca437dba7e6abb8e9abe5f6d9900da2ad2daaaaed22a7d6ada07bcf82505de84a81c7c2875fa0041d093da169a2f82f325538a24de61a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
d038701a239cee97ed6aa146274e71ff

SHA1
238d535fa762cecfe672808666572b0dbb5c6717

SHA256
6f8b226de25b23642f1d6d6a1a0c64a9f36bfc326382b4abed04f1db0808e0ea

SHA512
3798af351e330ab03c66717f0dfb8075f8d6396d52e4837c713bd5e56dfec44fcbd570b46567f59422da0baaace6f75bc2ac824489c90f76a4692925a4696b56

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
aca63f83229f9081559c18b32e711a05

SHA1
4fecdabc12a23da80b8ec4447ebb0fe55aff3c39

SHA256
935c3b10675ce20f0c7f1346c1615a8379683509eb97558e95c572126a90cc6e

SHA512
1c65483d2be616c067ef419ee05302adad22e73ccd80d02a6d3fe5210a8e64db995a213b5d3031edc6516cdb1101c2d16f61daf3315a5125463956763629621f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
dbb7698e82e5272eba03064cb66eee98

SHA1
eecec28a0257b32cbfb2ff2cfe982ba736cdd89c

SHA256
11672bc39acd287f36558d762c4cddd0ccbac4a1c5528a5e0c1642470e034f02

SHA512
90f11814fa4ea1b83c26131ae738edf5a35bd803636ef5b44f71346f606a5ec552e901c82aef9a16a072ed785b204f47bc516c64da86c5c5ea898e7c1fa90f7e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
7d7c38b8a0085d0935a419485fb2dfa5

SHA1
4540cf5935ddb2693f7bff2099a6420d30e5f7ca

SHA256
97080d2afc37bfc450d303d2483abfce1aaad5bb032a20ec0236d50404c2ea98

SHA512
08da4ce89e537eaab0302f930281b51f36045d2ccc505adef61853128374183b78c0221a4b59094bb19a63ade59142db351f0f03bc4fad35baaef0fd4022b539

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
e9448f9137648df31a1ebbb8d6c5acdd

SHA1
ba4ca13c57b335913d89317f96bc63dd10ca52a7

SHA256
b578863c53d6d1b8a93d7c3cc04f2c579905d18a4b8ef3337b67b9acef63208e

SHA512
092b986e12e686e76405fba4a74e9a3a768c9eeac06a3f4992b1ea745008da3fb0c92210fb374ad6c0b14fe084ed9535e8def411b615de4de2608fb56c06bf52

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
7b4351bb7f5dde385b0edba678249f3f

SHA1
07ccdd687aae2ef379266e47a9ae0abf0492a768

SHA256
4cc71ddec867b1499ebf1ec3ad814626aed517335294d394a7d016576f1c3c04

SHA512
3562c431d6b9f18d4fe8547082844a418526ba20320b7e2e5ab6e17a403d4194ee650f430a7c81f2ee132cbae2df2255adc457ed58d54109bbfb71e8d8fbea8b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
4de35e9b25fc706a6bae3c2c534d5db4

SHA1
4ad2c6114b96c9578fe0175aa710fbcefe1f3164

SHA256
c51d84cd576c50edf97f586a5a09164859ea8e294d30128fc10d592f6215b38b

SHA512
e75508d6527656753047fbc894161a3deeaf20f610df6f94bdbf807f3eb4d9d589389e667954b06ece3d1fbb3d85b408689d60bd7971897346bb8d1fde13750d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
9e54c69584953daff9dc3fb9be1047d4

SHA1
9af008d76a3aabd77bb408cf43482229f76c12ba

SHA256
0e08cb1dc193bbd0c49a4d856e931328353bdaef645bd99cc660c6d2040c9d51

SHA512
8b9630d3276791f0baec5f9ff0a5ec43164f15e8c904aa4b6dde7fe87bbdc64b6e8070068afb61bf5db53f0302755931fb486e0c356d32ca244d212b41db7090

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
ff247788fa682a03d8f13c633a82989e

SHA1
6299af818106174145939bfaff28d843863ea462

SHA256
b4446d2f5a81bd71c76c63bbe90c9bd1cd4427c12544c521d2b0adb68fb2cc76

SHA512
8c181d4a256198edabc9284d0793578e6024121e9a9bc5e971e1bb01744b3ba1aa8bd669e5a99e63b6a8c892a8293f3859a0e30e673477eeb6706d5a036b8364

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
763f797721099c685dfbf35dc734225c

SHA1
ee2f16dcb569a1084f65bd4e4a6dd31a158e8b32

SHA256
f65cc9b2461724f778709e4feb8526a6b82d0bf0318d02743eb2decae43c3296

SHA512
756fc2bc2dfd94278517189b80863c71f9f2e89e9d47378c7872da393da7fd8cff47ddadfddf3663d30491f7e3a5e7f53f417daa56286c50340a96df550ace0b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
2711b8422ae74304cc093f1297f7c6db

SHA1
93a3533df9e4facc39b4200e90bf46235e298973

SHA256
ad39aa2b17a84664295167af7d788c2a2ce19553e5fd59f338710751caf3e401

SHA512
f980e3da95a1cca86b16713d54088104d0dc0550c9576d7e69c89ef1d52d5158b8be76b39ecea74e62736762f9119477dba92c209b07487cc5b7df7a5cb32b5f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
327f9c45b6c42cace226d40abe1a348e

SHA1
1feb6fd751f070b1cf526773f02751242e48cdc5

SHA256
9bfcf50a3933218392d0dae85e781ae60901d57eaf85a61a472ddf6c403d46e2

SHA512
cc6a15083b37425a8dcf24b4a52bdc370859e7c52530be175b7aad1de7c39bfa4b45515a924a806289096207169a1bbcc3c50039e4f6843664ff70a710624821

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
1a98447120cf845649f7ac57c1ef854b

SHA1
732e760d673cc8a4b626ed96709fc6687e563a67

SHA256
4fbbcb8e747ce47bc72705b4dd2d0fae0c620076327b095e02e79af9c68c08d1

SHA512
8c6c18d897d15e94cbcc4b4cf5d4a693a7b045e58dbbce08c25a2b9c71c5eb228389a0ec778f6448c485a66d94f038389eab4b974270898c946ae16868f1d616

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif

Filesize
19KB

MD5
0e298f01579a142563241248e9c2595f

SHA1
0a22c9923f8cc705dd2dca0a70cb98e77c547ba0

SHA256
3f16749f91b20930af7451ece95d09bceb646820a8f428dc57febbaf75e526d3

SHA512
4226f8953264e0cc56d96688282a6faaeb85cc22c8848a3a86d191acea55003ba9e333a14f94bd6ca852c6789d3432a8863180750d002279cba618753973f4dc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
9f07ee1f9081ebcc4af379ddf508a32b

SHA1
fc25f78dcca171baccd7f1d986c58b660f2219ca

SHA256
53ebd8089b3ee0732166bf5cd3edd7dfda91a321f9fab21c2af65ce7b8813234

SHA512
c49004dbc23ce0c6b18559eb3980ce13c5ff58783faf9a68f3da416979357b692e1e2a47a1bba1bc90f661c29fb023d16905776785667a85d83df6a5eae5fcd5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
bff331eb35b03abbf21fd5e62d1f3a3e

SHA1
8d589ac37ca748212715b40cff12058f50402155

SHA256
58108730957eed9c95162e21dbe4df69fb477001b06dd1dbeddb64de7d0ebb29

SHA512
5c84f2d1cb462af277021684872f31cc62a965256da23c8e417a1058328c86f81e4b7e611d72321fbae36db00661b8d1a00a41bf4444afceaaffedcc29e782ee

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
e21243fa4dbe5a4a15359ff95833bb05

SHA1
5a37ab6386f09737e0e0768d82fff0c913b09baa

SHA256
7d96f75fa7111a137e6a45c62bc65ed9da367d80b694f7e864fce5ea1fef7d54

SHA512
62050618b80d7b26b2b453e0abf8a1212dc09e5cb1930d11d37986df2960fcc48016d59fa44e88d2bd91503b30b63560b4c833621b7793752e9e6d7c39321fe2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
572f026d58b10381ce538ab2449d32a8

SHA1
8e27b0606bd2b60787c6dfc063bb7054cf6d5306

SHA256
6cbe219345f3a4bf8d1a98e1f168e7169fcd6a6f3b2376c25ec5656aaa31c122

SHA512
530c55e870ed9ca02b8fb6283bdb33616270793928a761cbf4c5fd52d7ee06d0e5c3d6a4397c6eb428f593b7a072216c0a7434ec2d83843b19f6f4f29485a44e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
e441efd1a0986c79c6bd2f30e27de5df

SHA1
95d41c7f73704f5148c22186ad673d08e68e7de1

SHA256
020520d922936ed1f9f729406543408b0de4b7459607e11d3c9fc08b3e138c22

SHA512
e31fb7f678a050404f45f2cdb888ccd8ccc2ec2ff184cca8acab20604be2a76d49cdaf7d60861872cd81d8bc0ebab66ea26e9f6ad69b8d33ee457be1dddf982c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
c6149c9841ef531553c5c271dd147640

SHA1
c3acda32d02cf3e9e42a793a076e3d7e89a91ce8

SHA256
01d31901e294fdb11d0001b0cd1902eabf2471f11653c670922354b48bef174f

SHA512
4bf5ffba998c9cf361f99f11b3d711b1f1c38aa57554f67d547967d0896dd2c6f96b4cd616c79f42aaea456a61c1e9ad0cfc42010d35d43eabe261aa8c1d0fdd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
4e42ba4528f9b5e6ae9311f0d5242991

SHA1
08c51d83536e63d8b016d270c346f33700d6edec

SHA256
88e724174bd06085b9ec591193173dd6ab73b4d3f3eb68cc78a56910d5a20b76

SHA512
46b85f9b3319ffc9f6cce87abce5b53bbc5b50b782341f7e6323dfb13cfb879d95f746eadd6025ecd06f5c2f4936f3ec97b3caa253b0375c2369cc0566e4a039

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
9c512cb63aa64a0c71b29f7c16ee74d4

SHA1
396d8b7a95367d627e845036c1dba691a9aa8bc6

SHA256
9241e7840d3e322757635370e333d325ab3b6843330d22f1a1512d48eb0748fc

SHA512
28a37c18cbbd462280ecfee06b0124cdacc370ccc924aadf3df099fdede3db41735209d527d2f60d10d040468e4c10dd5b722dd304729e42995c0584b1226d6c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
87138cb1ffb22b54366ee840965a6008

SHA1
d47dee23dff7210d9e0dd8a7d203a88fff590a12

SHA256
b7279745d250dcbaf2b1d374ffdf85f1c9ce85d74fb07a4c9ca6a5656c8d7bcb

SHA512
fff7ff1d37aef64327e7c41b2d8d65f9614d8450418efbe25ae54d84f9f7da4fbeac6efffc767056c0454b4a4ae6960e6461152a28d09a5edcaa00c8e882d66f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
b74a2f7aa1197d67f49c2546ef2b9862

SHA1
7d149fc1c1c45021b1f91a38ac8069c11c2091c4

SHA256
23435410169ec6b0f335262009c66fbeddcfbda19cf9ba235ae9aeead53df363

SHA512
d6a1eeaacc329e9fa95fa00ecc114003c5c276c43cc92ee61e856fc6b926598e4135cbc61b2b2311b6960b01f95124ae245679fcffb06af9ab5d0721db6fec40

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
53f9825d68b4e98a862653d0f7d06d17

SHA1
d2c293fbb18621fa375576cbe924cce08100e5ef

SHA256
6fad0e186954d3f051036ee9424490db839afdfa10e542d5a988d2cd1d6ddf2a

SHA512
c4151417af3ef772e7655d162a2ad2520729f1c2b3d2cadba32762c8a80b009b42d56dea7a055f1f8c42eedd070dd061c85243cf5397d99298b50e9b7dde1293

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
b7a3dcac964c9cdcb32889367c3bf6a5

SHA1
8b6d78c320394203449205db65b7ae7bbdf7a8cf

SHA256
333b3504a60e496ef368804a1aea0d2a1792069d92210425edabf75d0acee342

SHA512
2d89c9968722c2feea5f9e02f39cd50cc207a5a90201bae309b8f8821ed6f797788a6129e249420bab603f3079fdafb39388a2a0752a29e40a550cb92bb35897

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
d4bec7f746b45164e7c1ece8fa900247

SHA1
fd1fb2a1e41bcecb0a579d4a430266024c8a4ff3

SHA256
f685b1f6ed9cb2c2398e328363eb87ad01aaf44c46b8b9c29c1d54a773b93f28

SHA512
a79b2629b83ed7b0f16393a02b26330f28f500860dd1b028b3114ec5fd870a0d1903e8ecac8f96854dda1e5dec5a0d7081d9d0ce694dbd4ddc4499b215e03da2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
0c9eda21f6c6f49147cd854d80e78c60

SHA1
b0524ba555016abea2ce5b8a755ba7a574c2b5db

SHA256
c17d0fcebe4ab23bcd468418af14bca0fd731f389c0d7a3d2be0147e7bef3bbb

SHA512
e7008468b613a3412771575730bd63f5122232e8beca23febb20cc6e450f09b40aa33c2449e7e787421b83b590d234e384251e0459b34a0738df1e477ea7043f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
c70432542f411f5aabda7ca61cd70711

SHA1
e4fbbd67fd20358040976f6b6a4f01f849d7131f

SHA256
c82c293a80d6b9cfb98b8953ddcfa1612a51351c3788b0943251c18d320a882c

SHA512
a3cb6a5c72a8002c7e7056f306779551195bafdcab5e90c18859862bd6702c3e7b94b0a6915d5894d84c7d25b0adaea2215a90bc7cf8b5ac67282506cc91282a

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
c2b82ec70bdea4324fc4dfa9f40bec49

SHA1
30fd2820e08865f520a7c7239c58be42b9d614c0

SHA256
9b8a78bddca0e2eeb39f9b86c7fd3536aad5b2a910e0ed6fea2123215ef4a8a0

SHA512
c1d51af4b4495c44b32f4fee999b30faac7c83376c4ef88e78f274f6c6f3f2e1eb29460aba8a4f097a54e3055eb4cc6bf38ee3b2763523302ff75166046f75e3

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
721B

MD5
88ea7ff802627f22e5ab0bd38ff32481

SHA1
b800121671ec35e864c6c1e35bbf1cce1679d23f

SHA256
a873697e74602fec75c20846c0fd0c4778369ff9e2d02cfcb89e657b4addc1c6

SHA512
0f8ddde276aae0865c64899afbd893936c2dcfccded526a600f4a743a86c9fc1697a1c15ddd4dec83aed32d8a7884c5e5ab8274868543802c3d21ce04d9535c9

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
933a5c7645e84b4f52025da492cd70d9

SHA1
37eda4e9ac960cd5974157c97398d70640496d85

SHA256
2dcf364085deeace7b11e4a438f30bb6196dadc8c579fc88b19b1eba55769053

SHA512
5b916ef871f51639b3b055690c2a8d11e790170b5242ab591edae0ac042634b4eaefcd4758c1775c54d1ef5b59baf82e7faa85fe1e5189751f88568dc6f99a80

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
5ab089f30ca51fcfe1240d7f82a14fc5

SHA1
515df287f4a7ad1cd21b92c92e13d8eacd7fefd3

SHA256
6c4af2b920b3a9f15e1ecdda98410ba469d30d2a825f544dc6adb6e37f3c896b

SHA512
cd3ccc13fc93cea7b32abfb81208acdc652741b93fd512193db06168a15e90167d47c6e3b3dfc801b34f46579e8c5e6e2e2528bb4bdd6cb0d951515f51be3f55

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
db8c6a4b2b0e341b220961566d399b8d

SHA1
0bf86951326d89a41b439e46dd19d89d4f189a6b

SHA256
e9c530eb2e0af0fc8098be816fbfcc20c653b72f14d7c5a279043e6815551e1f

SHA512
8b0b533ddcdf1817e5c4ed893a20551b11d202104b5b8853f4d8c8a6b07fd9aeb71397df4bb08e59dd5c1a5881cd2548ef6c477e0db9424d3ff33c1cd1d547cb

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
55057193019c4b6c0876db20533dfaa2

SHA1
8e425b14ec5f4050948819e898708ce1aa4733d5

SHA256
40a6d9a1570281b95935c3aef015473979f71ea8e7943f9456d313d066f2c489

SHA512
654da061d12916a33a68a005d23b8c8fe9d68695ff869efb2c9b640eb7ef2c73301e29c2d96304059941d7b37634a5820bbc714272ef043e9ab9473c557d0a44

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
86595add752215d0b6385e1659eb2e62

SHA1
c9d17a34cda5411087f3a2576dd48339871ded94

SHA256
7e7974cf20530e8ca7d9ae6220ba76282a42157a2af8736d19ba53c92dcf2a53

SHA512
3a52abf5477836181dce74ae5e014b3fabd80ebe8e9b5f8d6714a0aeb432ffae5c5fb5669bbfe3b5282c897d28cbb08fcdefa784fd4d095868f4752f34b6a0bd

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
4fc84869ce5c3373165edac282c5839a

SHA1
0f9d3e28a3bcad1b73f36f4eaad26c175df90a99

SHA256
b569caab8bf05c76de5b7c1b05017bb9ec5f351bf4872c8a5092afd09c82b479

SHA512
349889f15c64345a492e3e31ebcd38d39b94a17e0d715e3609b712e7a3c98620117ae5020c388f67a0d74173d78ffc6ed6b30b45ca492e2fdf75b3f979c3dd36

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
f6f5db8a4195fc2b73cb4cfa4e750a4d

SHA1
cf93506ba61009a409d3e13bacac11bbcfb5e3eb

SHA256
c50893e6ac63447024a2cb7bd9e4a3516fe180955ab1f96d6779f2d6bdda44cc

SHA512
303f89b9452436496cf778e12b4c75e15ecf18690e9500f6538d8ff73814bf77750cc5c90b97ade6fa784376b4a77464d501c9f793d276cda7d763c6af96b78d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
1321a201f88842e4fe8f0e04c9a470a4

SHA1
dceb258ef31f635dce6df61305d78ccdfcb5d955

SHA256
b4c19c9dda9038166914cd516980ee43b414aa0a2456ca6fbda875444d831b2f

SHA512
7a3f5801dc55c7885a5a5e099a52bbcb889755d5a59a7061ac1caf6769e153d40d82582e1e69a15f9e31b0df869407586944f970681c827d1346c5cfb2c523e4

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
5ca86dda53406e2f710bfec78df0772a

SHA1
f4e14268f49f8c65e5f11713f160175f435a37cd

SHA256
9c1142174af019cdb45c261a24685931bb2f539faf12209cf9136386faa01dc9

SHA512
913f5b9b5c5400cc61f31aa849ee91494c1484d2b348b3ba1d3f69d41b995b10da304735adefa57f3cd8e94621eccc0a86e22c4f7f10a46cea9a71871cc8ab96

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
e8faf85d6b026b5cfb1d5b7f71cb2c2f

SHA1
edf6a40829edbf5a200823db25d7205e4aab20b7

SHA256
3deff7385f26136e605d077497a976845f7e979eeb5b2e74474191d853eb8d0e

SHA512
1dba4ed8a9c4ae1044d2b01d7c86d384851d44d74a097bee403ff1a752a2f4f82c8a3b61501d1a4bf0e4472927d7f916b2c632bebdb5c06237322d6807f27d19

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
323d223fd4b76a7eabcbfca90436112b

SHA1
6f3e828b1808e1d7f7402c851c8e23120cc961b9

SHA256
4921b137bb3d9a6e37865ccb4d94d17cba0bfb1f705a95b3a48b78e4787483d2

SHA512
8dd8582ee3830cd6d1c48523a1d0badac6bd90c522db7ddc290f3109d249eeca80e927be17ba26b49ce7f70638f17338ef1febf4381314c02fb1a206eb006b26

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
28f26c5a4f25b0cb27337a1553d09565

SHA1
d1f95f1c3dc2bc9768a0867f9793826217ff8e62

SHA256
bbf9167fb9b2540699d258fa315fd3ce898525fff12b6f993dc1a877dd2a3587

SHA512
6521664ab88cd3df6a77ec11ba88e0391a949fdc0251cc0bc391b71c0e9858b82b9abdccaf9a08d302c4708bafc5fe8774f3d8e4311584f1739329f998efa168

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
e8bb33994888fa4126059bea57de5746

SHA1
803d4faa2026d2f1ed1a0322a7d730ab2916a81b

SHA256
d0dc4f3b58fa8ad0116310234f48bb0acfd0247e636cabf2d742a9a11d0b08d7

SHA512
cb3602ed24df0ca00896710a0304cc4e2be49be47648d2a598613719579381429998ae8d6017bf4c5c5e7fd7bf38dc58a9469c5b3f1ecc335b1b30c151257c12

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
e18690e01bda2d441e81606a4d7c0563

SHA1
c3d63983a8dd1287b80bbad9d8996ca361a175d2

SHA256
c02570fb89cedad126c518848a71d3f409a998977b7b4956dad85b5bbe7876ec

SHA512
299de25f70845f3fac8dd1235901236bef774b7a4c04fc9ed5a447cafac1260760bc77d54e2b84d366f25aeff8f755487e91890603e3f5b4e16c8a2be5fef6d8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
aea2c498b8369afde02c0f86add989a3

SHA1
1e8614f149519fcef300855a8995fe274aa26825

SHA256
80f36bdc852555dbe5b94588c5d8ee9c676dc176b9b28746a19953dd1b64ca60

SHA512
5e38abd7375efbe68f9bf8388c3d500082910a353f59e454c7a34e973b36898ce21150a296925b8803c84491bd88b78f41c7a58f9899ffb0bbf654d29ea650f1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
220d3ae01edac76c718e2cf898f5ab8c

SHA1
0221513e8c6d9091b4bec71ee91dae1f717b66ba

SHA256
3d2e578c90da151df5109c9281332c6eb52de8465db1822daaf484fcb66afe4f

SHA512
3264545e8eaa8085ebd0960b4bc5908502de7e2ee82d7496e96800c5a7182282e868c0c3b1515bb03c97180fb169e1c74d67014cb83057e5242f97afb122fea8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
12c92a644da9ebcabc6a1b97257e367b

SHA1
51cbe0fd7213429f7331b0175f4c690a74826e25

SHA256
7a71dafe0611b82b4e621262019dc8f24c3bed5c86f730f79551cf8c21537d88

SHA512
5f9ea2cc477345aba477387f4536aee28849a7b9506d1749b8549811d47814bfae1fa7f00074d9ce37d57e05d8eb88a312fa5038370dc023f7a74f449d106b0d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
dc815409d68f1a5917fcf247e40df8b9

SHA1
ce32599f1fe013f33cd1cc93e82a8cd690933d61

SHA256
1784543180897025f48b56611c6e360adb4c2c97cf9eebf28599d1dde7bfc88b

SHA512
baff924c70dc5563e571a8f040446a00ba11399bae7b5d7b2048a638a94c76c6cdc487d98480a0471b696b39a0d5c30b86949c9e609c170b29cfa168bd814944

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
c1051a3517c1929473314181f05f2584

SHA1
a54cb4c95520eb7e2f4213bd4b73e9293161ccf2

SHA256
c21530760d802d5ce9fd09b8d87c92cea0d6237f850c942b895c079f1503a214

SHA512
a5f6948a3c7202f031b7000e3b84d74fc16e23a11b75bd68c8ef8c8cb36d02469b52e1f2294b95897bafb0deaacf000a438f9833f44ea4c125fa5af3dc159959

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
36bccda4c75c3cecfb9ab00ad24a307d

SHA1
abf45f6eee2a03d9720ac750afde43c9ae536c66

SHA256
3817d97cffb78f08642a1154b84b1fe5702feeac79147d51f7d8126598fc68f0

SHA512
109b8f2254f07173ac26dc375b16e52e9174e65d42617e8ee4a0590f46bc5988d7ac2f8c05cf864ee9099a54ca9661a278406f9e8c5945cb6ef336035bc4c247

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
f5333d4548f95fa80b55f8f5056e811b

SHA1
3d17b04b974433d20560c1a77d1bae0dbe2e86f7

SHA256
6bc7e3435714dc967ef636a80113606625101e879981a85e595326cca12d8db3

SHA512
e9a905946da2786b76b0a4e3fbd8ed329989ac35c32cf101c41996f2780348ce168470000effee0c066936a5d591b3afe5b5afb9aca2bfe2bebbb4d8c07d41fc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
187a13e005e0c64d3aeb03b913b58a1e

SHA1
45a31cdfcd96983087e299bb5c2dd86d0b2224df

SHA256
f1603db339195848062bf32630921cb6049bd22cdd95c9e2ffdb3eba5d5cbdf3

SHA512
444822ca869431b0f4f06e2df7d7bb26cdfbddf5e24f703237b6a2988ba23f866784deac3a455b33d3c2b3ef721acb08eb5b5619c9f0aee251f234b331f681df

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
da9fcb4e556dbcd92b7a98356be462f7

SHA1
7eeef01be1aaeffef434a8cf94f67fe9f5bd787f

SHA256
b4c2d0a90041471eed98b6fdd41478533e4eb1651a00093b228628c430e4f2d9

SHA512
1d7f1e9080d5e16aaba581047405ea29cdc7086f8a6c6f3d0f612ef55493ad8d67b8ae716e852e2d6d0d71e04618a009513a2512ed91dee97ae613c0bd34a608

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
c6a601d8ceb76607c91a872df3b1e253

SHA1
a3ae3a10674a1fa2198db2c253f1cc09681dba73

SHA256
2cb4f46cbe28636c5c0a2fcc1c872328334734abbf1732e80549983c7ffd1e44

SHA512
10f6e01a0ae9eff5923710b277997bb930490af94677cb2ad73c3867efe2d92fcea623586b2ec093b027643fb8efc953ebe8efe2059c60e4c64455f9d8adf111

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
8b17217852b352cbb66db8f249e9fd77

SHA1
ed5fa452814e85b44dfb0c5de9110f37f074b31b

SHA256
dff4f765cce7eaaadf314ab793e329c58e9713e62f59bd51ec24f52ba647759b

SHA512
32d5f4eddd818e438ddea78365c77357cd77e9f10b655131d33580f257a5c8755af2808d6e551e3788c6fe4f627395957bc56603cc680eac94a9271b845cad88

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
b63c4f6d3a1b64b37bb41c80f549fd82

SHA1
78d2bb4b4bf2b59277cd98121e6abaee45324308

SHA256
901fa036016267a29567d081fd630f2faec7d2c8f758fb442fed34e6c2b0037b

SHA512
b93d760e53bcf8a7fd2c71f0e4993cbb434f7812b7c407710c267d184168d0aadcb737813fc79da39dfa63958cfe12e252a665929a826dcccd338fd7dae00ec3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
9fcdcaaf6e906755e85d8fb59f3b5910

SHA1
b78b600497458f84dca31ea21d8244dcbf8641bb

SHA256
2d687a610a9105b8456ed27d11074019022abf996edc61407b947f08b68166dd

SHA512
75fec55d91d92159c94e7bc88c6e09c80be6e535d12554183c07beaeb00f0f9a1cf59ae1f3c38d85396b98766bc24bda64722221b660a620608a22948543c11f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
d8f09165a9b4b18c5f228816e5deee9f

SHA1
9e58f76b825317ee43bcfd149f749e627cb049db

SHA256
178e0927cb6ddf490d82967b843ef7e8e4b8839e8367f3992ceb0c9e380a2a6e

SHA512
b4311aa753c5dac7f84d428afc8824ce55e34e3e070ae6d51c0e6eba45a69c56868ffd6563929fde0c2846b41e6d12bc8a21288d142697dd39962fa94d7985d9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
2a650c0f0d8746fd04ed20915df2f9da

SHA1
de3c3b40222f0e298a30353052cefd50e208c90a

SHA256
9ae8f6e8e91e3aab3d87e56fbf0e7ef3ab7ae4cf1c1b7550ca05e79f172c5721

SHA512
1c21e6590f29b7ece7ed7369e1ca61cfd57ff987c97a27cdf6e024ab73060c62ea8fc05ffe76d825b8f739e49d197020e79f36e30b12b3e097ce846baaea5065

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
8b0cd66745b207b3db2a1e05408c0e75

SHA1
b4c751aafcac725dfa207fccb7f4f68483067c82

SHA256
d6be568d6c51a90c83f9edb88ee9036655f9c81e7a3e064368073caf2ac76d69

SHA512
de3dd7d0b885bd2aea6cf278ece8303ecba78e069c6aaad6ef5faf4988f72499c004a748fb831a760098a98c184f6100e3c5322a50307be4508d0e9e6f283df7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
de7a64fda513e38f501d1b7f2ecb20b6

SHA1
93759dad18ce080d69612dc1c618218bbbbd2920

SHA256
f92ba6ea549bbae5ec7b24b43ff7edd288e6cee0044622664cbdcbe8d80c2437

SHA512
918e2d45934045481756b1956d5c685a066435ab3560cc0718f8cec2b26cb361ffff4931ccf3632f9199c29a01a38323d6b155537c094efad4917c16c3b63c48

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
ae83e222d97e1f2384ba9674f73c9c41

SHA1
cd05d9c413e487f7317665c02aadae941b0ae247

SHA256
9d37ce7309ae57e3d9c6ba9e29e8e1ab3570e4ded5712a316c4bad690d2945b4

SHA512
ed2683b476869005fde4430a38065e4666dfe401d4b31df253b23c3d83964cc4d36986be681171d54714b9b8f1d7bea40cd3d1ca837241955521ee2b302c9b3a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
bf27a018acf06ff7889e3430b3a80497

SHA1
9d92f55a28c8f5e4bb99bd0b515b4a079b38e8d0

SHA256
9a241ece21b3ee6856ae0e535e7134f6bbc91a6b42239c3631a2940b5596864b

SHA512
fb314551cb1e932016dc1ab24c73efb2901725e15fe86925cdee27eb16c8e56b5ccc5b16aa8cb9bec4cd324e196dcfac2e3a5c77362c2c83e8792e7d2184d082

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
4f4be18d51bc1ee59124527e227b0804

SHA1
d6b516175b9b1fcd352c406b37dfaf53e15723ca

SHA256
705f863edca529f1ea036566a3170f7855a74f0a782f4a9a7a930d84bc29de11

SHA512
a4ac5d7be1e05c74f7e205548007cd19ae321cfda6fca66148fb109c44cf9c1ab000479460687335c979a94690118de3f8d6302b1658d095f4efa8c26924d8db

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
3bc2302f45260b423996272d8c0e990c

SHA1
0c4ce8a804778f289adaa1534a034a268ecc6b08

SHA256
414638ae51d820e566bcb752cdd8a5b9f003a44cb270eea1b5334c94b8ec4f26

SHA512
a4dcf98eb08127fc01f03348194ae1093fa46f4f7d5f2deac7530a53a9cc0706f2254f20af2b4b78b3bece8ec1764c35601966e5f07709450d18423fda5579b3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
2e94ea8dc387dedf9fb5c9732dc384d9

SHA1
7d95f6343684b39615c8ec003facaf75f9547ea2

SHA256
ccd4de6da79fa7cc5883249786654ff8029068cd067e13b122a3b702e1e40925

SHA512
1aa5c8947fd1e74d7e81b48a21211637bc9dcf400f19918cb863581e18a1305304507afe71365960be2f663f236ce9d4277dfcc088fc6ae19a463e39db683f34

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
f25374ebf49575b9c52fc141145edff9

SHA1
2870f1ed0475a27c02c7549d7d597a8ab606e5f5

SHA256
c65dc22d3d2fe70f5e6dcdc64b40491809699ba94e54c9848f771d2370fc180a

SHA512
4489a1770ad9092b4baa0363d7d653a10797aba8b8af34dfc9965942de9b176ebed489864547995a8f747d96946aaae0620d0b206485618313ed7b99249a4022

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
cd0f0d00e12e830c3b873cb4308c4166

SHA1
e9ac5fc31a16e6e71d2f50a46070688fcc8702d9

SHA256
247894d4ffcbdab82d7b77164fff859674afa4e22be6885ed923abf9088cbe98

SHA512
ae501a1377a63e2f5cf37ec420a9faa9f1d1e6515ab59cba7912f22a0c6b0c5ea1d97738f1e56cb9c7002f4e88bb7e9fdcce349ff2aca9e132738b7f60c2b131

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
53c24e7c9f3ee1e785013ae0909f3559

SHA1
dd6f2e43422acba93fc78140a7ef9332ffc68844

SHA256
cb5fabc726dce37753ac6eacfbcfe13a3c2e799666b64666f3f83409a2d4321e

SHA512
d4f65927770c87070a6e319ba8a02080f2970dbf730c03506bcd0b28a2428bf8d09ef425e4b2d99b051cb8b0ac5b0f72d9d5ecfbed38cc11c4808f1d61430296

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
1d09a2b0d405cc31dde7b117be7890fe

SHA1
bdacb81a88bd247d1036dcd47f5d4ed4cc0b2aae

SHA256
1c1812c2125e0737d239fb4517a5855eeb5138e2ace0a608591e45c016624954

SHA512
9e7f377c96449c07fd25439410870a44fd42c062cb31c99305c9f20effd89905258b03dbf4a6e72cbc58f65139364da41825be0b9429491a16b8dc5621e52d70

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
f023fab9aeef0a851ab717ad380aca9a

SHA1
1da7f66575065c3f0922cc2b8014d2b12684a2df

SHA256
d2acc513f7c4557eafae860093fb3cd04e98c78c62ce953f76b9198929feefda

SHA512
05ac22c514490e42aa935bea3b4f1532b9cc7e45e7fafa9e28ececc66126aca2407f41589a2becedb21ad060691a8205338b6d7d0b82e54d78fc40b3ddac0e86

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
233e32d0b1495f4fc8d51a5b50cfc5fa

SHA1
8ee912ab238f45a074ded7c9eca45a2a35d78e89

SHA256
f81e6b940c6036080d82a1548016a38719b0df88fb1b74aee33d4fdcb7883e10

SHA512
548a98b70b3d06485ba87ca38d0d19ae49811018741cc63268a406731c68415a95dd0df958e9e6de71e73047a73313a0bb5fb0ce650ade2a206e0acdcec099aa

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
4499f58d01544cc0d1d21ae3979cc725

SHA1
20ae3a4788fcaa49edfd11ca1d63cb4124302cb2

SHA256
e73e993b1297f9984d7ba15d9d3f3278743e7a388452896628f93e20ad56f15b

SHA512
1f885370cd80a0a18fce2906d128db8cfe45b680201a8310e58f06feea19f2498e6b93d72eaaa817a7fc6237067a95098f7bd1a65b9c6f71bae4d148a60935cd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
f8c0d1732364029eb4931d84638a6b68

SHA1
471edf373c048e743299b208db0a9a2938254a70

SHA256
f12eef22f58baa8e42bb47b4152cad7e53b7a3585ae52334cea288235773448d

SHA512
e38f44118236b1a8be4586cd1878b38f2af77b3893a8f494da370a7a9cb4943e348de868454ccef9c5a976a6d56f36651d2afee8f46ef478b3f1efcf7c4216d1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670753844819229.txt

Filesize
77KB

MD5
7f383ec9cd09326db98b074c807166a5

SHA1
1ce9f71935eb5733a32ca34c2b655d92240d2457

SHA256
5b6468a0c0528497835aebeb7b04253d82c73b8dd61adbe2183d40025925efd3

SHA512
2804d573372e7da264ec424d5a8cf8f09af5092990aff2fa8c718125f0ac81e6a0482f2e83be0d916221f96dd48ceffdd774b8c39a5189013c6f41add9cfee8d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754404913880.txt

Filesize
47KB

MD5
cdbf85f0a9b143955347ef8a90dd68c8

SHA1
88e9d6653be893241e1d8e190d4006fe2f2579ab

SHA256
f0fc5a84e687326414e55ee1e956f17ae29b746e626e3bc2e077bb617ae90126

SHA512
86f4e5469d037881d214417ee5cc3de935276aaa4443ca837999e632f03b7def08826c07c79a684ae5e898820da5f6bf342b04a3d02a2c75e10544e4938f4dc6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670761474704088.txt

Filesize
63KB

MD5
7b2a7b85b287126b296c8a8946f0c445

SHA1
e42f5f81876ebfbfe9b05278e019960027806e6c

SHA256
73b12a9a85e8bfb239b4d2c7ae3afec934af6151825697cf508eedbbef7327b9

SHA512
d3a35435c87f98a2ca17611ba73e8c77a67eb44071ae003dc78e9f01eebdec01dc087c5ab24897f096ac6c37d0d369e9fdf5a64009f3b37488f7f8a45e0ef0c0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670764101374726.txt

Filesize
74KB

MD5
cffee35687477918ebef9aceaf04c8e5

SHA1
c1d09137cc14593165ca11fd47bb7cd2b2376a36

SHA256
5478800426a8a094cda2906b4f21d66db327a397b26ff89d39040ccbc4d2909b

SHA512
d8b86568f47cc445b160cc7a1e0dabf70872bb925df7571956cb4449b32b8822c42964d11b32f14db7cca695c80ac2e5f984e3b2bb1f0c874e1fec942c699df1

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
580106c66d24ff80a2a589b80a6a6516

SHA1
b9b196766bed1d5fc0b5f45190a5bedfc45af842

SHA256
5c9315a2e1652616eab2911b3956c7c161b4421a1d2d127bdf6ca4f13fe8f504

SHA512
6050137029b7e08ed9633f08171328af350ac4f0392b7dbab58a82be5bb8002a485951cf5fbd6d793d993a9da824c6896e4b23ed6bc0db6bf926a0449e2da260

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
628f0b4765bfb6e3a230c437590b41f9

SHA1
466fa721797a80ef0a6f2da8f18739488cdad0a1

SHA256
67935cb7d52d4f421ddece5765f2f43d96395211d281203b3ed3c616525a100a

SHA512
3a198d29091432579905cf8f679dc293c71f0e330145cf37cd1612d3cfe896efe288f92aebb531901fe1f36507cd80e34e4bcc09814d29cd5ac31cc7d6eb222f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
d615d276969884952ce87c67118a41b9

SHA1
0ad0aec79205408ab57bdaea49c99f0565fa3037

SHA256
d86dbe2af66cea2da74d871eec69b24b002e07a2139f9a6ffd36290221c3e0e3

SHA512
9ef02ad18a3ab27bc9a2984e4e928275c451843945dcbfd8fab319b4dfaa70e00eef263f8e2a9c9b6e515fdd363f359de2d624de0dc649d23ebcf91f8867e886

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
811b4e8a8d5bef2ab9dd1be9c903f5b2

SHA1
59aafd95fc6c200002af76b3bff8c2ddbb506bb2

SHA256
2ceb8ec8b6a939de23d40c408f39abddb9724caf13489271537af019ad7124d8

SHA512
5563be58833113b2885e0a9ea73f51d9693b483ddff60e062edb327b6978541c0385c4b76bdb7fe5bcabca9862ce87a3f448148850652ae8b5ea2ec8c0aadf91

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
e4cb5308b5aefdbac9ee247ce3381bb8

SHA1
5ad7c3d62da38d9140c2172120f711d9cc3d1fe0

SHA256
3a7b2ab7956ef0a5a73df0a12984b11a0c9ac75c69b2bc40b3138677a73d0118

SHA512
b43fe1a025507421de502582fea4ae446261414c590ddad9a75960b912242045ab919d38e0ab04f61cebef24fc25d4ff87f594ec8a3de4d347f0c20bd39aeed7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
8bf81a82cc12a3779f68a519570d8ec0

SHA1
3d4b1312eb2c3632a1b01467c831d58c8e33ecb4

SHA256
63ca86f2dfa706253cbc2ff14ed575d5d106a80cdb062354640c348c55c42c47

SHA512
6c389892fb9ef37799c32a8626b0619836b6b96e9ccf75ef86872649f85870a3a2008b34d5112480372eafb1d44bd3cde16c554d46bcbc00490517a4d5c1d4e8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
53ee969e95afe028440facef2871cc63

SHA1
89d4065c951c0b46473ef97f4dd59dc8d18fecf2

SHA256
f392bb17ad395c842b5cff321a7a739ca3d2a83f12ecc96b4b033043af82b64f

SHA512
def5e148894a6cc433b2cf588a40d9192c26d380704d3d87b19cd2f3430addf8c0f7a4f796e0309cad5ec425ef9c2252c36cf15073c418f9dab8d09c3bc668e5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
597fc4347077ed4316567e5a11fc4fa6

SHA1
f4bfa04dab1d4c429d5e03a77904df5024db58a1

SHA256
2e9a586450da6bee29ae6436613357a248d3e06472f98bce9a835f34aeb380cc

SHA512
b768af3183be5e651d4575df11184d0028c4f9950aa0c2984fa949029ae72907955857209d607d92b3af122bc5a035ee7bdee51e357655e5c0c198e544dce421

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
83e9e928f05d3a8d6ed8be8c38c25da4

SHA1
29b984742af19c72481839aeda41f674fb75c729

SHA256
b69df59d5d4cc434118ab0a9ad33c43b641fe47feac2526700785be4b271387c

SHA512
cbb1cdc61fe34f5e7c4f0ff256f4ace2ffdcf3537d10a57ef89a1340c70e41b0b4a345ebbdb827ab51741e0d25c509a67fde5a184804a6bb83fa7d58b93d6734

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
1a7cf73985099e9d554ad7b09e1a43e2

SHA1
0a6f3999ba1c9716c9b513abb90c494e62e61e53

SHA256
97e6cccce3f5fefa227cff96114dbedc0c5b16b5d3b1b518b4868cb69c4277e4

SHA512
868a51c1a5295b297f8b9554518844d5a3e4a6a2922189c72e319a7003ea74f754577229a9d7d97ef4ac4c9db901f94707de0a9ca29095d7d17bff8bbdf5d413

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
3bd2cb33bb8d59c06961274ad4b1fa59

SHA1
f027ceb3b40cac82c989f29299dfce0fce6fe01b

SHA256
2c64ffdf6a3479e005f5350b9ffb92c412073af5203b44f9252c343300370e9e

SHA512
91200b121ec91019c54047df362e85d9bc25e005511d2006fe4d537f13dae2a872eb3a2d5938578fe199da21f2447baddb1cda107ec9e39e2aa959408ef64010

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
966413d0ca7695f72f1cb83c1aef0511

SHA1
7eac563330afa21627eaf45423a7f7214a41fc05

SHA256
8209ca6ac9457a135baca662c510a5d8f33ee89fe5b93e69f8c18cc42c672511

SHA512
87ef3718ebbee87f02f1448fc8708840842d80b6d936b0a531c9dfb3a823971f74196def41da1577d5b7b41616d68f5b835d35e95d3adbec5c228907238ae808

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
6239c41d3a529020ddb48a97ef950d82

SHA1
b3a3359c5f48321205c348c1da79612e5214c5b3

SHA256
739b98a468758a8982f5fc4972311cc32d8c4a755fa01720aae2fee231ef34af

SHA512
99a48d2004a1169bc31c5f84c77320c666b5dedcf2176826962a8694e33872dee82b54fb2b71a3d17a6490e75f65199b3f414633bded96ffaca60f61ce28d5ab

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
faad4eeddd14f043a91b2aec5770cb78

SHA1
c4d484a54ffce8f5a177c30567be5b913bb2d8fb

SHA256
786e9d80086d2263c6faa92e19ad3acba5fa81c89fb015ecb7b2278e394cf062

SHA512
08ef8141533162cee0e8ae77d1fb56493db2c3f5e5c61b849b5e434a8dcd12dea2e01512f8bdd78f6d3813f2b050c845c6d8be0d59c5ff18e686f5a400c1d3f1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
ee1ecf066fc4be14503a615bb25e3b94

SHA1
1c4419044fdbb1938a24a42bf32ccc416f6c3ee1

SHA256
63b68830541fc6a828c1bda081bd4bc3463629e2280af8dc2cc02dc44114e336

SHA512
456560324604e6ed5e0f29fedfb8735c82576aff831db74cda85e1a40de6e54843741635ab26c8c1a8ae70ac16e7e05d8fff45a342027216989320d3ae55a790

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
787552227978bec2dc9b8602a8d725f0

SHA1
6951c6545809acdd35212b14ca6d30b8381f05d7

SHA256
0d9bb8a961c38e968cbc640fd9fe3c7731b527f3b4bc5cf97768fd98aea60eb5

SHA512
0092f38af9664278495d023e5a22d9757312f1d3e0c97212bfc06e2ad5cda174eec2b69b86e7706cf9519bfe5fd1d349f816313f9736371f809e986e5848b5d7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
0846142707480fc4b4431f1beba76494

SHA1
5199bca70465cae12bfb763651c39c351cb35183

SHA256
040002a4c56ae38fa7bdd88c5b863edf56ee84ba46ce1821968633c65f001301

SHA512
f7869d9f7ecb2560171b26e6d09f75a36905ef05cc5473133aa7bf26926125b60b1ae6e483dee7da5afc832be3d590234e28910e8668bcd2751c84aa24193e82

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
792fbe57687f65326371d50cf6289a66

SHA1
df62e3ad110da0009281522f0c7b3841dc645121

SHA256
dbed30abf2f86986377e6dfc3f0010c1b8e460b8ff2ebd1c558c0a8e706bc65e

SHA512
dabfedb07b97f46cd1b23ea646c85b2aafe5db5803fe9465d7a0ee783a9f2e313faa3194382b2173cac4adc78b21611e9c09df8f90c087d4a1f78d7bfbc462a8

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
6ab46028c5b7fd35c044a9c54d00d750

SHA1
f3a5c0cb690f9b68a5b4d5c71699f072978c0cc1

SHA256
1be819f2c58d17bfa94581ef586568fac01ae2e8fe32f7426818b2076933b48c

SHA512
5c327889e75880fe2432acc96125448471cf336a3d6a5b9b446788fad8d21b25eda5a224f6dca2b85d7f9495a94656dbd82837c6d37c65ca32e8de190e70339f

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
600718c3971427ce6476e439db78f071

SHA1
c3ae356d864d467028a9efad4995692f4841add3

SHA256
3a4576eeabd59361659e35611d85139e705c81ef8221e0936c477b44824ee04a

SHA512
53b20135e9c42a0db75d9b95093be71e9665fc51a13bd558443dabe14d411c48939c45119a855ca7eb16b1c76b4dc11d019011f4f81096275c99fa03059a9d70

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
c235cff47fda09914f708b6430def376

SHA1
fdeb2bc564d98f999e66f5be9cabde2c5de55190

SHA256
f8cba38d5a3b99fb0ef09fc3e68501ad6a87cc06176678a60bb8062b7def688d

SHA512
70cef28cfe498918609d8c0bb389f17878c3cd4ef78f4c70698e525e5a46cd9c39fda84c13a20cdd47e97e2852178b657b7a9bbf80da60c531f96799e6831007

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
737bf813330f14604fcefb2b5bb4ae69

SHA1
ab17a9348664bc9e0b865a02090e0f74f8a523dc

SHA256
666e16c8d09a0dce5857b0bb6fb41251339eab756e083cd75cdfeb2fbf0131f6

SHA512
82e0ec3515b28d7dec09b55f0a2f2ebd89c2764620f98f8a1849a4b3ed8ead0a618b6eb0299777bf41edc75e7e80543b63f691efe63bf32c9a1c881f9b4b4e79

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
b8059cefe653c5408d09570ccd2ecbb1

SHA1
ec864c71a19920a7c417fde7bb545f4d6fa8a49d

SHA256
524771638476f8fb005c5428ad5d5ddbe2805e727e9d340f1d4c2ea3f3283a3b

SHA512
b5629b40642df4b284c74e448d9a4125ec00802a0667a5e760ad1f65fb9043cfdd942be4a017cf6746a21cb5932084a44f48fa98eb90ca60524950189dbb20a4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
a0b420e29dc270752e90734d823407dd

SHA1
59cd4c16b57409b3ec7dafd2d7fb06cc850d75ff

SHA256
1768067df321b296b38c70c390494375beadf7f8e4eb78332dbdc14aa8005b69

SHA512
95d9841d98d59f7a50ba09a15f0c3a171d5baaa49c6a3a341c38bd13e815f6f0d79f0672c4f45f99dacd613322460f9a8e7a0dabb15a6ea063f7a4179c249ee8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
dcdcf522e2ec29e299c1a909ca8bacfc

SHA1
1c475376260f3135618d51d8cdcce55cf0c8a15d

SHA256
75a9430455fd4b1e736611523785d875faf9bf602a8ea533dcb6e2ffbfc57c19

SHA512
9eb7840db11869e6d2e5aed2dc08bc5b8ddbc915d6b1289d400b12ff183238657fbb32f6b079522363d3343aa10b8875801989010b6d2aba5c645ea5e4ae3719

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
2515b0918f80507ff36f766260d8ee12

SHA1
dedd546e834876d2e8db29fbddd0e607528288c6

SHA256
e6cbd9ef19a3258bf43c5eafca0e4e2b2b6c471e15617bcf0fd11c912593754e

SHA512
c321de8c1f3fffe6ba3b8b62756fbb0b9b4043e91e4628401efb0fe2bb61ab102137831a3c6cc7c740fe356b6bd1d5691f71062dc1ea3fa009a2b30212a3a8b9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
14c9aa6f8da3ca190eae077f9599d6be

SHA1
6d6c0c8457afbba129b3b4bf6607bb211dad350f

SHA256
a916b8c9dfb21879b4e45af3de42b2019051b544bd681863e8292fd293ad1433

SHA512
8ad6e2a7c1373cca2f1fc120ce9eba8f754914c2fbacbff3677ac70736bebe1319be585c7f9b6e27041c77fe4085e65e319d8d5f1ba2ce260896e4e4dae246a3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
621f8546ebdf039fae2ba0fcf4e182ef

SHA1
36e1109329bd59ec7aa74b7be071ba7d91fb2cd8

SHA256
3e7391335fa60a713f588b1f489ee767b1824a9be976e889d84f2689bd5ee0b8

SHA512
e8a46e808f73a3158eb450bd0500ef6b2746790c553b37ebfb7c23f0ab11f131ec62ce63f1f74aa1a95813e212100adde08104f26496c6047420ca5985829bcb

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
999e53322311feefc9520676d4c867a4

SHA1
9dddeea43e7afad278f5996fc9b89badf1c768cd

SHA256
c7e128940b10814a7f0177a3bc7aa5515606aad26f3b809f6661e9636869deb3

SHA512
65b7ffbf396bd70260df61aa7707817be27fd2dca9a040a9854c3bf2718c4a9abbdb226bf342e79adf6765a34cbd366ec06db9fa1611bb929229daa0f0894d52

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
a078362e7bd7c19fc046bdad9a5b0ddd

SHA1
43efe62b5b080a2e779a2d208fa83803aac18345

SHA256
37cc490b40315268cec733d6411077a4d9ecffc01c34a0f555418548ed7d903c

SHA512
0c7ef7297587f302b54d84d5cef3f87783b5ed0cb4f674449c9c86898167f464d0729d3b87530bc16ef4696bda660380557a29ce9973a3a8bbec82d77bb5310e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
d89e8ecfcf8b1d836260cce54f8cbacc

SHA1
76b50014da82eb5a509a27dc09bd67e507e51465

SHA256
c2e8d56b25b6667843e46eeaa133b73d479d01d92206fa6bbad60804e0257a0d

SHA512
423d69918cc722aa0c07665a8dcca8b30ea0a1a2958dcee6d1da08e84c8c4791f8d730d29be8346a6fad24716556952faa77c2aee0809ca8afa919b42c182769

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
e985783ebe5c49b852d6ccc4e74383ed

SHA1
dff78873de010c1a5cc8f247bc242d2d3a2b3056

SHA256
a7623788c6c81692bf5506d22dcb235838ebf84f65e7857d347c014f3b80bbf5

SHA512
69cc5eb79e07605382c73175260faeaec48bfad92a969815f17226810c1d9e0abe1926b3ff2f41572f2cb7ba8241e9e7168f365c01f0cbeebbbb2dbdc4c92bed

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
2dd294c46dae846b2580ae0b8dfe097b

SHA1
1a22a20fe325080a7f266d367bce169b82368a61

SHA256
38fc31b559ba20303cd2368d6f86a3d907c711dcc1899d2cba7161c9f7950352

SHA512
4b78e3229b532361352c12f7d7f2b363a2d0eb8f63677300bfabf296ed62176f589abd9f60d83d7ca2e3642b17ee77ec4f3b188eb1e7deef261a285ebd31d0ed

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
3ad665848dd4c59b5724ab68899f0b32

SHA1
aadc05f1e0b5e4f0e2ddc7dda1fc70780fec9d20

SHA256
eb71bd50c0a1f71238fee61541b51e20feb81de90a9b482168fd1d16f04bed2a

SHA512
1920d7a9fc826224089e6af371b5102ec8e0ab7e583d6af274b648c9150d8dac75276574496e4ad381d7e094088c049ac06fc15902464dd1aa0c40e5a6c95f41

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
1960fdf36695c0de09c30d2d9a585800

SHA1
33f6f9122caab76a93e2892df2144cfe651e9479

SHA256
46eca7ec98c46bf6797d2b1d8a197687e81771ef8107ff9b1c2bfe78d923f435

SHA512
13be6995b35cd7a8981fbba85bcb2c6aa96f9be9e7f2bed1d29584801cc64417c94e2b7bb1c07d83ab853a0e47439b4dfa3d0ade629cf3fc2c71e1b809d99a84

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
84b9ed70fb40dca038871f22e55c40e5

SHA1
f271938595f7ce3b91845df5c844bfcad074c0a5

SHA256
b51283bddb3bfe75fa984072aac22bf2878d104a2e0d070c5fa754ad518d4e48

SHA512
afe27559c022eb5a450f9eefae770650d01a042c491bd45ef682c609a4c299f820f7203374ebd8f58fa0553aa1c4683b6c34c65bac09581f62754b648d47bc38

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
0800b754a179032119e486ea9bd8ec70

SHA1
e89466f7b985ff55d59b73dea2900d91ef8b98e4

SHA256
8db1f34cdf0e7b9977b40ba6f9eaba1118c224dce2967f7257e3bcdf6be8d177

SHA512
710853f67e076f1b3b35edcd23c05bfe962515db34a57998e36bda598691311455afb9c0c3ad1cf1de0efa40e5117ff6b763981e4af3200f9bd0a92aa0c7b0da

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
91e90fc66dbc450459da853dedca77a0

SHA1
0e6ed9f45cdc669b0cc0e38120edf263221a25ab

SHA256
491bf242cd2ea17556b9cafe8f1d69a08c3bce9064a5e98e1e24979b833dfe04

SHA512
e73d048c132658b29210a91f20866c0c01303305523d3edda9c471c919fdd5621900d4cb208d6d7de9e398d5e76bcfaad4e61712846d97d0d260df7e43f336f9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
be608e44202403ec460319df48fbe453

SHA1
ebe29f1e7b6e260e2f3f402d93f3b605393ecd99

SHA256
1a05c53d9f18de32736f2b36085df5706f359cbee71ec957f23abe7014324c9f

SHA512
406b573ff48d794bd1df682ae4eff96bbe6a78c2d4bad5d542d57bd5879992aa74ae3f6cad727588b76caf36bd4fb912a1a40ff98d7248cf2f781093941bdab9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
07523a681c26ee847ad37efccf8c8c5a

SHA1
475658ea4102934a6293d2cd118438c1981c9df5

SHA256
ca3e831d3938df2d2c29ddd6159865c4dbbc2985b453bdfdbb261c1a28ef1c3a

SHA512
9457e30802994ebe901853507b2d17f2a5d6b15084062701b5368297fcc19c62bfdd7f4bef01c129aa82d853a84d16c8fd9744d8302ca06ad9d402bae16a0f9d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
eea31dde1312ee6ff4eb5ab1e32c83a6

SHA1
28524735ee1d0a1e6babb57508f7def99f7ea890

SHA256
d30684a634d7a195916bfd3d306fffcc521a36a635959d5de2deaab09263dc9a

SHA512
a7a94e5efa61d0b12696956e5934f277870225d99cd462682fe152de3b72c8f48aeb17a5975f820731e1da54194a75a75adfa544fe011fa2b553e3ebac479166

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
0bcd2ea08ccc550ede3c94ceab348985

SHA1
810e7bce0c18e24633582a7011c428cd63e78cb5

SHA256
89924ba35db5530bd3675f70127cea5cfd438f4cda5c9ed0cde2318e649a2c6c

SHA512
9033418a3923c197504e93b9c8b884f9ce5183249b37de84b6407304165b2bf027bdf9843cb41e08fade0b340b4a3e1ff4b6ab0ee5fcf6610059a66cc424f5e2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
16364631093f75dfe6914498c334304b

SHA1
101f237f779df36756fbd5040a33d6be305107c5

SHA256
d811ad6ee1b3be7f42d76713ba7c4e762695a7d8bd8ae296b5ad17eb0d1423a0

SHA512
aae60ce7af08d5efb002c8e469a6db3426513164e923403d8aa5f757cd6100a7983f565c12a1c746e9f16245e087887778c02bc648181860b759f517f04f2bbd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
bcf3da476a5e1cc5be278597f2584e9f

SHA1
1c2f1b58fa1dad31b2a395698be18a98d322da13

SHA256
6e5670d01b4884ba0c910b5d7f6bbb13ef91f1aea9876b25ac4b2a2cdf3820c9

SHA512
89aad6a737b910fa5dc1d059e9fe1b1eeba6709398dc65f386cfb997edf54f8acfc41d87d905251ce8d4d4a84480ddf34504cc54d5555add59ddaf492cee004b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
33c3440405e3fc8a448d90d7ae4c3c9f

SHA1
1c19eb8b9222be370f6aa9f7efdda11caade5f1e

SHA256
3c037d3732421990c007905032ee77a0b2b115519fb61ff2560b61ecf93aeb8d

SHA512
0af462947b9a85f6c7dc91f8bcd3deb8815f519a8150594dd7293b985c64d5ebedbed59324d20b17e755dd856cc20603b9020df974563b081f7d58b15c02ee6f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
e0e711f56a2a666ef45c4f75432e7060

SHA1
efd91f9ac197d0075bcd3fc223c68b6c57316036

SHA256
dfb1213144663b4d246d18d0ba7bae6cc2b121ca04f294cc3c8c3e45d5ed4dd7

SHA512
2350ac865ef1677bc4c257de2fa8936d0a8a59ed95773dd8ef56a1526d9ce0b69decb650bb4679ddcb0880f1fdd59606e4fb2d567948541eb8908edf90b8d108

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
31816e3a0bcb06d6f5754c35b544c080

SHA1
b86cae02905cb8b8c269a42b4249f0b08b8e49e1

SHA256
2d65c2d8b0bec4f0591fc88b643fd271737aefbdec92f764463a97316a979d54

SHA512
d975b6407a4d71c3e85e681abf43ac5c32cbd45be7a5c0b4f5fbe64129ce4d1615d1fd63a25a7e1d609d7854fa765be0be57551784eeb45043240fe878f7f5de

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
a0c4978c7576d31ab8931ee2aa895909

SHA1
289eeaa132b300b5cfc8a8878681e99ee8c0d108

SHA256
b2c0e9308696d06ff077dcaac14027ae9a5d856c6fe2c996c0a7c81914ffe937

SHA512
d032b8d33b45117acab3d6d60b0452f4fd65048bc4a6dbe200b0757da08b2bde95c11ebc2696fbbf866c00cd8b02f00866e1e0c80cae7e45b79cd40118976a22

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
99177f880f761be0c6cf5692064fc445

SHA1
1ee2718170938c372d8acad53be55cb59a177850

SHA256
354f348b327860d2d09dd8aa40bf62f57d8b848415a923c3323efa60b3ed183a

SHA512
ed2e5ae4dfb96561c97812dea4e0476460b93e978888f3d07ae2dd3abf72c20516e437a3c7660909c92533a52ceb4545e6f5bced30ffd92e7901d093ea415165

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
7c792ed18275723a43dde90ab1972d30

SHA1
c5c6e87819b8deba897a8fe87f13ff4486db67d3

SHA256
23d44a66c86b9ec9026f330fd2ff40c380e9205597553a3ceb30d6f2f2025645

SHA512
05974a5c6f4c3aefedbb9af5cac26c5c3e23713dfb7b966e70c20133ed23b06777f1f63061008bfc4714b336816a48c1220e810abb315ee7249bb625f340b4ab

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
58ffc2c1f62051c379ed0cc7b65cb552

SHA1
7e06fff1b4847b30c2d7b2400830dd175dc63cd6

SHA256
adf40ec0143d07dd8ab19188663df3b9bcfc1d12834fbd6b7916ac8752333a12

SHA512
ebce681e64837d72d1f80cc9241fd81c6463be0e3ad363220a0e693e205682f439f271bb547c1b633ab3ca3cab19ebeb2063dedef24177fba0697e2b99d928f5

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1_none_233543e4fce957ae\Disk Cleanup.lnk

Filesize
1KB

MD5
ed9edb7c6b40dfd490d46f868f496b12

SHA1
d584234c54c0b08880021e7c3165828fab696757

SHA256
5e085f89b91841a19eef2da68da511b169952cf3c3cb928142d36702d2d15316

SHA512
678a47f2edd2a5b95151a74084b05f4f059e5cb0fd8b1c9c9eaeefbef03902eb7bfa6c0791475d66c0b4fcdfcf248bce2bd596ad029e8d508c68d12d3f30470a

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_61cd745a990bcfb3\System Information.lnk

Filesize
1KB

MD5
93802d7810152adf936433e1e15372e2

SHA1
b7d967e3040271a7afe1aa448334659bdabbba61

SHA256
abb9bda6ba47387aee72fb3139b6af5d2c2869e600f006a7e4dfa417959960ab

SHA512
b9d0851af81460d9c690389313cdefe676eec328e55ff1fd4e45aeea0b0686b83eb5abccbadd3415b391a9f5718d4bd4d69ffe7a5a60c4b6847403f21e67a870

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
783d08dc88327e89ffdf2f5e83b3d169

SHA1
33fc4e35f98ae1042a7bb1bcb0bdd0c3bba1c2a4

SHA256
33bcc1183c1f3fe018dad2e912b0115d5b22b3a6461fb3cbcbac7ec5072472c6

SHA512
e5344dde044d85d3282e2669e8465bcd8c97b010eb3f892d1f17b7d8a8577cdefbe543785f738963def2c4e3bc839efc7138dd39129b1180c697b7dc5d16cf4c

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
e11d0c7c340955fa7ab6c6b8a43ecd60

SHA1
3f2fa78bce90f450185b8e17e23bddfef2f9129e

SHA256
601bd5cc9b4b57f0ac23c2d9ad556f4b275bbe971c47935a55db789b8e56446a

SHA512
6fb5ff2c05694f1a8b0ed46c91c64c9bf1a8eb77c9359ed568d4cbe2b643db27f67df062216dbe341b57c982fc0120950363049fdc32acb3a306ff93c8d6d642

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\squaretile-sdk.png

Filesize
501B

MD5
cc732d0bd874a5559714f32366affe1a

SHA1
b1b7b5585059d53f44d8e0dbfc260472ab658c71

SHA256
a836ae986ad1fdf66b57b8f55eac652b146a474835c2c0ee3a6afc945bd60bed

SHA512
3d9324b6ff7f7db2248f609f2364c515e39985e7db154df70926194ea141cc67a8283b8ec91b0c0f71b97476755cd272ab6af1d5b44c37f1b5821c91d18d4890

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
55c082e5c753a3be7704ddf066d0e895

SHA1
ced13c44a19f82b143b033378d601f93b1de3388

SHA256
e45f697a81e1cbd46046a50597ba9af08e1d8311647d62a17402cc418b0f63e8

SHA512
8a7dff042cf53601adb5212f9bc6a21e48de61faf38096def0a733188e22b57d0141a7b2885ab426f76c40c73ed92fb0ef80abf0e469c83a7c14166a6830a0eb

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
c4be1ce9dc39fb83fd5a2d617c2a4837

SHA1
eca34cd429eaf350804bce704d19ea61c74fd54a

SHA256
403a36ada7f7579d09670f9b98e7dafec1c2e1beecc5fd26ee6b5fd0b4f2505c

SHA512
3e736e36954c970143a82baa806fa88a36db812d09c08a6ab4d19a78e6d0fd2c42c6b8e59b62f7f4c3fc7806f5b1d9f30e934b404de6465e9280300b034fd64e

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.19041.746_none_a89acde4afbab635\Math Input Panel.lnk

Filesize
1KB

MD5
276ec9e6ba869a455efa6e97e977871b

SHA1
7d3e8ddf9dff5507c9c12194f35c7be7d1b8bf29

SHA256
9c78adcd23b8f0183cf735c719d7b169f4e07085b3b754f93d8fd198c973f2b5

SHA512
0ef7b57a15544c5fcbef62af237540f881ea27cfe18313e51069743c91290559546f3a1eb1442c349793cc667e2c97ca27dc21bb29ebd665a6d0126964bbc121

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
df15f88bf89706db2988206ccb98ef32

SHA1
bbc487aa93f38bfeef24492ebf8e9fa15401c36d

SHA256
48ccfed9ba25a9ee15b562066f02ac0337a8157f9c4ad126f458eec1be3d9ba3

SHA512
66ae7dd73ae20f2441ce62d1177811cdcf8b6c420659c3b9158f6b652db1cedb6920a2920e629c7fed38247466e3050fa2e880002ef59840dce34f2aca35b924

Download Submit
C:\vcredist2010_x86.log.html

Filesize
81KB

MD5
f8982e222a0bcf16c83698338e9fb411

SHA1
6588f412fa8f984972673e70537c985a47a5ae37

SHA256
68ec8faf5f43fdbe880264c8e3ed5893151b36021d852440e4f8a8b281f0a887

SHA512
4b32780edac92708422b7f2cbfc6f0cdeedeee599ee2c13167bf2c1d57c3660ebd8a8c045aca5599c7fb2df9fe57c54466ff09bdf340c594c5f5df05abb2e079

Download Submit
memory/4456-6535-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4456-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4456-11227-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads