xorist | db6caf0d960158ddea58014c0f62e0ac5c7a5ffc147ff1b71af479324c1aacde

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ebcc0ec24f4f883df0e18c4e81a8b81_JaffaCakes118.exe
Size

906KB
MD5

3ebcc0ec24f4f883df0e18c4e81a8b81
SHA1

490bf7e10ac597d603a66179c6e327bc6b183599
SHA256

db6caf0d960158ddea58014c0f62e0ac5c7a5ffc147ff1b71af479324c1aacde
SHA512

6f71207fbbf669519e13d873659a38a0484152ff9bbc1c7b7e17c0adf0e2bb1b53ecfb061b7ce6e1e0ef15ceb5510a6e2295b9625e77af928a1644075ffc6e52
SSDEEP

768:Yn/J8wMaNCE44lD1USubS3/fP9U5KWpuW+MqjojnVc9uV3:Yn/J8cQYpbnPepuBMqSQI3

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 7 IoCs

resource	yara_rule
behavioral2/memory/5048-6238-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/5048-6237-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/5048-10608-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/5048-10999-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/5048-11326-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/5048-11331-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/5048-11332-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2181) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	abxd.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	3ebcc0ec24f4f883df0e18c4e81a8b81_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe

Executes dropped EXE 1 IoCs

pid	Process
5048	abxd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QmdpTwe5Bw2jy77.exe"	abxd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmgid.inf_amd64_3a0240393de08f95\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_hidclass.inf_amd64_b37df5bd0922aeef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Windows\SysWOW64\SecurityAndMaintenance_Error.png	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdminfot.inf_amd64_564561a23e05c7ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmrock.inf_amd64_9b13bcc1f320d1ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\remoteposdrv.inf_amd64_0f0da968c1cfce06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmati.inf_amd64_16fbf6520a254fad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_avc.inf_amd64_8ee511eb19322856\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl009.inf_amd64_3bab34655afeb7e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\000e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_69b5e0c918eab9a6\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\megasas.inf_amd64_289e18fb610dd883\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MMAgent\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpipmi.inf_amd64_310dc613a7e31ec8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifibus.inf_amd64_f52d5ad58116f6f0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_683fd853c8b8a4db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_9e6bb7a4b7338267\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\halextpl080.inf_amd64_15251233835ef753\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmwhql0.inf_amd64_db80a6e1be3a2d08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mausbhost.inf_amd64_34c86c15777c913b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpi.inf_amd64_605a5cafbbd86f6a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\smrdisk.inf_amd64_f945aad6094163f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wave.inf_amd64_8e8496aa33c0a7f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\audioendpoint.inf_amd64_4fc4a632c1490033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_computer.inf_amd64_aa72c8894a821b32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidcfu.inf_amd64_409fe85a7af72672\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_c089962740ea1f84\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa3.inf_amd64_ff37da248ddd748a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_hfp_hf.inf_amd64_0c00f8f3a465c9a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms014.inf_amd64_faec3fc366f8e1fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tpmvsc.inf_amd64_9b03a5f041e8d2b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\Licenses\neutral\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthmtpenum.inf_amd64_3abc48e730d08fde\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgen.inf_amd64_977aa23dfab87f15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmzyxel.inf_amd64_1edcf626fd489056\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oposdrv.inf_amd64_9090a824ce0d0e68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Engines\TTS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0c0c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b000000023b96-5.dat	upx
behavioral2/memory/5048-8-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/5048-6238-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/5048-6237-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/5048-10608-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/5048-10999-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/5048-11326-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/5048-11331-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/5048-11332-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-36_altform-unplated.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg5_thumb.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\MedTile.scale-200_contrast-white.png	abxd.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\excluded.txt	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Square150x150Logo.scale-150.png	abxd.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sv-SE\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\MobileUpsellImage-dark.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Dark.scale-300.png	abxd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	abxd.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WideTile.scale-125_contrast-white.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\logo.scale-200_contrast-black.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-48_altform-lightunplated.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-20_altform-unplated_contrast-white.png	abxd.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-16.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\2px.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.scale-100_contrast-white.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-20_altform-lightunplated.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\RotateHorizontallyOverlay.png	abxd.exe
File created	C:\Program Files (x86)\Common Files\System\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-48_altform-unplated_contrast-white.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-100.png	abxd.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\SuggestionsService\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-16_altform-lightunplated.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\EmptyVideoProjectCreations_DarkTheme.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-200.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-96.png	abxd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCacheMini.scale-125.png	abxd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\dd_arrow_small.png	abxd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt	abxd.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-400.png	abxd.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-48_altform-unplated.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSmallTile.scale-150.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\FetchingMail.scale-150.png	abxd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Program Files\Common Files\Services\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-black_scale-125.png	abxd.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\WideTile.scale-200.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlOuterCircleHover.png	abxd.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\CHANGELOG.md	abxd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockMedTile.contrast-white_scale-125.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare150x150Logo.scale-125_contrast-black.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-black_scale-100.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-40.png	abxd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome-2x.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_altform-unplated_contrast-white.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-64.png	abxd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png	abxd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cngcredui.resources_31bf3856ad364e35_10.0.19041.1_de-de_b041c00d5e52cc6d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_dual_mdmhay2.inf_31bf3856ad364e35_10.0.19041.1_none_8faaf87975ffc6ed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\msil_system.directoryser..protocols.resources_b03f5f7f11d50a3a_10.0.19041.1_de-de_9b3cd3fa080dce03\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.Shell\Images\Icon_MMXresume.contrast-black_scale-125.png	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..gement-ui.resources_31bf3856ad364e35_10.0.19041.207_en-us_034a758b1fbf3096\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..dataretrievalclient_31bf3856ad364e35_10.0.19041.153_none_a276f5a2021aca33\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cosa-desktop-client_31bf3856ad364e35_10.0.19041.1266_none_51e937c8b7fb1678\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\wow64_fdwsd_31bf3856ad364e35_10.0.19041.746_none_65f678925555df55\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Linq.Parallel\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-iis-httpcachebinaries_31bf3856ad364e35_10.0.19041.1_none_5b6af3f8c790a083\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square71x71Logo.contrast-black_scale-150.png	abxd.exe
File created	C:\Windows\WinSxS\amd64_system.web.abstractions.resources_31bf3856ad364e35_4.0.15805.0_de-de_d35f88f093a4a07b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_10.0.19041.1_en-us_c6383ef34760136a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..outercore.resources_31bf3856ad364e35_10.0.19041.1_it-it_840c823d69f19ad8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..k-transformers-core_31bf3856ad364e35_10.0.19041.1220_none_e0f5f5b98aa564fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\wow64_microsoft.powershel..datautils.resources_31bf3856ad364e35_10.0.19041.1_es-es_61c0d9c8cedf823a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..necoreuap.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_15f50309291d5a92\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dataintegrityscan_31bf3856ad364e35_10.0.19041.1_none_f8da4d31ca450d9f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp-infotech_31bf3856ad364e35_10.0.19041.746_none_def1e232a6ea43df\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\tlserror.htm	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-display.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_8039ba8a2ac82198\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-icm-base.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cbecf1108d53f882\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..ionplugin.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_466b14fa7ed272f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wininethelperclass_31bf3856ad364e35_10.0.19041.746_none_0329353d97fc76a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_security-octagon-enclave_31bf3856ad364e35_10.0.19041.1266_none_c5ebbfd4188c4c8d\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_system.identitymodel.selectors_b77a5c561934e089_4.0.15805.0_none_06f4c9585ec64fb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-fileexplorer-common_31bf3856ad364e35_10.0.19041.1151_none_ec76581f556a7020\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Mobile.Resources\2.0.0.0_es_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..-classext.resources_31bf3856ad364e35_10.0.19041.1_de-de_461026ec4b4014ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\msil_microsoft.powershel..anagement.resources_31bf3856ad364e35_1.0.0.0_ja-jp_01fb500ab71c0c1d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-o..es-fondue.resources_31bf3856ad364e35_10.0.19041.1_en-us_d2680162eda75da0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.19041.1_pl-pl_d9309f5cc8240a4f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-enhancedvideorenderer_31bf3856ad364e35_10.0.19041.546_none_6d9bc4ac2b55c98b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ie-behaviors.resources_31bf3856ad364e35_11.0.19041.1_it-it_9e04654a801ab7a0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_10.0.19041.1_it-it_46f2a11d47bb9cf8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-msmq-admin_31bf3856ad364e35_10.0.19041.1_none_1120739e246c79fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-consolelogon-library_31bf3856ad364e35_10.0.19041.264_none_6336533b85d8e590\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..emsupport.resources_31bf3856ad364e35_10.0.19041.1_en-us_b5da0cd4eeee462b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..ion_service_iassvcs_31bf3856ad364e35_10.0.19041.746_none_c075dca01e8b461b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rasbase-rascustom_31bf3856ad364e35_10.0.19041.1202_none_6dddb24371ed0da6\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.19041.1_none_bae79f374cd70cb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..yoptimization-winrt_31bf3856ad364e35_10.0.19041.1266_none_5437753f697de5a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-refs-v1.resources_31bf3856ad364e35_10.0.19041.1_es-es_01269ff0f751e589\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ineclient.resources_31bf3856ad364e35_10.0.19041.1_en-us_02abb9877c778368\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_59bcd3c7af8c3b35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\HCBlack_Search_TraySearchBox_Glyph_100.png	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.746_none_e72c4ffca9db7315\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..vice-core.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_1a36e4515ffeee77\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..nese-eacommonapijpn_31bf3856ad364e35_10.0.19041.746_none_6fecf6012ef3141e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..lsettings.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_1fe8e4e720e2ce0b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-user32_31bf3856ad364e35_10.0.19041.1202_none_41f8992b2292d6cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\msil_system.data.datasetextensions.resources_b77a5c561934e089_10.0.19041.1_fr-fr_df35d2df1c8e2a82\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-p..g-printticket-win32_31bf3856ad364e35_10.0.19041.746_none_fba89dce325efce1\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-msmq-runtime_31bf3856ad364e35_10.0.19041.746_none_22bc83c4dca24ac0\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1_none_b817dbd29134ec4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-shcore.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_2a4eb43040ddc569\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..namespace.resources_31bf3856ad364e35_10.0.19041.1_en-us_5a98deb20a9a8614\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-help-clientproxy_31bf3856ad364e35_10.0.19041.746_none_ad97f9b3a6e4b201\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..stedsignal-credprov_31bf3856ad364e35_10.0.19041.1_none_8ea8ef13ae7bad36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dafmcp_31bf3856ad364e35_10.0.19041.746_none_3d5e8baf52cfa7f0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.19041.1_none_afb33d8068b0adc0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ndis-tdi-bindingengine_31bf3856ad364e35_10.0.19041.1_none_f405f4e7c4e54d09\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	abxd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ebcc0ec24f4f883df0e18c4e81a8b81_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	abxd.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	abxd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IMNXWSJWGOEPHMV\ = "CRYPTED!"	abxd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IMNXWSJWGOEPHMV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QmdpTwe5Bw2jy77.exe,0"	abxd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IMNXWSJWGOEPHMV\shell\open\command	abxd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IMNXWSJWGOEPHMV\shell	abxd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IMNXWSJWGOEPHMV\shell\open	abxd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "IMNXWSJWGOEPHMV"	abxd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IMNXWSJWGOEPHMV	abxd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IMNXWSJWGOEPHMV\DefaultIcon	abxd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IMNXWSJWGOEPHMV\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QmdpTwe5Bw2jy77.exe"	abxd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 5048	4808	3ebcc0ec24f4f883df0e18c4e81a8b81_JaffaCakes118.exe	85
PID 4808 wrote to memory of 5048	4808	3ebcc0ec24f4f883df0e18c4e81a8b81_JaffaCakes118.exe	85
PID 4808 wrote to memory of 5048	4808	3ebcc0ec24f4f883df0e18c4e81a8b81_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\3ebcc0ec24f4f883df0e18c4e81a8b81_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ebcc0ec24f4f883df0e18c4e81a8b81_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Local\Temp\abxd.exe
  "C:\Users\Admin\AppData\Local\Temp\abxd.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
fa2040971692ec8cb73a240f0b694fb4

SHA1
707a128797ed6f874ee73c4de35e6d2bc88579cb

SHA256
a473b089c407091786e9ebf47b0ae12c8a61f14d694d6df6484391cc967ebf19

SHA512
2b61a93120e5d51c4f5335f0c8f0b7c0052c40e5e62e619f570d9addfa09fe5bc60ac62093d817b32df878eec9c41e8d736d6a2112dfb4c665fbccb807335db6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
e66b7438318a57a886fbe8aae50d6ba9

SHA1
7cb46d4638e39f3cb0c3d9e91fc4a130cf9dc0bf

SHA256
9c4dad2161ebaecbe0c125862b75541a01f61929a8f1c8f56f69b69b52e5e826

SHA512
3d1bbe467b82304678f1366991e1e7842d9de6465c2a2524071d950e4c333072db3dfc3214a6c921a7950bf54b4a178b735c8dd5d7e94d13bab2276e429ebed1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
a9ac8b6bcc7e7d579cdefa9f99beeea8

SHA1
27ad1693a6822e8929be8f15fd8ddc5e2d9a6155

SHA256
62d39fddce7f111ec26b5b4ffb3125200827735e59eb81d78ef354da0fe6f191

SHA512
bbd7e5e1e6276ae0307eb655f75395a75a00ca187041ccd492d899f08104a1b1622698e23b875dec40c34c012e79d4abebcc542ebd0776ae42babaf964a3e438

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
ef177051a18d9ab6fb1f6bdf33cd9ee7

SHA1
251ee649502cbd4bbc0e67a5feccec8bd802606c

SHA256
f4c61ddfae665011e07aae388f39de0824d373b8af360e1788e73ac0d16a33ca

SHA512
6f6004905717369fbd17790098c265450764d06a502e0f48bef7d1739ecaf15a0cdd5d3c6df234002e8e6ec3e14244a07d10057e6e9464311ffea51c1558f9ea

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
dfd6aaef2900a2dd41b3ceafa637b190

SHA1
21462cbc4f0dae5f6741cde0316c95e57d131afd

SHA256
013643671061a696466a61496f9cc14ab243850bcf997b2e2e825aae3a7cae5a

SHA512
11ec9f40aeebed7629c396e2d3fa2fe63c83a7422890e276da0973633dc8846f3e5791e01662dd8e27bd29b767932377ea8488aec5bb710398a6d88e8b89ac8e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
5591e64b0a694d73206ca4e4921d36dd

SHA1
5ec21d8194fa6dac3522f769a2e6e9d6b5f66956

SHA256
78043322520d067512e293acfb44ede83e4d243245330f3df2805f554eed7fbe

SHA512
e4539102cc5e4ec6a80269cf75224c830e35d72e35bcdc088c5d2cb0cca369ebcb854576e9fe10e898c774af62a563193ed0d09d178034324ec8e8772ee64c4c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
2da027a3f2e9ca27e07ed6072efa1d2d

SHA1
cd7ca5379c6f2c2bfc0e906a49c27041c2df0fbd

SHA256
e6634b43ac4b8f707920196273eb9946a18a25fabf4cd649608d102948cf2274

SHA512
c86bb122435bdc7b716642b02512cc667428abbd6a75242cfe884570154438ddf412ba91918c20aba6c2b040bcd7d303ca1517abf92096d540442771ec5adfbe

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
3a02dfac1325e5474cd874b7f73148f2

SHA1
5b01c1165fd52613c5210a47a3d7be86297360ad

SHA256
081c3e35ccace4a0bbdf88cc8d6d359b377c16f5bf06d01a8b9a4574e6925edd

SHA512
0916cdfe654981d641f03ab9c555f7f4eda4a9f2435d0fb97d2bc0e38c38f6f4019bbdb5b72494fa7e25018191b1a2f77c97c8c96b605bc2a05a5a439b478baf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
a4659f00897b57363a60001ecbd9ffe7

SHA1
4062f6540c384c5ba7aa51497deba85ad6867f1f

SHA256
7ca18d8ad4ced19c6b03035618b3905451724396eab53db95f3e730914f7972d

SHA512
8c66da0dd75a77cdc86330ab8395cff3de6113889f60c6704135a40bf99e98649acc6091bd619c461071b7a849fbf731bbc7afd343d1591dcea9847778d4bc06

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
578c093c2b80eb7e85e1d52d564e739d

SHA1
11ac6e1c359aec6853ed5c490bd9b8f5acf2d636

SHA256
99c16031cb561a214dd616cfa568be29fbc02db2307e222a0df31fbc2f273e90

SHA512
764f8c0604d8e80021ddb4356854f198a76d9beb0ef240eb1bf3ad52721afcb94b77368be44dd937c41f2779ecec6db3daec9f853c76cc49e12f8092bd75fe22

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
2494a0a10a3548e205b429686344ae28

SHA1
39bef12368c6dd9da93fcc2e60e2a2e8dafae94c

SHA256
82fc0a8a339744884554eb82cb0d5446bdc2a050d6e3a55472ebfbf563c52f2d

SHA512
5462a835fbb202456c39d296ebeb592934f5dc6038f91bdd6d48ca6b18c65a2931db83784e30cdd46bfcf23712a89ea81adec337a96e4b436052a2d5e9b91b9c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
20c5a1ad1027dc09cead39304c027988

SHA1
46ab56aff73d8e9b77218b1c43e155c38d5caf6f

SHA256
4f0faa7c50f539086aca705d010d52a8a3a804e108d448a1bdec5c7cd945b043

SHA512
b470af422faf4612e76932f4783ecaea6847e5d9ff27cb33eaeeb6d50de5e3f407247f1c82508f71844550720b1abaedadeffc736e93205f31e1188659a803ef

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
7249b77c3695bcc1d93e0a195f7e77c7

SHA1
f98522549e2e910a3711f8485dd62d3b167a99c2

SHA256
6e8b05838978a0bc81605be83c514481f3bc1001a6c526d6d569b759c02e18e1

SHA512
da50e5bd933d72599df8742bfe295c134e2a033a6064670d5fd9c15d933cfb452a08f9691f12c023a71e32658c749dfe562529daccaa26a9c37823482f2da243

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
0bc31bbfb00d865562247b739fac79d0

SHA1
4d0ee186a7ae84af342b9070b7454da332edce6c

SHA256
5aefa4f0212191a1a4db0c88468e28d98cd5fae1dc8928982d21dcd9ca9fe20c

SHA512
15095ee433cda5d331139ae4ee8b1ed669b1baf3fd74679194376fff838084d3dac7eb95c432ed6043092992b548911bfd4f7277c57e18c9c5cf01aeff159316

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
ba1a8bb1b64b61dee2a43fda8a5e8ec2

SHA1
04835d2cbeabd1124c6e9ed6f1b5eba896c1aa26

SHA256
76a661e1ee861c6e83240e4c35c95b8a9dbdc8523a043d5f8c9eb53bba506b03

SHA512
1d8cf93f56bd922126e51da8b4168c998aaab5ad0bf02fca3306d7ce6f2a2dcc8f9a8cbed0d8df5a2f3f32dc1763d35bdf74b3a7e63c2fa88e25b0c5bbe7eafd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
3a3f142d07fefe3f00fb9ddbdbc90712

SHA1
76948958e0a776776b12b9026d48e94e5961f034

SHA256
e008fa9497158cae7682a4e2020233a41a92019967d924f9deb5d79d097e674c

SHA512
8ee3047b38bc7956c5e74d2373c620c96f735f2f4cf09dc1c867b56c20663bfe196ef025672992904490f12696d81900c3d817f58f6b5d24df8c07abb5f3bc58

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
c2cada3e609a786b7da73c2c208d638d

SHA1
c1c1a7a40202ba03fee14574acd3e37394a5b5e9

SHA256
f4ffaf8d2418203c3a40e2a0c28567ff226726522d10c2eca82943ca2fdb1689

SHA512
4b7fbb675bc87e730318406a69e7f52cc9267e2d7c138058664920d82d89d24ab9e010a1440ca2eec5554ab60bfde8717d98927fa92c3729c33da2d4343c417c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
959a4f5841bdbaee487b9b477989b1d3

SHA1
239a964ed0fdbe9a3ca4ac13ace99651c7e68b36

SHA256
44d0997300986f3e62ec9a3d1dac68da13aeddc6d7e0740354e387375ec94c0f

SHA512
e4e758520c55bb971b066d2f878ea7a190f9976e474c879ea9e6f07524880a3e297e26b644a1e42fde29a5bbcd1dcaab1a9deaca97e9d3b9357f0d21e1915d12

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
625096d704de79bbb89efd6be87bec15

SHA1
a1b472efaf78bb0d16a0e7cdac177d076753aa1a

SHA256
006f9bcf21a7b17581ceb3c3d9843a19a8c65f7e565769ac655b67e791999a94

SHA512
06520b7bab2714a91207f86420710e173398befe849543617e1b6590604ab5dda4ce3b3a952dc5f80eed900891b0d29dea68f1bd69f04420beb97cfd87fa13bb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
c9753746473dc95383bcdabcdee77d78

SHA1
c1bd6ac33c886f37efe67b9c525aab33e3fa11d0

SHA256
e941fe78195853ee0443f2deb5274f6ae5fed577ad0fb81192cf4f3355429640

SHA512
024fc698af33729373604dcb5cbdc0e4d292d234347c08c9a837298630548c36af5bd1fb00a5488bd51ab7c5ebf5b4d9438830d61caca539d8a78062e6a7b343

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
1c4654f9edc888de99f0eab30c6edfdf

SHA1
2220bded81df50cd8da3849269e2f799d0b6b9b9

SHA256
e1b322e96149ed7f58ab58c271cee1d7ff4a3c4d8c7b3ee8d8ef039d78a9d29a

SHA512
72fa3fe7d3e998a1d9e27e29788665152c1ffd8a3f37499f432423a19d1e2644e9434b3c9963f3c12498170aa425146dd9c8abb565c1a8fd918d67c087332e75

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
54f08ede88d300465ea9d2254bc26869

SHA1
3c93e4e397c7b7c43f4535cac0313682587c54b2

SHA256
8ae42061047abecc80c209534be9efdf0686c80176fd7ba9e929648807021654

SHA512
0f7400fdbe8080b9f561d9f8c4a0a437ec8a09b82e271a0e5dbb9a84e423de0f2e27efcd98866187aba6e847c35c08b3137896f9d5ca2b764261ab890a9689a8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
4c1aa99956b098657389ed4f0e39000b

SHA1
6cd69145685b67e30bc65eff6c85ae20fa404d27

SHA256
08cc944f45615559d3e3c1ca4a247e214dd5d9cb6893d93443d0e209a0b5203e

SHA512
ed0e9008bf2459b16ae8d7d8bc201613d793e11057d20a69812c1ed95f9048b4b0c895cf0e5cddb6ac4a86809f09624b23d154319fdbb736179986a990e6a1ef

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
9cb397b68fe188f955502acd0e11d89d

SHA1
043d212a1e252e4faa54fb0246cd7d5dbea7b48d

SHA256
597e816ccf9c8ea797204db2a239fcf52cccac0da04820864d1fe9a46b5b7c9f

SHA512
4fb3d3adaa8ecf639ffe76db931a60abfc168764e4c8a63a36de7bcbc5ed52045364ce241efa64f9a4682208b6786de91e4a6e8f4b41d9838dd639efedef3ba4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
0d5e658f12f214b6329a44d148eea140

SHA1
8240a9616f1ea57ee8cb72bd02b1ae09ca503bab

SHA256
71488a5864c049613281391c7aa7947479492def50c87f2a0b03c4a0b919bea0

SHA512
0ad4963e9a47dec1227f6c763072784d61d9e73f1fe7cc16aa12a2c904d790a63a1ba952ccedf93bfd3e097bc1b3dee0547f459bc8d4e9e8a4d2d81eb6781fe9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
d7abd63668bb65194b5d5debc5ea1a54

SHA1
ecd75b14ba5e14bd9bd8858b64aeab779832431d

SHA256
6b5305e9d6c9bd91f14962991bf58c43ba6f8bd1aa30bcdaa8260997af9c8bd6

SHA512
ccd19c8ec0c7f6c38287c43d5649c4e4888ca7d9187c4ebc15dd3f12322585d30216dca6e89b15295711eefe94d8cf2de4fb775922d4d3c61abfa9c9c1cac452

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
0ec702c3826eb9e6b99b55ac6ff8a105

SHA1
f6f7ee50f70054f50f2d9c78600e50b7fb3f9f8e

SHA256
a8347b4258279a8f84db6e1a3ce166493ad8370fcfb67c47e2afdc84def32972

SHA512
97c3dc79aa48f41148f07158eef19666d48c2013afa960a8751fd598d3c96187042977f4c3762ada0648670355151bacce927b5cc848c5c6b4f674d26f58e839

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
1b6765da8f9257004f4b6b850d634ab1

SHA1
63e64732454b1ef3d936b7d1af89cb5547ce62ac

SHA256
e662952bd88821bbc22d1f0f04862e9dad6054373f3b00100ffa03bb3668f663

SHA512
7b98211de3a75ec2e752958ef231a49705d044ef0096aba7ddd08df87d2e4d4d3c88b60406475ff550ea35991952d756703f9cac9b88e3b994686d47567e9a2d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
e0860355a2c95696b6bf63530f65754e

SHA1
fcac18f26e75e3fec8a2121fc2f5b6985c035a5d

SHA256
78849a4ca68dd14509caec60f5471cb4ddad02b36a2277b49f6de2161896bc63

SHA512
b64896cdfb785351b7cdcd33a7f5d23d451e63c581c9d377395983ba6ba4e6ef1e29f69751c1796209eb6934d8ad0c6bf0f28b4820a9e8709996b5985513a6a4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
8d189ace8e311471538d0331fb59653f

SHA1
a8af0fe28b6d6a3f54a85555aa83c0017bef179f

SHA256
cbffb496f98791524695b0e4f434ec3917c04246cea4bc106303f3e7766e58e2

SHA512
0a065c53b693e567cd3a430d450aa0b631e651d342a8cd718f871c6f676efc8f5f5c28ff3cf32c850524d2bac6f89453cd4a96fb36c872efbdadaf7ed68865b3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
07ecc16d0c57e38b083e650b6d67f942

SHA1
b2cd289f95fd8ebc06a3cb83a5abff2a375bdff5

SHA256
d367a19a5ece99d74278afcc81b272b420e1f84873316dca64434563bd42dac2

SHA512
9be92e50f4885682eff19b2fca9603cf30fd4f2227490c2b30aad584a2b62153a69bd7473872df38afb9f1a18e84f3cb2d2e2c5d4233729c05a7a40fcf285a78

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
a063a89ff2f6d2478812dd189f0bf3ea

SHA1
4ce8b4caefb0b405cc2080823c8ba5ea417ac7c7

SHA256
93f758b06cc6478a3706923e870f5166182b6c9d56765571b89a2b53d90fb151

SHA512
e2515b79c2478cc26c030ee80388207971cdd9a7242c73370f9a0883f2653fdefde277f0378bbddaed907f9d0119aff7d0b9d18d828424b045032512cf856e4a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
642a3fb308373f5ebfbdd945c70bf7f7

SHA1
ed24309c49c53ecd53c32f23a9c2baa906a86803

SHA256
7cbb5bbf4f7ad05d8d22762e02e551511dcf1ecc1d461d01a7155e37ad41390c

SHA512
3d037d831d00fb5453a5af7c267b6a57edff96596f4783661a71a5eb19aa45f348a6a292818460ac905ece2ea005ad716b0a14dda7985cb7238fc73d6adcd39d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
a346840fa77f52d8d67fcadc82e11ce8

SHA1
fd7dd615b12aa7380a0f9f1731054b6397d28df1

SHA256
00bdeb6d3f941fb70388b82cd637bbda573bc773bed9625a8fb02d46600672b2

SHA512
80b0ab788172e309f9103c37bc2f93932c73f093a7d9769662f6ee69d9dc8857f25efe892980771d6e82d907bb595504d8113b0823cc8b67b7d6a594693b8a50

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
8ada74c319fb19d6e8a499b6fdf450cd

SHA1
6505724b82e826fef4dd5ef0646536a0ae997807

SHA256
c254e125687d21ab63b27c4d170d49a653c66dbe6b24437b9c621462d4894533

SHA512
9dc80a7ca95fc1eae4c0fcda09a626b57d1e22b981043aa85543daff16bedfdbeb1b9b9fcfc653020dc8579c862eec528c54184d2211224256edc6df872fc33c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
24f49a5961df019ac3e40d896c106431

SHA1
0ef29559fb7b855fb92b83c72d31e49168267656

SHA256
6f7b505fa5a83bc296e0013f592000ecfcba5c8c563fdded2737932d99d2427d

SHA512
41b1a66f64f902397701a20a6be6f66dbe067cef767424c0faf85679f234cf1a24ef6ee57d49da6dc73dfdd2f55f2b1f602415162405f608ac341fb37543137d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
b2ec5ad74c6d679f4dd7b738c5bfd4f4

SHA1
9e53076306ccaeaa501d66b162b6da1ded4377b4

SHA256
a08982603244f13e9f9c603d04341eb0d39e0ee3d4923435636c6cb2fc069894

SHA512
e690c998c74cd7aa585f2d2cf98e8b0eace0a3b86aa57ca0acd44af2c531ffafb6b492ed9a8d9802365012f03e2a5170bc670e3d8f10333d5007431ac97ab8be

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
043fd5244b123576dbd3049802d4ce05

SHA1
6defabf764556a7d8a2403b8747ea111d5f1b736

SHA256
d5b52a0ae4865cfd071a33c769192f80ef27b7de79a0bb835a18036a9a113c39

SHA512
19b939de8a9564da6d3f38b9a71298f9bede0aec048cc2c31cbe94f98211b1f8d0ad0b1615887d988550ca2b0ce8577880eafba2c14e293178810fb751c8cc9f

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
374B

MD5
4fd7af8890656b6d8d33bdb64d1a7d86

SHA1
86904845f70fe0e06df05274220540219506877d

SHA256
4407816fd216281711386bf1d73247b7753800f7a3d87df82cc38a42121fca93

SHA512
cfd5e0bf9277f0865f59429e998fe1be9c1bbe6576e312625b03f4070df5a3eb810dc0c4eafc3802b4200058d950bbeef16c1996033d8b4ebba7d66ad416aa19

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
099b66a06ff1d191d0d8a43818279416

SHA1
fc15834b826fc5a1ca8133d7de8fca9352b76a7a

SHA256
fe2910fabce298d1ca1b665ef2034ec5121c36ae561a655e0d0556363a4c83ee

SHA512
e2c5c2e42fd73e55f2a1f97badb01918b681833d615b3039ff25336b846b5fe4a83875b5aab668e05dbc1e3510a61c536cf113d20cdd4c44609bf2ec577229b7

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
5f16dd620d6c90d72dbf283dda01913d

SHA1
13a4b77d88d44960d7b6af3e367a893cfb9a52fc

SHA256
9d7d2134aeff39c8cbee6869920d7b35c51c15530e8bee720b60dc5c64c87201

SHA512
16ff5f23a57c335de4a68bd59c7af2b4c5274d0c166222a590dc66d3266297a8297cad2783bcb6824e9365dc608ccaa88696c1879662a29ffc3fd0ccd261fdee

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
994b2fb9bde1428762bb78d8e420a0f2

SHA1
d5078c50542536b4546af7f59f24939a1c3c090b

SHA256
04bd1d7a79404080d78d08ca9e7055dbfa4e2c8b933c555fc1c6854bd4135170

SHA512
b044bd5d152efac2597b4f5f86fd916ffe057cbbca4e00f3d669df580b61f435a16e8213135149f099f8c65fa619397f30c0684c705e0fa44718aa6c80b35245

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
98329b198983f51a5e63967f52de9b38

SHA1
82da4a1e9c0546e069c49ecfd48272c777dbfc1f

SHA256
dc04e657b093473b7286872ee7ba59b193eb46c641ba2ecb21b5c7e1d38f1f29

SHA512
83d28a2f7923b070db0cb06f169647f56e98ccd40669120bbd6d3e48d33a4106378502b4b5741321755aa4bdd80bab13cb6a57b0ee1fccc8fcc22cc88d57e084

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
82ec21dc5fd57b7c215c8c10352f19da

SHA1
ae430e9de0858f94d3055055ea9e8cc81f9a8373

SHA256
42235aafae8c14ad6f63175d429bbc69d2319f2737746e134462684ef86a36eb

SHA512
da895cb5e49ddd48853c500e73202dcbd7edffd95eb9a49fccdddcc1bd2764554c9afb1d9d6da3849a97d0b1822cd674a53af61b7bfdf7fbabb3025c5bb381af

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
95b36eee84515551def0f1a335221eff

SHA1
b29aed8cf62883ea699a92c5194dc3f683a6a4a4

SHA256
f9bee1d8727beba5a7438a3e9679f475d71410ccd4179a31dbe277bf849d2c2a

SHA512
1564040789ad1e6dc42c2f9683a3f4762c8b9f6ee9260b4394da84d3ef1e92bc758c764f44da364719bc8218e9e47ae293b25e554560949d5154cbdcbdbd8348

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
e0afd9173ea6235b2399c86d2f427b2d

SHA1
d2d71f6008f5e5f9e31f129a934a46da6cabb0f9

SHA256
a51ebe1cc88c44709c5eb897c2e150b8250a9e175a6285af39e2d5a9ccebc26b

SHA512
793765827202442125ebdd05d19953ac36a94107228cc9fd8fa7ef4c2b6c29406793da57aa9623b0ecf8a8817e6f81ae55ed1d2c9b32f0a76085166c67caa45f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
fc7b450505428c91f89a8af2bed7e908

SHA1
276a55a56f6422a1e123089b3f45ede2b3b3c552

SHA256
bbd18b7f6839615bc204b879130e78c45b9982db9306d55be9f8057ce067bd3e

SHA512
482d5f8c47c95d44d16183d36a8ce6dd60faad2b466a0df824c02967f4d0cd7a0f5432b6e35ed6b8b9dfb57e7a71001035413881a00ef87cb7960a52e3c3def1

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
bff3cf26381428f9d9b74021214d15a9

SHA1
c19363f8cc032e54b56420c2fd1b04e54738177c

SHA256
eb78f094791e2aa00b177bb71d163e8fcf021c64b71f17299386306a74496857

SHA512
43de6c3d76984e719ac2ec2053c176f37df4ccc7567d72a4d6919e8a605012bd0c00644a10c30d7fc34e08d595fb51f94db477ebe6b19e22e1577f93936a9812

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
88e39009e3e656442e680160c4ad09ae

SHA1
56be79eb0661bb199db8d498193e055198a55f02

SHA256
8456a26a284bf30e0e78caaf8262f980a93214a9ee12f911210a98aa9bb3ec39

SHA512
6dba2bc5f11512bba051f84559afeb2c6fcc35cbbc01f513d78061f0aff430039c939c1cf4106ecfbb4e402f32689811adfc573ac6e381cea5a83350e18834a3

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
9e16f73b17112edb8df650a45e4e616e

SHA1
7cd435e277c198aadbb3e481ee6db2d26bcba1fc

SHA256
2e057fd1a77ad3af6f128a6c80fde00addc20e5e5bb3515e1157bebb52276c3b

SHA512
56aca2608a0ea051309a284008b929a9bccf3b09ce76e871ed6caede959129573ed434b9433099eb741d5a02b156b1cbf54a6d4aeeb55756915ee4cbdb18de76

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
6e1dc2c7d6e68c5bd963ad9eb4ad2eaa

SHA1
b7b6d8a132d9e210e8dfba0b82210dbb9327f56c

SHA256
f5d6c442286ae9b50af89f13f46fad8362f0e861570ffdfa5df254db08600d5e

SHA512
fb61bf7ef1481a95e3c9880d8e24bf6e16b1b60d093a3a297c489885a30c8ff5a6f812a1db6560af96a69ae6ae7ee8722135d03640cf6160a8cf72356a3b15a1

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
83ddea4e37a3e129ec18ca9de64154cf

SHA1
3cf94fe4c1cb1e5224939370b0210d461e201cc4

SHA256
de14822ef97c721513f32f3e83a7e6ba41584cc871d9c5934cbe235f2d3d6323

SHA512
a67b77575da6c2e4a3c2e5cc5b3a4c51dbe27642a602e7a89bc0124c6fed187d4e5cc5c84e58b09088bd6a0866ad7b00fda32d54471d3f3e962ffae47badd387

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
66cb33af9d2663bb33bb4247603fcf2c

SHA1
eab80901609d320d2d90b4a0a45f0b0a1147fd5a

SHA256
44eed07adba34434234352ab5d58dbcf5bf41c0832967f6beb5619aa3b81327b

SHA512
e168de62cbc3de830f09e7449746139ae0f07a9f1b067bb7bee7e1a364e98c7e7955014422b758799c0d3f22f522466364dfd4b4f2044b3cec07cc43d3eda8ad

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
e7aef6907c553b542d0bf14b53e16a02

SHA1
23325da0b51e839c8d6fe2d624a7d032964ea946

SHA256
97c2624c3bf8cbfbf09724576a255852bc8f39c82238901b5b8632b746a674d5

SHA512
0d774f4e34ca2241ed6ce4692edb726e6f5d1cea3807ab3784913a039e18208d28e6c7f7f4b090dddb05dc9fecdd5c2e15033b81c5a2899cc42223b4e11b8bcc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.EnCiPhErEd

Filesize
10KB

MD5
1706b1c9d41f6259d73ced7abf585a8c

SHA1
fa218a78df131430261679bd2c10decbe507bda7

SHA256
980d2f5cafbf7ce19b417ba4ff282a29f4e8525d35b5dfcf7a5ddca1d9405408

SHA512
2fd7806e322f860ca2abd0124278593443ad7104bec09db401d9e44f08d8ee2b8caba9888fb88a5937996ca508aa40b318c2eb20aebf12b484858876e9dd1718

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.EnCiPhErEd

Filesize
3KB

MD5
f1d4ba4241d4dce5cc1c9d78922d9d99

SHA1
ec31b3e61b144a929ded279f85d02d289b5bf165

SHA256
f79ee149b71931b970e4654f3bc63b7ca64eea6d29a5cc0a9a491cfe761c568e

SHA512
c4bdce7835e8044e5861e028df956cc8ef1325d64e5cc16ab605caf1376c60eaf1586ff201e2f9a330fb8b1987442f3e4ca5b5176acfa51eddca010b4bcb692b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
75582b4d1b3d0daa284ac0880452ab4f

SHA1
94087937e4036d7ad38f06064f2b0bb8cf4ec57a

SHA256
51e1e56c227019d262fc4ae4c51229b5af854b87b895a323c7cfa76235703dc3

SHA512
a6b3ca61122f534cc9e1a9066a1746c257e56f5a42d89e0b43ed56781c27dcb86213d567f44adb1eb704bd09c27432bf2b9bc597ccbd0ccb1f224badb09ee659

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
b1a62fbeef9e024740de43749dc3563b

SHA1
f3b2551531ee958e59f385cc3d1c2411f6cdb4f7

SHA256
2759d8fa15b052cbabceb5e5808e2a49ab42a8609b0771c8d6c9361d32da9a7c

SHA512
5c847ebb04ffba41879b5b2a63200779b6d0b71686502a0f3e5f14cf85d2f319daedcab4611dce693d115f6cb14d5af669dc4073dcc44a546daec42440c1376b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
7e5bf18e32ad0f76ec237fd213975b1b

SHA1
3a6804a46d9f9bb399123bbad0204544e65ee2e6

SHA256
20ac44d0d16b9e56bbee3b78129ec420395b23034751faaab8c6db61dee155d0

SHA512
e677caade53d0153303d2e3f5efcbcd61e24f0cd9274e2c4b960e8bcdf62cd30dd965bf1972159847bdac01d389f00a66108a46c8430e4b97e40de1e84703e4a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
b2ddef1c62ee56471249977d12443209

SHA1
149be5218ffba3258bac5ed42a3c8dc054a81970

SHA256
4f5f936871884371013530899a6ae21627fa05a0636c57946b17f5271ac2fc56

SHA512
3074a73737bf386e62f52d5061935fd8324606cea5926d113dec23acce816c838040eebd544c52c449a06e54bf6082c02e69374d8efef2862587905534e6c2c5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
9839510c7c72a1ae2921401c05b566ff

SHA1
0fc3c0489b75f04464922778cce6c8d912468072

SHA256
d524e4aee4683c930e3448c7c3e029ae710e08746798d6eeb1d094a0eda9b04d

SHA512
ff9a99ab48c6e9ab98cc883d5d8bcd622c575add8776dafd55dd7e5a9a156fa690bd3267cfb1eaab504736093aaee02ac0960f6c8eed29a1c914260da0116e49

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
886aa69ed7726f3aede606ca2506c926

SHA1
509942fce5b7298220a968cffb3c7ed31b5be4cc

SHA256
d96db48ea786ee9ceb1c250c7497cc85f5df3e381df2a1805bf04967a3fa7c0a

SHA512
d7e0bfbc6d80ac1a045c2cf7662da6e15576f56e65a1e1230c78498ad17129d3bd761a6d2f1210c67ace8e39a642f014423d453824b20764e6018a1b94e47158

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
f6be35b075c18fa8c516992a10c1ef32

SHA1
fe6c13768e377b01becb683180e57e4601eab1e8

SHA256
e25cba43d15fbee21bee8b8c5148f18263f4dec39c45c381b475f86ea1f51d88

SHA512
d4abd861fc6271336c88a48875f0dcc0fba19b413d40e20a2352ecb7f2dd4cba88226b8c0187c5e1fa195d6b828ff550f5f175e5ae0118b404343f9e595d5ea0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
6fb3cdd59f40747a6405a1538446170f

SHA1
428e0931e96724263622182f4fa695178d0d2616

SHA256
303a429ee2323cccbc0d0c4b44acd0a3295ec45ef5fa86858d7fe7e205f8d428

SHA512
63d040648ee72d69154e99541c9918ebfcd05d55da1d0783ca56b461786d271018c7ed8084ca76bbeb71f9b327327053fec65302f30a673e590472fb4fddd90c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
a1ade4056e5f95df20e8dc2e2ea3d924

SHA1
08e736a73e5a1ac0aecc04704d75fbe558337976

SHA256
66e3aad21e72f067cd691b99b3c7473c1e1d2afc8d95e74dd78417d5ad00392a

SHA512
bd407c1dd6624cb4b412cc468c173ac74fc2fb5a80f30e42a017960c92ba39318a2728f999307033ada933e6f42fd132329b79a634f662e640868480d3acc6c0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
28811a1c7f65693ba639f6243755946c

SHA1
b1d1356242d9a610411d3129b7dbc464dec07002

SHA256
e7486cf080ccaf5591d2ae128e386bbd05ab04ee510d2d4bcf71407c9375424e

SHA512
0ec2d69b651de1aede9d24d891c8590432660adb5212ea6e57ad738ae95ada7e579f977357dc1aa974b5ef4ce0e0eb8ccc3a4be9ee61b698cce7700310ed6dc6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
e656320a4bebea9fa675ee083dcf4278

SHA1
fe7f6319d12f2eb68f62855fc8b91f6031ebc3ea

SHA256
b0b7975689d21c80fa6331e22f9187d55472ba2e92658ed89c528693a62b341e

SHA512
2fd9348bcd33de4b4e1b770e603c79f137cc79ee4907701de12f417751ba4c11f9a61d3e84df742374a6b2e32d826b0edd6d28463bb915b32db4270eb4f498c0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
7e6116025d05084cae10664ed1c42ee8

SHA1
8019aa1914d99343e0754d26774c863215243719

SHA256
6a99f8275539681e75fb909a63ecc39fb06bac676bb767e3841b313eabefa231

SHA512
304eb8ab4a84b16bb6a1b25d305438b81d7baaef42b2ae84e477d5e424c03296e646c42c6a978edf27afff31c2d6027932724f4e13496fdfbcedc13138e90560

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
b2acbc32c070ae7e843e0da81f7e9dc7

SHA1
eac06a352f1fa3b983051eb488417c8f650d7041

SHA256
1c96537a7acce7d293d5e77c42496a8d3d37d9cbd31bb656efb3265fe37f03c3

SHA512
e733ce6ac00b8eed28cf2beafc9fc195a559a53c2f6331d24fc31c0935dc35dbb700f56f13ac8c2dbd351b52394ef820fb5693d212911525fcca62d78ad520b8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
2aac2eaf443a64caef350fb420e1fa1c

SHA1
25a22413e06dc254bfbd8c4e7902906680df7c7e

SHA256
bf3681903d97ece1e88731d3d230727ea12dc323511e84ace5cfc63704b30d80

SHA512
ab2d70c6e15f2af49c386bb18a8b1caf9200ab0a247a845fb2672033064dfa08b94a2182e6f7ea786218bfd5bbd35d5f6d3d1cce92c7a4b8669993e430941c16

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
335da980d150d0f0a22d176bf9ef54ce

SHA1
fcdde6afee03039f9edd3f6056eb03010c0ad27c

SHA256
6aaa75ad59edfdd438f2956f86117ac67736600c476278259d1d1117734c8f68

SHA512
6e4f827d6012d259f36996c7683cbd52d975dfea1e288748225a75ff73b1a8e091dcc9f69640c9c6b494aa11fbf34a66603629ae25d5d11abef1614d1913e600

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
e941e541c21808b29d07a54ca680e9df

SHA1
f5e9e2b3754481fa86e0c4ec1240076f20837e49

SHA256
b05c2b9dbe3d8bdb579cb8fdc9fff7d1e223eeeedeb2866883361ffbd906461f

SHA512
37b8e1170a6ef3a99087de57bd13cdee204e9703cec76218a417bdc5e0fe84982595be0bf66347e31dea898579e65d1813762c4f19656a8742cf386c460cfabb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
e06f3cb32f57a1026ce3d6b56fad225a

SHA1
87b295d5aaae9eb0921489acdc811370e3a0fc6e

SHA256
14ab94bb6a40ce7132b50b87df8683efe0c4e66964a6090d64accb7e990e4a57

SHA512
91ff44faeecd118e14ef1b4b99c80ce8b2a3608564b01998569d5d0eae96045013dc630db08376d89343348e84f7fa527fce4eb7cb74049ac7fca747e48cba1d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
5a078cc48768b355527c55da1665dda4

SHA1
5a27a4c5ec8ceb72b9e0820d59ecd9ff753fa83f

SHA256
ff0f79b2f8616e064a42c5db747ed4925d8011d254ca73b8c3e6d2d7b1fe678b

SHA512
c90cd70148254fb7926fca9006ccd9a450a74b56a79a8a9e05fb387a318b19bf15dd82e4aac32d6b02d1dcf6d867ce8715fba5ba1603fcf95f2868038a33990c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
0039311fd7ab709149f6c70703316fab

SHA1
5481cd1bac98100ee312d3e27dd8b2cce9ef8dcf

SHA256
ad16dafbd115f16c1a6cae8a25b19f6534cca9d74ff9e1baefa98eb1d4a7e13f

SHA512
d22a6c1c03062a1e2e53b0629ffad55534937b181529dfc285b9b5b245c75a58c3e01d9b090e0fb193511116fb01f5ae90fec6ef27b11b74c31b507f9aedbbf3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
e87fd23d9c9239d8f70c81b270d6210e

SHA1
7d8af6379368648152a5cf18d0c98a0c2d5ae453

SHA256
b5b61b38fbcede0ae0efe81307f40f90c4e862eb4384ef301059f1690b238ab5

SHA512
3eb8078cab4772c0c60d61186de638da012c0871cdee6c00d0ca67f91c57742634d4326fdd6607458ef3dd77ec4df240c5584cf2a771c8220d6d40afbaddbee7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
fefe94fd7b74b1dff7f0f3635b44acce

SHA1
a10ddcc8b3c3fc86f083c154434fa53da5d452e9

SHA256
04ebcadadb6ff715b300ea5026d0c940bafdb3e949d9faf5d1977905bceba0f3

SHA512
0cd2d234292972115132961e53dce6e0d78ef0b2a7dfd1081c8703b7594e7fabc4c680e4a4c895029aaaf0b6091b3af9690ce6c50c3541f70579723945a89436

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
fbdee758feae9d001530eeb23cb0b2d4

SHA1
b25791ccb59cee714d83f01674599cfb6bfc3a7e

SHA256
3071fdad20aa974e94290238cf51b701449af802f7ee3a76d37e41994e52fcfe

SHA512
0105426c2e3f39a10bf409e93692d0ca9da58de1578ff85d31125288647383985a7aa026eeed29316799c3f0573eb2413ee60a46adf6b32e13b216b6e035f329

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
36fdfcd5928ec24e15d58a14df85b5a6

SHA1
506f235308152abcc2db34299cff1cfc990db22e

SHA256
33252a75f8d36c185b5c797df2b33611a0a16208ebde5b8bc4cdf768fa9d4331

SHA512
99dfde3cf8a75773f3d26e8a959edc3aaccc46091edfd7bac1619305b3cc88f709008b6ff88abfe4c2be948e0a9f0e74cb2074a8b1a3f6bce8fbda6e49b6ecaa

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
ca71eba45b7ed6b9990d6ca3f368cfa5

SHA1
8125880a89c0524ca0076c20c0827c2710345061

SHA256
13891b7576a85b1e0faba86e2fa02c21fd71572acf6ea0dd7e5781eb4dfac803

SHA512
339e1d477f0191205364663d143db8e0296e12db930fe5cb919af138798631d84ba83c5a2a1b2aba1ce2c60311594605cd5689a9ef8f75c55c46dd03493a38b0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
d4a4c6461d8bda107796be3a9df6783d

SHA1
2ec170ebafb854ff36acb6bff761077b3b8a8abc

SHA256
d5cd17770ec3f0010d218b3308553c346d04cf15ef7c24d73f14a9eaa8d25ea2

SHA512
31a7c0f82cf7254e8273b4c3ffeb82fe8917a85372588f9d69e871df19611938c42bd38012c262eb67394503c703ed1ad0fe269e179e9a917c6f77f070b30f88

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
a1bc830a4c3ca9310a3f291b560d19b0

SHA1
e779254284f0092c47a0c105c58543330f124926

SHA256
eb7da3b380f143ea530f1e4d1df59fce3e5c997032a6a4839c83d9af13295f45

SHA512
95ba00ca98b652504b4418481785a6865f14fa27618461523297cc214cd9c36c3cae74bc8ac261cb29aa9fc8091b2d08f33a047d6969ef15c233a686858ab9ff

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
5d97c73a84ec4a9c80796749439e6991

SHA1
b12b12c6ffb04352f260e65bd3a7d767cbd406b7

SHA256
4f290d33593fa460dae6b1bc3a1857796ec009272c31eb8d19679b71c692dd6a

SHA512
744739436d548951caf63b881131b5882e85b97e4221ca9fb54c4452d51e18c7444b218ef049b5156f1edd7302b90e272a41506673910437d0a2554123d1ad27

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
42B

MD5
ac154d8a3b1315e61e5905fc6fcf547d

SHA1
a50f49738881b22bf11638420bba2b73b2c2368c

SHA256
07fb57b9dd876615fed4efcd8a0f138e69c935e952b87ff2f4115125e06a88ad

SHA512
8a31afa3dc49ff3979c1c2b5b46aa56e4dd2edea918d520c4f414839e6d9bb852430de0c18962480e17b3748bcf7f2c7b0d2f593d70e33be11366fc099acfe0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727655977808114.txt

Filesize
77KB

MD5
fef99f650e5f2c8130a27640203f7849

SHA1
70dc51ff85ed791eade8da443b1742fd9d52e656

SHA256
8e19518916446dd905f202d747d96a0dc9ad5dc26f7b5bd60e2ab454da219ee0

SHA512
2356d2a354652712e1a77ad54dc3167d9eab0ecc94bd0925507d823d52de5e3ad12ae5dc8cd5b350c0187ffadbbdd059a5a208638ab1f9bbda28b481e544a500

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656717558154.txt

Filesize
47KB

MD5
4b85e6bcb663ef5ce7c915cd31e0312a

SHA1
c4bf7597740f3cdb63d3731f33ef06fdfe92bfb6

SHA256
9e0229d559f564e510c00b68e7675c51bfcc933d781d5a57118a72e68b179960

SHA512
80a547a206ad52acca3cff055f72ea2c1e1eea1c4857525898844df7ff900aa6bff0002dd69d89e6bf51cf546b5a5d552d9bcf0e743ae0f3973bedf16c3b7fa9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663096253949.txt

Filesize
63KB

MD5
a005054fd0d0eeb5eff4ca37e0520ea7

SHA1
490717e6140693d1e0a20dca82f1f39945b18698

SHA256
b83a30d48a4573daefc6e87030a08e511e44b589f9f8ae374398dbb1aa4d8ff0

SHA512
3928eb00571dd18ffe4d3b0d24d9b914994d8491d425cd60c812d1b2ae1f4c7925567567fc2cddeab58055d9d4b237943dc1b0bd939c40739399ccb49b274605

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665766873969.txt

Filesize
74KB

MD5
63c16de1febe59eb2cc033be47d843b6

SHA1
4ad69211414c41b94890934e36106aa362e174cb

SHA256
dd4497afc2ccb58205c325c5eceb6b1f39567fe497f08812301dff4352387191

SHA512
61d6851aac84a09fa97aecbbebc6ff4bdaba4117467a333cbe66103db8d318c9bde656b1332cd48eead16144325f374c9cc34e19243e60193020853b312c31ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\abxd.exe

Filesize
7KB

MD5
9fcc91636fd031148a85843248208e03

SHA1
1810fcdd967f80b71de48bde2ddc379cdd55caee

SHA256
028a6a1a53b8374a8dd8b6dbeab68c86b24e277312d6c62846a0404bc8edc78d

SHA512
52e75ef8f1de6ca7e02e11a3053109e9c8dcf514a83d75a826456a7cd33a65942baca27b8381855df72d8bcada1cd18f3fdbaf454fde53f1007f8fe10ca95278

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
dab5d8f571d913ad5c560b0146ebab8a

SHA1
bd60dbd7d3ef5d7599fed5535280183659faf648

SHA256
fc8f3dff66238d9b20789e63df9c600b332b08b080c82e96bd816f316c5b9de5

SHA512
fd929eae42d8fffda3a8e94dfef4195104624ea654739965e4255680229ba4ae50799362e71b794d3d2b19ee6bf0a5f1e65a3b9d8ee8c5cc75a7b521ae9cdb41

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
c41fdf5bf71cbce5374f4eb6c16b8c84

SHA1
819268fe4f6d558ce8ae27515de5606e172c15e7

SHA256
36cafa3071d2437de08c4279ed5d17bd2aff088b9bc8fbceabfef0c5f91e850b

SHA512
b477998439731496caff97803af1059750f01e842d57e58de11b9ffee87405357cf0e497146171f03285e0700c66922aff13af4922b5d8dbb9e20897df44b6a2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
644fab5294f9d7f5e9e6fe7b0a22655d

SHA1
0cc4ddaddd3b82cb6e1290a43935119e6d338ccb

SHA256
e8405c04e03d72e1ece319a0fcd397421885c128aa08fc2a394e9d90038d3381

SHA512
0011c99ce881c70cd84231bd054a6b874b84e6099ef5b44a62a4e8816d45b910c4d14832c576ce058d4f2a61a86d9dbce1a51292591df294ce8e6d71876b0a7b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
46835b517e80ecd0d9e805d17dfd1f09

SHA1
4b7708995d4d152512f73c0c7da15b8bb793df54

SHA256
c21954bc50c73174037fc33e2099436c2efaec8ce702ef4302a45e6e429e858a

SHA512
f976360a7fdfddea9f47f455fcdd6632abfca803f6f167238ca2683d1bc94f399f72054d717321f35f47a7588499b30b6e71a6c1624cbe19af6295d7447acc23

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
64e321e96a8306bc4425031605cd07bb

SHA1
459c4e7484875bdc4eb885a922fe9e6ea77c14eb

SHA256
77a7ba1230f44e9d26bf7ec8ef2966aabb58f778666e972b53203b27e0f15627

SHA512
03dfc84b08222cbe5ae98402f3b8a6711c8a94cf890c01605875f6526846f57be90c48efc5ee4527c6ef96539f49e5beba79eb3b0e9d0fb9bc2106a190ed4d42

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
829c49494d82b40e73d69f6e5eb9258c

SHA1
2f894af5c5cc08559390212e93183f01e39d3f84

SHA256
5e50d7bc2f8bee52034641225eb51b75170cf150e5ff07bc38ffa1b4cc28b4fa

SHA512
af077fdbc1a78ee836870c13962ccc23c4873a29cb011094f0bc721186866389974befb18c8cd025db3be4258af47c0b250451d1aa01a7a2cf386090cca27325

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
bc753382200e0f04868e826e42e2ecf8

SHA1
2455946c22780e16ed0480f52ea8439db8af2ef8

SHA256
2677568d69a768ac292a8dc71ba5a34d3de7f22ba7d75cc1af700bd9cd4fcc38

SHA512
2a561738abbac41be211a8d16f9f9fe9645692510b431843d29fe320ba05d61a2c9fe69bafbbac2b3158f4578dc91c9ba4784d383faa9f8132eb9921779c8405

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
1d0d6cde77e02003f3b50990b8f26435

SHA1
d0986c81c2f286f5e92e7d08d3ec7eb9f14deff5

SHA256
dc76ba24331427f9534c42175c36161da0f44d59211ed551644dcc97915d07ce

SHA512
2144458d334677dac0c9baaad3863ee0f5ee9876067ae7e62c98341273bc312c7ecfb793ff761d7623dc31181747a8812650f460dafecf316f09959f6397bcf7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
a6d98c999d5add17802b2eb97a5801bb

SHA1
be7f7b25f5149afd25d0fe8337cf08803c84c120

SHA256
bfc4a1123b1a9ee79acab74de71e067b87d108b2856f4569dbf84aa997762008

SHA512
b9a36c27f198798bdf764135c3393b00a101b154e03f43bb35f259269d7adab0067ffaeed58f8f2bb4c2fea6913b7ee0d5a25b8c1667abe298cf8802ef031531

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
629e6db6e5dd4bccd3afa64d54767954

SHA1
8ffa8e8942de3bd592a8961e2c8e4e0de2507d11

SHA256
9f6c1aa24663b9aa01955c1f37b2e3315638ba681e6febb3db74f4661523bd32

SHA512
199030f1b009a541885cec712f36376575ff20053f4292c0787a3f50603c0d1a345c2695d900fac86e02f2e83b8d65ca04b0ca2e2431abf57c02656c84c333f9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
4f558e9e3f1c38fb97e79e86ec8a1c02

SHA1
51602ea1c569d4b35eab856e34563cdd787cbf83

SHA256
aac2e7b4840ec450f74d53694472064ba461dc27a7fdc6d5f4bdc211ab3f8bc8

SHA512
6d32d4f6b374d0b8eab9fe24eba6664a438457cb3dcd8822c3cded073c2873f68f8958e41bac9c4823cd3cce0343f0fa6a45b19093a5db92dd7b7229148afeae

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
2677049269d8b8a500670c62d3b35bde

SHA1
d54a7f6c0218c21517babbda89245f7d7ebe113f

SHA256
311b756233f9430e5af9dfeb6beb57444994796334450bf61f5f9a5176ff3d32

SHA512
454580bac7856e3f07dd28e07747089c34e1e70c55515dad002ed9bd04a90b05a29de0d3799db0dc451fa5cddbee01675afa6de75dc60bc6185af9341b5d97f1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
33fcda908388eb4350863595715b7b76

SHA1
c5ab665d808fe8d7e2bc3c46fe12d03bdbc08128

SHA256
4eda2b78c5e6d3b138bf960b22ddb9cbf5b1db7cdaea4f9e02f79875fa4c6cfa

SHA512
b7d85ae7a096596bd0558ab739de14d7815d9e981205e968ae4395da81ee57619d4b9cdda1dbd63ae62b895b09c23895867c5aad6c69857da14437aac12cddc8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
5bd52af9cb3b203e19bdee273d3ab3bb

SHA1
2215d425daa402e6c5d6174d55b2c3ad67e388d5

SHA256
46accba73ea1c30aa708483756b9325f3d5d9c689ecf46d1f9d57e84a0cb979c

SHA512
2a8509d2c96a4cf0c5470aed26cbfb0d143b57d7fa26603592d351e248bbe449ee60fd0c55bb2fe9132aa02ab5f8df76b144c14115aba52771ceca454a2a03cb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
a4d9e81ef95b60ddc0b257f5102d6f9e

SHA1
448bd380f4099f65dece26336f3e92e3eceeaffc

SHA256
7eb89e635be73402fbf1d2cf04f465c176d109cc4bd42789c897af51f99e63dc

SHA512
4cb82a44702f6254196520ec46c39550d270e713f3f95ec1ea4991726fabe9f49af39ff978ad926752acb44c162ea3915b953bb406a1e12531924efa10115d5d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
1f39e2dc51557d985b24e1f9fecda134

SHA1
c78186faa931ce82112f2b5fc0dc6455d35760ed

SHA256
1d53efef128e163152319c9b1b572a0b8a4d7f8a422854c2ddd7318f9527ac02

SHA512
42c6f586411a7bd976cfe96ba5b37dc2be4c8dc2f09b134a2865d631625056f6ad5e63191a116f95fbf363a0c6f0f88024dd2fb3f5d15db4eef88b2c2f6ffd72

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
52a021c04e04876cfe6801e6e0438018

SHA1
c92a83daaa236e01ebe2be82d1164d524a42eb6a

SHA256
6875c9a601b708018b30ddc32913e2f73167f53ae383d116cb65bc52ef41f07e

SHA512
a1602648debf7b329e38e9b666d6471f6319440fd7c5396a42f9225dc9a2ba58cba624422b4fcaea451cd208985f8e0282100163c691e06dcfc754731902a308

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
07232397bd5144d6df309e79d87cc0a5

SHA1
9dc486ff623a717d5eff99896cf9fb97c7f3b0c2

SHA256
94e04608d55128f741789da0efbbc182cb9f25b9d52dc41bd12a1270d53a268c

SHA512
a2ae5e4718a1fd327c68fbc617bc741c49ff53ab3994ed2daaf23f092bb23c71bfcefed1866291036b0328392a3a1a65146eddffa019a1374878d605a59d8525

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
fe88f6ae3c5aeaae9902a156d70c43ce

SHA1
6bcaf554bc42ccb9d5f169ea3b91e6c4e637fa2e

SHA256
ebf52f305818e41442e49edc746df24d258b74fdfbdf41a30059108a3a1f4fe3

SHA512
47fe1ca9fa5dfdda472705d176d5afe352f9133f307befe9759a12d15a30bc4c08ed3cdc3931ded2ac961129fb74ca3c4ec21caf08babc0896d6d156b9842c0a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
ca5615de6968111e37fc17c7b18396bd

SHA1
e56532336584876ce6408720e6d6616bc4163830

SHA256
a9594a38f5f1b783955a30cbaba3c65356d99f8782180569b411dba9bddbd030

SHA512
e488528380af2326647cc07e24438942f30b1ee3c8c958ad170ed8e6c5978a662312f4f6c4e28a21f578dde81b5080c057429093a5d56abd34de324513e7c7f1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
798823ac9a481218737e17a5ce3e8e5f

SHA1
329741a10d6b82089912c2048e4af938839afeec

SHA256
fe46012e87aea5c97abd225855c583e803e6570f2224cd263c952800c12736a6

SHA512
650d09f21e67344020e5150417676e4eb45693eefd91191c0fe4ebfd8907b36a2cc61c768ca788f4853f24fb81e792230305e80f5f32d3dcd3a04f957d327e44

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
4f8db507e311e2dbfdcdba07769a6a5b

SHA1
02cb981b165c3f9a8c4f63dc92845d6d73d4ceb8

SHA256
333b5c75c451eb5d2231098d08e72074a7902a71928975fa4875a7985e8507d5

SHA512
bca9cc3b99003e132cea6b753ab1977a8c17038edbe39678884bf0370f2292c81418e23d70effd0ec7ee84a58fa33ac7bda4adbf5c00ae7caff7219c20a3d41d

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
6537e77afa866b2b0a58eb904f9e47dc

SHA1
176926b9a20aed2441c0ae23bebb9b599559646a

SHA256
218fe92c9016d2063869ef9617853203158b3bb95a80a3ba52fec942c10def0d

SHA512
0622d39dd895fa099209f54382b584b602b3dd8ef17bd0c1cc5454875f225b3d19dd861d4ad30bd04a0c020503172ff21d93f51a6a175b79b6dda1ae6e530c7e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
ba0dfc4fce45dd50ddaccd444bc52778

SHA1
ec86662863ffa20e017e85942a3577b652ef297e

SHA256
66c8a3d396504b724aa1394ab598ddae9960e6fd95e2014d0f7a2efc33b7fc9d

SHA512
2749a8fa6107cd0df677aac853230b93ddafa249ca34b342687d5af481412ea653d4eca4d858282461d2b91e795d297ef770de5b2244fd6d310f59f1d4e89017

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
03f6e8bd053deb594a3b000dc9f67b97

SHA1
627e36643d8e9d75dc6d75d8e0c8a9e8eddb0a91

SHA256
2ef2913bdb4220e8bd13f59cd47edebbf82ba69270972be958f76af27f04ef49

SHA512
28adbeadd12e68b70a7e69953579b50726e39f5d2c79d675b249b7f0e0f7b76c908167cc1c236c7830647510ae103987e7ece8c34afab865143b907ba477713b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
cc82a497a74df5739bbbff87c1ac38b8

SHA1
d866c57b040155cc66933f14618bf50bb6017a89

SHA256
9334199f4cb413e364ca3fba00bf7ead173de831f2f3f68f8af4ba4884f7bc12

SHA512
4330cd77b13e095b0370a0ca5d12a119c4de52d0d8b6718198c3f508405ae112c0289ed6d7a9cc44f9b31010f8dc5844b4157564a23656e12be1f47cf166dd38

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
985664408ec597d5cb6e3d4d574b5c45

SHA1
5a62e4dfa754e443f85b9eb09f3f5a484b1ad627

SHA256
1aaa5348406686a639ff9cdc718a5f3ed4201cabf82ac1304699e9f33134ff75

SHA512
a00c3cfa651e85f3351b42136116df3986ef6f9f68de8bb1e486e806ea4badd1cd2af109afb76592b4eaf365d122a57dba20e8e2265f2208f4a4182c9116c5f1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
9b22fb71a994b422ec592177611e10bd

SHA1
30349ac852ab8360acc454e301efa5fea8a6d31b

SHA256
edd1e233040842af9fa0958037c5f6f4926c31c8a00b61a40ed4dea3fc6b18f5

SHA512
5a9017fabbf0c8cf2c4567f0ca29a9fe44cd53ed5bd7052bf0b9d0ee9b9df4abb86cd9031a209ba97e8f6f23d2494b1766ce601f15806b85c92cc601f5ad4b3c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
accea2c04d8ddc04a54eac00fbcb51cc

SHA1
49a403cd7ba52293fb0e7738a16b8092be592619

SHA256
1e33dd2e14bf50d35a534bf12211ad90be5c6a5a43a6c17451a944120b87e40d

SHA512
b5e79ec9465bd44642c6068cc8f95fdfc1b0f185b357a36a734309c34379f3102f48790a1727e007218f5cb044cd0ea366188a11e7a3df746400dc6483abaf61

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
6c33d3f99ef7871b7d6d099de7296a02

SHA1
fd3f6e197a3574866c5aa9f0aa96d68a89433d85

SHA256
a8e95893f0b681e6b48826ec77db7e84be00fb6d706f630b01e6139f7a6928f4

SHA512
5747ca8d82dfa7734eff9564dc992d4c85fd225a24eaf30fc14f9c3ac79f27ea5af64a2d27b24b6a2cfa860d9bb5125d2277284ee80863c87d74a9584aa2853b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
f15b2a58a824ef0dbb251b6d386a3000

SHA1
b55df126ae18bee30b4c093f483e2c67577d6eae

SHA256
345c3cb844981f1e6706ebf5bf81ecfaa9b54d7f760a2c1e02a5053cb6dd59c5

SHA512
821e06da995c69dd89c9286a4b59bcccff1a79141db65d50fb52d0fc399802090e5bd764fbd9adefc747427c85eb20bdb5d4ebe24930173bdf5f8d480a34f391

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
94add919f3a07a00d9b42067ae3b3472

SHA1
9718fccf2371cd1060559f7f8e1793e5fb0d3aa5

SHA256
c46076ccd84b33831c152f00288302ab8758dd1c66d7259cd16c9a8a45bfade8

SHA512
294a4530a764981c71035fd99398b333f1896eda032c4ed1cbd3371ccb285d4ac2335a766a65198c67a9a9d5dfbf84f0be6103985640275009053ffd67062148

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
34cb07158743812698eb9e890df9fa30

SHA1
8c062227da71d22af1360ea17868bd458e832311

SHA256
b13162b8ce455ee7f48a01e98fc50537f2b3dd8637e3dea17fc60843893bd748

SHA512
b223c88a480aeda3ac2268730722d81979ec4734cfed303e47497b92888e6d25259a09c5d2e62f1fa622b51d1d7bca0b46aefe039549a0eea786b30d73cbd806

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
19e51039b5042e72835877d90e728f97

SHA1
1a8b35bab208e1c6a88bcaed29b5defa851146e0

SHA256
dd04ab84fe293e9af8e7bbc9ee8776562bccea0306be7019711d54a397d3a216

SHA512
e8f4be512d6dde7b879d7cbe383c49e8ab502dee529817dd19d670e4b42d49f0b4540a1625594b363d4b53413dfadb692ed535cf8add67993ce7140de3a584e9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
ace395388cb106db7570d19ae0e85555

SHA1
87abf27bda778d15a6caacee140d2e59c6846286

SHA256
b9fac0d21dcea478fbb400be5ec02f4674b2d268dbfabfd5139e3b3a4e0d7560

SHA512
da2d9dc1eac74f61a3c79c3e80c34136ba151b27ec1874b51c65df9822026a28a6f3326b14b98a9225beaa8bd8e63c5c2166e4dd9e70dfbe10cfc5d1b0f5eef0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
4158e468c5244d2d1960c3332ed26ec6

SHA1
02c18ac2cde83e8ecb8dc4a332d0c725f25f7c87

SHA256
3c5d21818c1a70a4a4215aaf6ad9085336e9e702f3cbf80dd2d16ca03e796099

SHA512
aa47f072f145f82253ef5ed5b91ffbae41415d9c8d5f6884babd66b096ae882313388b8258a73ecf6afe2f1fb0a1663e235be2742b82b9437fb9371563bfee3a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
cfaf31f4d3cc84ed7a94f8484a163a98

SHA1
f84144abac8f6ccfd3c2f9d94c08e23b4ec1d588

SHA256
18b50e3f97ab5639e973f49f976bec854decde8d7a3b16cc98ca56899ede5b78

SHA512
abc83e6811aa86138dc35126e5d9e3dff07e6c574bb6d1bfc65dbc41da2b0f6d5957659de410e8dac37bc5ed6c451af26401cef14d1de73212fa8348fc28c8c7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
5da72983840a2b5c8a5959660feea0e6

SHA1
451f5b0f6542fdbe003372b94d9ccccf0072fa54

SHA256
1c0d6623063512fbcc8d0a3ddd0e9c475700784393e7e5383963c2674409bd19

SHA512
fac9e08656c51b9cdba1e3915c88a1f8a5d5db6979429ebc1c9d97bedc4ca437c44299424d3fcfe829ec9abd86d0be93038559db4a3bc333318d88ed0a917c2d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
a13ae893db0660a68f69814cd95e167e

SHA1
8dea68dbc1efeb8096e957e437cd8a716889be3f

SHA256
04ab87f0282c7141077881bd76cd8e4cfb1ccb910fb5555f4fc67ebff568abe3

SHA512
531629ef59f9ad45864be671831206e6495bb69ee00d527ab49dd11c6e08fc132cdd9cad9fd5b770de46472fbe0f260fa9cb8455298471f435a4b6099008267e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
e495a25fee9c8b5a05a9e01f6e82b56c

SHA1
2b046af38f98be4f80579cf3735cf3b7b667d97a

SHA256
f1c963f4f1cfe6d940129eaee1da0c8433b8e0aeee22e2399e89197d0d7507ad

SHA512
41d28fbc01e92d9de5d1da947c57c94c1f1a3c1b7b5ed13ec3ff61c385d8787fc5b20ac6944846e0c68523177b04994dd1639ed78c8477366e8c88a4778e7d3a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
e11dee21246a7d201c4353e8395ff45e

SHA1
ec6568971939e018ee242ac14e3fff92dee6452e

SHA256
66e26f8c52e3dbef8213b796f5b7f7b201dd06825303eabd3311633619a7b56b

SHA512
87e89c7a0c4cb635d3bb857406d36d477273c9ba96b7d4f2c269ce30e4b6e6388cb03b5d9c73db59fea42e14a1e88dd1c6847e41b358f0e0b92d02bb31ef65e8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
ae4afd7637f0490602823c8e649f3578

SHA1
0bd8418395b7cf33361610ed4c1944895b5f27fc

SHA256
234e49b2e60c58818ab6b00f7e80771891d377799cbf5d7eeaa102454b69853a

SHA512
2e06744bb395265120107862f18db6bc8830ed4684ddaa165146b2863998019ef7a5931f24ed84e7f58be029e7b60a45ca076c2046667b5aa68e954902ead1f6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
7b38ba9be3ad40ec5917fbbe83444bce

SHA1
3c4ac7c25e0245b5cbeef487a907382ab58f6f19

SHA256
afa861abf347943f695359fb9872af791507d914d8d5d9a149c49689f72b6f05

SHA512
ba7cea34dee5574ce06154f42b59d294b38e0917ce3fea354b7f178e4b46d01a48c5b7aecd9bc31a3947bae797612d36fc1f621670bb05610bae5a1e19e5349c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
8fcf1fa9a977e3b82bc48461090c37a1

SHA1
154aa84ee4af5cfe631550290828d031cfed9214

SHA256
cf1882941f0c224b202dc4944953b6aaffa700d7db3da779d61993c25ce7ce42

SHA512
f37245515600d166a69bcc8bfd381de33030573d8f62055e65d1f0c0317be42d5fe0251f641e1753539204653af98c3d81a2e08bd63bd37f1560b827d958a8bb

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
d17b70d3903532623df94d65cb4b79ce

SHA1
591f47c84a44c6f42790bf86c8cad7a8166ec942

SHA256
8336c4871a9e200f25b181fa8df0d16af913760dca1ec17adf7c80402034f235

SHA512
da27d5dc2800469bb492733be2262d819bd062bcdb1a9e7ccb3abef03772c0524fb15740e0cc634b7e29ae888de9666ac5bed1bc9dc6cec3e83fa5561c79b20f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
91a95d79fb6d9788259a8ca578de8970

SHA1
2aa6641e14bc66173cd61dbb7cd80855b454898a

SHA256
d13ddf1f956e7c714ccc05da8d192bb7b5aa927f8ac91d874c884239edd6c568

SHA512
c41d7ac51a2dc477b921d7a2f59a17186a79ef89ffea980262a8c6a7099e1a1272c4dec7962287a80814873e240c5d72fca4b56a92694fb23a79e5c2a24c8d08

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
5368a1f82b1fbbb4b9b0423d3487059d

SHA1
79961b4150d2ca35f0ace815ebcedce134e59820

SHA256
2339c1bfa9080146ebfb44c61078caf2ea20faf9526c13ae8842c5fc3a6fe679

SHA512
110ec3e4c28701548cc414689f31c9d06582abbf5abe7831521d925b47765033009a22b8f056cec1a86d67fb46ae60f2da04f4b9a729d8d74bcbea0a864458df

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
3bd133e2309bea010a3988c43ded02ab

SHA1
c2e46f67d9a03c9f91810d9a37f19502424ad04c

SHA256
53cd4bcf4bdae81ea940ad66539227e5010d9f77fad66b19d4d5fcfef77f0f67

SHA512
1d37b20735df91f2e12582a323ea558bc2e2c856bddeac12b0ef8497d63b5fb55ee88a5e8730189bc980817ad734b41b5d94f4f963278f05fc29d400ca26d35d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
f986589fb87f90d9220066f859339f7f

SHA1
a954b8d28099252dd4f6539c900c408b60222534

SHA256
3f65820441b71328bec1890c72055879967291e8850240cb2d33809472268e2d

SHA512
a76c034db36168f5459dee0eb06bb6dd8dc96d494215f43c123c02638097a0aa889a8a08417fe509dd1c10c4943379826905e86773a485b9edaa2e2291b62811

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
f96cbc5fea777d2644c6d03e68b03686

SHA1
468f3b816cec5e3b27a4b75b09ad3f859fcb4dee

SHA256
e96b091f29074209a0e98bd7185fc473bb46af5895ff71b139449b1453a4e2c0

SHA512
7309ba1216d43d23bd342bc2f24ade685c105fe83fd0da1bd3b949e1abb2f86c56a067d50e6834043c8a43fb456a2f61b42718ac80025d7f7ff8fa11632c5ce2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
ce585436ad612c101b483d795d4a0976

SHA1
f7bbc6c15d1658d9073c6d4aae51c8b80b9c57dd

SHA256
4845cdc1a1a6b3aec207207e63ca11e5218a6595960231c36d72e924db856a54

SHA512
a4a9ad5ad393b3ef4b41fcb359e68886057f771c305979e4d6f57320825e9de60ea9454d6b914b1338a0dac67691d6efb22555c311668d084681c05af7d3ee21

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
97745488d76deceea718e7ed23d2e326

SHA1
f4c7026eb842e65922facc21a47220c21e195e6a

SHA256
98f91c9103c1a60d5db5bb0dcc3498c61bdf278dd44f7ba27189ebb6b110e8d4

SHA512
cb856737e898bb6c8c5da8117d1363d81b97d79dfcbf5126f4f4cfe64c9cd062e82bcc00ac5f2e4874a2973ef1f737aee02baed5e67f1d321aea649499f1c976

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
3b92242c2134cf311dd1b4a271234299

SHA1
4c8da6b07c0dafb72ed78b965ba2dcc25563ce67

SHA256
5f6fe53fb5cce1c997a6ebd2f237fbdd9b252cb60dd4ab78ae1477877cd72ff8

SHA512
6d02f78106c82e07e978c472c1f607041797a4ccc94aa32fec18b7d83bdfe287a462b94d4ef15cff786dc2edf0c162168535b4cc2d13bd2d6b21343a16ca61f1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
9baa47188dced59eb88b15434fba9baf

SHA1
890c4f1c21f149cc14cbc7774ff48a0173620ecb

SHA256
eef34c50bce2c219f20f285a97cf6d93fe79075e1937c92f1af2830e5dccf432

SHA512
e375e9b63c51fc4b42988053aca88b62120e4342a460319f1d6085dbf6080faf0986b2d390fb236e040abe88eb414a53963c5e5ae2f1f2d0fbf5d5bb96d85917

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
f6d03baa3060dea894a889bc523cc485

SHA1
b3f7297115a71d5b32060c5275f8cc478b390bc8

SHA256
14b836c476dd6cce8b09a9ef0fcb15ebb12a2e269ae7368ae298d524f26461de

SHA512
f4c78c070ffb544572924b3be27775d04bd9d83ebd8a89da5c458bc4c07f706b812ae1db8bb1d0f788e3d4409065a8a088b30f283fe4d8b5a44bb5900824a161

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
37546623848a1a82d8a4350f43a1cbde

SHA1
346598a51a842cdc694efebcafacbbb296d8b3e6

SHA256
84006796fbd5a19ed92b23f9eb24ef1173ecb0ec8012469ad5de0aa9cafc69ad

SHA512
8bc53f8d5296d383d52db788be284bcbbf3627498a8a9e10ba1f4eea9d873fdc1f890a056fe1da593e43e022a7a2c2a29a607d32836aeea81610f08f598a9be2

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
27fb0a83640b80e3667c2861bf97a65d

SHA1
73f0461d832950287af8d64f9ecf00baeba80598

SHA256
57badc78808dff3dc22dc4a1e7ab7cd2639788733fac22d38f39c2f2f2a57f68

SHA512
857ac216e937aec89e9ccd463b3fb909c9b415e894f0074a09cd991844753c569a4c5d684df820a13df777b31bae8ed207c1c75476b90fab95b89de498d7a6b9

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
699d084ae7c9fa4755a35b3e3dc040b3

SHA1
817aca218a239446327c0094b97bcbcd6dcd35f4

SHA256
8ab9ef06a7f9c96d56ed2e78ec8d5486d130d8f8f4fead9654ba7fa7ecd10052

SHA512
94fb78cba59329ce9a0da58daa3a734c0d4d620619d096516bf4df2a4b8fa9e6fad80c7e07c4ac1f41586b242ecf9cb2f548593c033417db141b8318cd0ebffd

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
082fb56c66c541e61a836df2a65be1b6

SHA1
acc199f4f6fb483f30f547b552c3be36f3ab9a37

SHA256
56de841557f70df651bba87404bae0f457f9856ab9899d5c4fd1260754cb199c

SHA512
f9c4bf9dc2334290b8b7bcf8a06e50a780e1113ae4f3083c1db5adfcaa7c90fa2e069b9147acc533be0713aeb44b9fba890438b088816f884181f54e0c3ad171

Download Submit
memory/4808-124-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4808-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/5048-6238-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5048-10999-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5048-10608-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5048-6237-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5048-11326-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5048-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5048-11331-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5048-11332-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads