53fdaf0866002bab5dfef76b3edc45a5f8de91d15c14ef4a9d2f9549275872ae

Analysis

max time kernel
142s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
Size

12KB
MD5

59d0cac75ecec1bf3b268ad7d0cdc34a
SHA1

db8c8571dcb12d4ae096816e2be7e690554877be
SHA256

53fdaf0866002bab5dfef76b3edc45a5f8de91d15c14ef4a9d2f9549275872ae
SHA512

c815c63b6c5c2426cf6f232b631e1a6b776449447e3aa8051a7297972512e6d4beb06e35a650a0393c6fad488ed79589f7c584c7ba14c597caf2c132baaf7f30
SSDEEP

192:J/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRMyg1Rtz7b:JebFNw4Pk1itKkpAjjJs6B40WyKt7

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2484) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BWiDB4lemwP6Kbm.exe"	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\c_fscfsmetadataserver.inf_amd64_ef3485e85c5c1b11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsencryption.inf_amd64_b4b4845819a23338\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\logman.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ru-RU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WWAHost.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Robocopy.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SyncHost.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\notepad.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\certreq.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cdrom.inf_amd64_28c103304ddff3c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_0e2452f597790e95\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbus.inf_amd64_a192dbf28b4634a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\SHARED\res\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\net.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmarch.inf_amd64_1ae6ea0bf54c0f5c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Licenses\neutral\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\TapiUnattend.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\GroupSet\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\net1.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ipmidrv.inf_amd64_ddb154dfd1a1c33d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\remoteposdrv.inf_amd64_0f0da968c1cfce06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\storufs.inf_amd64_a7a5b507fa22251e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ko-KR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\LogFiles\WMI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mspaint.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cmmon32.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ksfilter.inf_amd64_d5c8b2a031c7d5c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdf56f.inf_amd64_1e78e192efc26192\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmhayes.inf_amd64_055d85baabbda8f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\I386\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\provlaunch.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSwitchTeam\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\schtasks.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsinfrastructure.inf_amd64_1ef682cfd6fc7d1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pnpxinternetgatewaydevices.inf_amd64_82b90e51473d48ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ktmutil.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\quickassist.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\srdelayed.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_nettrans.inf_amd64_b6d30279f382fa4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_69b5e0c918eab9a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppLocker\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MMAgent\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tsusbhub.inf_amd64_bd91a147ab4ebf1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\TokenBrokerCookies.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-100_contrast-white.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\Weather_BadgeLogo.scale-100.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-100_contrast-white.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-32_altform-lightunplated.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-20.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-100.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\ado\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\AppTiles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\5px.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square71x71Logo.scale-100.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-40.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-36_altform-unplated_contrast-black.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\154.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_altform-lightunplated.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_contrast-white.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\JumpListSettings.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-48_altform-unplated.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailBadge.scale-150.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-200_contrast-white.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_BadgeLogo.scale-200.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-32_altform-unplated_contrast-black.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-200.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-32_contrast-white.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-60_contrast-high.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleSplashScreen.scale-125.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-white_scale-125.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\151.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailBadge.scale-125.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailBadge.scale-200.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72_altform-unplated_contrast-black.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-150.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-72.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Retail\NinjaCatOnDragon.scale-100.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-40_altform-unplated_contrast-black.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-16_contrast-black.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-125.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-36.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-fax-common_31bf3856ad364e35_10.0.19041.906_none_ea293d31af4f56ea\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\r\aspnetca.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-ucmhelperclass_31bf3856ad364e35_10.0.19041.746_none_b304b89859f48ecf\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-mfc40.resources_31bf3856ad364e35_10.0.19041.1_en-us_d0fa26cda01cdfce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\INF\ESENT\0407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-speech-shell_31bf3856ad364e35_10.0.19041.264_none_0a3e4cd4b3dec570\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..codec-dll.resources_31bf3856ad364e35_10.0.19041.1_en-us_9dd80637a0a77432\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_10.0.19041.1_none_8bf8bd980545cdd0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.hyperv.powershell.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_56bc3bddad2256ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\MediumTile.scale-150.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx-dw_b03f5f7f11d50a3a_10.0.19041.1_none_46d7d57b97bd01e0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wdma_usb.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_5fc5aab9f0e92cb4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-dot3gpclient.resources_31bf3856ad364e35_10.0.19041.1_de-de_303b9df28f24098e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions.resources\v4.0_4.0.0.0_it_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hyperv-vmtpm.resources_31bf3856ad364e35_10.0.19041.1_it-it_7d306046ead6170f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-c..orization.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_6c1535b515f1e6ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..ktopology.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_bd71cce23f0cc16c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoveryagent_31bf3856ad364e35_10.0.19041.84_none_b26fbb1c9e00e3ba\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_winusb.inf_31bf3856ad364e35_10.0.19041.1_none_7be6a04fd552bacb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..se-client.resources_31bf3856ad364e35_10.0.19041.117_en-us_f7f9409ddc9bebab\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPStoreLogo.scale-200_contrast-black.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..gertransport-serial_31bf3856ad364e35_10.0.19041.1_none_c7a69aa24c087590\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-flighting-settings_31bf3856ad364e35_10.0.19041.264_none_66b7f4dd4df876d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-speech-shell_31bf3856ad364e35_10.0.19041.1266_none_96cdd525d5ce0168\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..on-onlineid-runtime_31bf3856ad364e35_10.0.19041.264_none_30bf3c3e4f94840c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..defaultassociations_31bf3856ad364e35_10.0.19041.964_none_983b357fe6dfa2bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cdp-api_31bf3856ad364e35_10.0.19041.153_none_ba03948cd2f4713f\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\r\wecutil.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSplashScreen.scale-150_contrast-black.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_10.0.19041.1266_none_727d8ac8ed2b3e80\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.DynamicData.Design.Resources\3.5.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ets.icons.searchapp_31bf3856ad364e35_10.0.19041.1_none_ceba36fd1b479c4c\WideTile.scale-150.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sysdm.resources_31bf3856ad364e35_10.0.19041.1_en-us_ec2b16af84e09756\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.19041.1_none_d2cf62416598c002\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-printing-platform_31bf3856ad364e35_10.0.19041.746_none_86a981fa20a67c50\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..ovidermof.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_f1e1cd3052a17d60\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.management.i..mentation.resources_b77a5c561934e089_10.0.19041.1_de-de_37eca118745516b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..lelevated.resources_31bf3856ad364e35_10.0.19041.1_es-es_84062fd848ae5154\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..erybroker.resources_31bf3856ad364e35_10.0.19041.1_es-es_84a71b758f502e55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_net8185.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e1c495d7304dfa0f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hyperv-integrationservicesext_31bf3856ad364e35_10.0.19041.928_none_6ee83b5c02b8bec4\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..-credentialprovider_31bf3856ad364e35_10.0.19041.1202_none_57d72a0470694b5a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\typeperf.exe	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-xbox-gipmanagement-component_31bf3856ad364e35_10.0.19041.1_none_98dd0a9878d62c7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_multipoint-wmsusertab.resources_31bf3856ad364e35_10.0.19041.1_de-de_fd50738c2f3b7ec2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_en-us_772f0f365eca5ecb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_netip6.inf_31bf3856ad364e35_10.0.19041.1_none_22cbe777848d0d0b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..rting-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_8c918152aaddef74\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.19041.264_none_34dcc771aa7f6b3b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-scripting-msscript_31bf3856ad364e35_10.0.19041.1_none_50a77b0a777929fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-t..ices-rdpsounddriver_31bf3856ad364e35_10.0.19041.1_none_fb0f0514cdc35272\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-credprovhost-library_31bf3856ad364e35_10.0.19041.746_none_9176e7768cf05100\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-tiledatarepository_31bf3856ad364e35_10.0.19041.264_none_ac56521bfe3760e4\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_start.png	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mccs-internetmailcsp_31bf3856ad364e35_10.0.19041.746_none_d926f3cf9cad3920\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.572_none_3e399e76562f6053\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mfplat_31bf3856ad364e35_10.0.19041.264_none_dee0e3e1e6b76b53\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hidspi_km.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_c74e9a46c40e9add\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-windowmanagement_31bf3856ad364e35_10.0.19041.264_none_3108689b2f24e931\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..-mscandui.resources_31bf3856ad364e35_10.0.19041.1_en-us_d196908189d8c678\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-zipfldr.resources_31bf3856ad364e35_10.0.19041.1_de-de_2077f1012ecbcdb0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_sdfrd.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_6c2d548fe0bc3b4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_wpf-penimc_31bf3856ad364e35_10.0.19041.1_none_058384e7ebade92e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "HSQYOVIRZTLMNTF"	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HSQYOVIRZTLMNTF\DefaultIcon	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HSQYOVIRZTLMNTF\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BWiDB4lemwP6Kbm.exe,0"	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HSQYOVIRZTLMNTF\shell\open	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HSQYOVIRZTLMNTF	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HSQYOVIRZTLMNTF\ = "CRYPTED!"	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HSQYOVIRZTLMNTF\shell\open\command	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HSQYOVIRZTLMNTF\shell	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HSQYOVIRZTLMNTF\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BWiDB4lemwP6Kbm.exe"	59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59d0cac75ecec1bf3b268ad7d0cdc34a_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
ed1db943270380a17731136347168dec

SHA1
b7d0953b876e0b16f23d54509ba7377fde7c5d90

SHA256
3a4a6692c463574a48e74d4c435f11d9699f80799637f9c9f5818c38c5e682bc

SHA512
8189f37f0e1f9719be660b32b01121976ca8e7a1cafca874a1d65c4e8761d2f72efe118cd253d862a949282116ae1ed4449c9dc394e367874f3199a15761f87f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
45d2f3500604850f4f08c60ba1578dde

SHA1
4b5855aa4dd980124007dde3d143804abbeb2ba0

SHA256
39eec8469d23b9fef1ea6c4a0d9a42984a974365b45b63a6c64120cbe60e3d3d

SHA512
2fdf97f19339685a62716399e7586baea8a006559d2a0187e477f13ce0a2dd8d9ebfd49a07e26df04299e23e2b61b3fe4ef21861a8b4d60ee5d6d3549bf9df6c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
a9765ab539ae59f0f75dc2ea84535a45

SHA1
a442e9c021c26e1fcb479d87f6313071c34104d5

SHA256
18e216479389ff126fbb445710d44284a158ce457c8c7295e655fe776c699166

SHA512
6a02f33b22322656341e15b1095507a3987f9a490fcaa7cc32f83629579e9b9038ba9f521fdd480c421c4b4afb89c34d8c2109a58917ab8de9821f93aaf0b58d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
e7268c2bcd892efabfa1756c014a62c9

SHA1
c25a46ec0db405cdf4c00e0ff348f538e5d330a8

SHA256
d58b3837d21e3bcc86e7a894f443601d7c1d53d2521eed3814c32f19a1eab084

SHA512
9e4c52fde1071f69117549ad5148a525b7c1a14a21dea8464686f12c54ebaf93db587d5b79cc37c4616efeaed40234da5aa4b1424c542de5e58c69c24276c283

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
312c510204dc92e7680107e99c0cd8ac

SHA1
a95d0bb91b3722591ba71f41a53cec63a0f88294

SHA256
b4a5641d649e60aa652f2169eda42a27c8cda3abef2daa3daa0fb76ef5dab814

SHA512
6d72ee7e4a35aa6e37055ef03fd1dec5278aa1e4da3483fcf32ebcdddce3e59a3c324817251fa3016e5ff7069b0922146da5f771ae026ad12d5cd7193f1643d5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
6d20431615082c6fc818f6c14c3a35b8

SHA1
887679785dce58b0d9e79cef18874ffadb3a3bae

SHA256
b894631e482187cd7b445c55a40c1c47859810517a3136d08c450a4ccd34ac99

SHA512
43d0f990009aaaf460a10c1c2fd318247acdc22e78d4e137d998b1fdb506c75a1779487d36be928e84fb37569639c9fc7bd5cf31de58daa23643723221ef43e7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
65030bd1b677b18bbd34de53ef564d95

SHA1
5103faefbdc7a807b104b5053e0032df91b7e4e5

SHA256
699a402022355cb66dfa20265b862abfa3ff86b71758821b03b31ea4cd0711fc

SHA512
c0c77211dcafa330d1e481a6c75a93e865704f7ddbef7658af36d5cf36d826341a78346bdad47c58fd3a9db8d4a2ce96fdf9c083c6da3de169807e7b6d7bd434

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
f34fd1fa6c299378e116bbdd9d80a892

SHA1
3e1e40bb515a87004df196d010ffaf634f3ce680

SHA256
01847b0efabe9d01e6cb66e4f66d29dce4afc14c2bf15fd146460be0e929af29

SHA512
2f300b6303610070289689f681cb44cc6fae4e76e6cdb8a2d605d5cfda2c209a50c673ff1d3a0015aacdeac8a646fd2ee4c7158ca5d53c1bfb3c3fbe5611f911

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
c3f0cd8ee1d9cae3f87e0a836653ca31

SHA1
d17dfa6319ffee301a9712b14506d4213a2f7bdb

SHA256
0cabff25fe2e173251757a1005cdb181171c741653a4f8629c3350e8fa17685b

SHA512
6776fe88617b1a15d240e71c16e9aaef02e7fdac8663b72614ce07dc40c7276990aff730046a568f0662a3ee66e5cbbe79b5905c17b2a6c1c55a6b9a22a31860

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
ee330160fd70f218bb1f304da790dc36

SHA1
82fe6a7f3d64b96f355ccc7d7ca30c4ae85216ae

SHA256
a812a35f6ef80af2511661a137f665c4e8e83143cf304178bca39fe409e4600a

SHA512
7d217d30ce3218e48217016a6932d4d46c97278bdc0a84dffe31e5f47292abd82b0febe9d22dcf2ed2c82ae612811b746e4646da25936454d8e940955ccd17d4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
d28cf507cc3f9b8348fb0fa3adb2b9f0

SHA1
cba3dbccd2c348db32c2abdc57a278851810f89f

SHA256
4eff5dbaa6a08529e821a88b3fe58a2a69ca0ffaeb35b1e79764487dee812f6e

SHA512
a47c6b28120cb7b8fb7e01f27256580696bcd53b5740a28b5f188725bba569cac4c89d9e3120ad7398499cf301924117afe5c21a4eaf0df606330a9a3ecdcd46

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
9cad6a4ec166da6eaaa37986fcacf4e8

SHA1
f133a2d2f5dd4ad0d12cd5bc1784fa712540a16e

SHA256
5ae609e1f598bfee4118547460672fce0cd9ccc3b01114e78822c66faf3d36d8

SHA512
2d6c7d91b45fc9d41cdfaf9fdb4d09c91b081d41ea48eae3bf1b7da2d043165e9c03d4339f9e16f6c3f0800c749987880a6b9e1c4ce1552b1a252d635c141a06

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
0d907e1f481490bf0d24963fe4c2b23b

SHA1
5c7e63357c27ec6b53ac9cf60bf88cd8381606e5

SHA256
e51557c26c466a2c3a70e65f3be9d005a819953218661cb7da9e4689a988bc67

SHA512
ed9cd7278ce0c0d44a7c56f42b6bc846b4b0885dfa993afb07696befe554a1abf612726bbeb6195fa6a228a26155fc396b47bd683b694fa1e57609cd1fe3768b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
41660d23295b4bb3e176b75b5ef04234

SHA1
11d9a9bcd0c392670d93c6962fa227d27d8f02bd

SHA256
0b2a473d41a3625be64b7cd149712f01b5d750daf3cf06086efad32ef3b1e111

SHA512
d7e242c1e1d4edb5208a16dd7914c51d6cdd8a8a6bef0f9a1d1e470717b78c3dd50980a2e4fe49e3abbdd0aefcc4379299ca82af62f272471b0885e5392c011d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
e32a07a0d51e0359d582cf91136bbfcb

SHA1
65b4d93152836f310f4b13ce01bc2fa28fbcddcc

SHA256
bf1c3278d453618046280d428f928f88cb3234f8b8f6697087d63971ba6a4983

SHA512
56781440e2f00d4af37327c83e43d18dc66bcebcc7c26e85ff9cf2113af820e9a3bb7ef08c36ee6567a5d24dff28587b5401e413dff856f4482f7b978971f0f0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
c9b8fdfd5a0a250b12007cd7c850ab21

SHA1
ecb9a54c0d0327f08042846c85e73875373353e5

SHA256
bef1bb5f7ca92b8b0de6cc4779abf32cbefccfc622a241f3b1f6b94f6e513ad1

SHA512
b18e2979367e782d5d28d9f92705e675ca44f182b78552f96c0e7e1f3d1d08cd6a185a719a63f875085838753d4d7c18024e1e023feee89f7d9ec2b99a8c267b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
7f0880577bf6f7be235c9084302b2a1d

SHA1
b63c7b255eb2a893cdb802c62830558c764ea803

SHA256
c6a52ecddd292bd6fd6f08049a51457269ba1113632ab9cbfe34e0a29b82e191

SHA512
b576b29c9aca8fdeaee414f0488301114db00f25e4b395fcc049f246108c2723e8062e80db240e976f62ecdbf6a1e5fb88e5132dfa6f24408a610c1850784ba8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
f08debd896281e460f3810e7e11c99e7

SHA1
0e5e8d2ea82054a6cd7c0de4f8d71a3fd4946c47

SHA256
ae6e95b62ebdb2594ea187c0540d4e67323c1211adb6f250063ff622f8482217

SHA512
9d1dd1ca0388f415e61eb32dc071fda475769ed480cc267c5bd18c30f5041b13f7007380c2d6eaaaeb4c5277790bf01a31401af9a0470160cdf98bad09029acd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
d968c570aa455b30649b8eb9f28056c8

SHA1
c819247a80c602a56e18e180b833b1941c516ee4

SHA256
b0a285897facdbf95056fd5d854982ce70b18a02d24aab3ee50c051e9280c405

SHA512
1e582770567dcee6d87112aa3f1724254ca36355d189e1c9015182f8ffbfef840caf582b69642f2d194de071168cc5d8524013bf531870dfe3320521aa5c47b3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
460197496b4d7659403a3330adc986cf

SHA1
e9803a1a1bff527be27ca366aa58067d6720f5f6

SHA256
c8536d78b52acec1f8458892deb1560e37d9eeb83ca50842bc5ba9fef492ed13

SHA512
c87488073b5a0b76a570feff0a462b34958fc7610c3591ca047135079892b2869419ff48fd2c4f4ee5e8af605d6b822890ee9aff1bfabc0dfb146efb897e8024

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
101b21aedc3d05b8341748c3896a5839

SHA1
a6240f8f82ef2249828daea63db4ab56856490f8

SHA256
e56f34af2ac776c3d12b75872410cedef06e09cef0d09edd2413b8a11d83eae1

SHA512
a2fc9cf5db4eb5e8c3e3f55703137caf2d4afe3e1eb258cb4e1770d0ab3a36edc9dded667fb86d85b1f1aabc9c79ca3b8374a782c3ca18a673da77d847ef74d0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
45623a4781064fee7dc9f37751203167

SHA1
061ba77924cd76a5ad006cc30a98da852b0770e6

SHA256
afaf905b4ac1bfe316dcd697933c26bc792811c8d17f0e33a275522d2efd2cd5

SHA512
2b12b535d88d9f7749c89f165aaa1cd277df6113a47d5448bbbbfd2638b2fc294c11921680b0e6f6d1648533387fc7f2b9d7ef339d53b768fef983ba99b4c2ae

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\faf_icons.png.EnCiPhErEd

Filesize
6KB

MD5
a0dcb5211014c1afdfabc1be83e4572b

SHA1
2bfe65f92ee27496277145a8e9dd116bee3088ec

SHA256
43f898ca3414305b5891998f08bbe7dc7d364fb0c95f1aa5596aa1c8e3ac3ed3

SHA512
e017c25af45261a31f94699a0b1b68d868d2c3e226dc607871f8f8bb718c6998dcc30a783b412f4ed2b9dddbba68db26b987ff63885a7ea77c10bf9dbd2acc5e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
da08a5fd53e84a7af52048769c307c21

SHA1
ca824bffef0c41d0184408abe173dfe93a83eb54

SHA256
c99ab0c3d15a90bf5b4a293b6d51cba11a66483a08916a783a52a2bcc5662959

SHA512
557d4210df415734afc9100533f1ab0766fff167773c4a5de099d4cee3b1eb27fbed1cc5ed5df85e614bb1fcbbdd960dc3a114bc8a841e4335f8c629dc51d831

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
bd843d337e5e7c6325c94240cef5b4d8

SHA1
9ddc5ec26b5e9dcbe33d9022544ea6aa561e5fce

SHA256
bbe190d7c95be067913e39c92367751a0581531e7133af78b18e67a5c67a0e73

SHA512
ea0d88394cb487090738cc327534a59c46f537d57b54ee764514ba9d59f678042bfacfd447a2cb2d88e60900d516ea26ce7908aca8986644abaa686cb4a15ef4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
ca42be756d66b771b21133910669270e

SHA1
b049d99693f353c5a62363cbb3c3568384bee7ec

SHA256
80b1e2deeba6973c077347573e411752f72e6b769744386af04f60505a16018e

SHA512
8c9fe8beeb0c981372aa13aff2f19eb5fe65293f5290c4d12a1c23036a5d26af32d0aaf1d1223e0b53bcdb8fb70ba63d377c8c53f184848edb13f42430925604

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
7b35518b426463ae23674f8f1eb1eb81

SHA1
84fb6d096781f62a2564cf240f461ac3599e21f4

SHA256
4ace3ccac6c07d620c9e47c4a6fb13054f7a070375689967cce890b4eb7335ad

SHA512
5fc29c56463dde3048d1f39b9f0d4aff628bc77da0eae5efbe9841b4b62e3fb1fbb743ade846383d8cd517c033b2bf31203f4718f5501116cfdf6ac02c1d0c01

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
06ff6fd9a00f2f87b11239002caa3e72

SHA1
44735e6b22a354bae6678ae0d5eb30042b4c8870

SHA256
ddc7c39a70dee9cd2bf28ccc0675e0b6604c4530ce83d5cfb302e71c90646ca1

SHA512
d884bb9c54f4ff4797470ab4afc78d86ed690bf1204b25009339726a4ec16c7d5af7e13ceabab4bd760614571a7f34a581db4a9aa40333053038b9734a39435a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
8fe13820cd54c7e206e1cbccb7180086

SHA1
bbb53514d8dabba03639af8ffc78e3503333607e

SHA256
a5453967a99727d6aaf10c28597cfb69b59995c51bd27998f8df589864bd5c28

SHA512
deed90ae0074e9ad4e5c176172ed30df661287b716deacc9b03ae7ddccadf5027e274b9104643d06668127e22d4f62acfcc7cc3c40a660b43741aa8524b8157d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
bf142ae8d6f9b093c9bae703fe232dc4

SHA1
561889d73436e2a210ae8f33d93d41e4fcb168f1

SHA256
4a53e6e3540b72b3e6bfdbd8f97fa29150e4579bd9b1c7536a3aff9bab308e6e

SHA512
7420e0481de565f063aa89d36b4b4bb8202b63c2a9ce198d28ce202c5fc805d4a813a5a7ccac44fe944de5db01c4e389000192d8360fa7c4221755d6287fe099

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
2ac6ce86b5f3ac1c8b37e28d4da2c469

SHA1
a52cca445754fd8260bae9f77adfc46ba2ab3153

SHA256
c8b90e6639ffa442d481e63ea35835aa0bf43c0694158e09cce2b847da8d7193

SHA512
22d09dc23f6b9a9d558e58d8cad8e81ddd7bf3082ca66f406461ec3217f991bafad2c392b6ae2de9d366e990a44127767f923ad20140220c5fb2b1c05b29d258

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
5fb0fca7bb3343788fc4a143729aa163

SHA1
0806534880994e756c81895499b82ad6a0758bac

SHA256
3e47690c06d626dd10ee1e924fe2f6bbcf4e492ef857da4221a8a0f2850d89ff

SHA512
585aba3da69b083f7eb0f50b4b62d334004b09bf419362adb07a2d2277f16f30271755c8e440672c7d49196c60b039cbf26c534fdc2cac0fb682c97aa92ff597

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
ed6b7d4dbdc6b526319e766e76996b56

SHA1
e88008c9e9185ce1bb1d57557b22aa2eb7457d7d

SHA256
0ca8219439494b260737f580fd96762cc3e9ac39bdcee107354202eab5570667

SHA512
1c9a6d7816274e76eb192860c7c0f419a73c3e8c41a1ff74ed8e3ac95e730f2a3f407a9baf38fd6de142a6c542e3abde6221a8e435500cb1f03f9f6aaafcedf7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
f2ea09a992090c8b2515de8f9d774c57

SHA1
4f2b0d4aafc5aa279e453f844213f09fc82a5565

SHA256
24df78fe01c952baf22d9c1f8aeaca2d2480ad8ae554d173045f121063cbbd97

SHA512
060aa1b345c6895cd7ad4014cca141cd21b2b4c82552d0a575d6043f0c5534d03a151ddf38e01e8e1178d9caf95b047ae5624417294c23ee07009b027c5fa6f5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
a6b045377a03c3a654225b81a85d710b

SHA1
09d1c558f95ba3609095139eb539ba7cb5da12fe

SHA256
873546a4e12f31aca79006a0df38657f73e27431ba2518f85c51591445706cbf

SHA512
abd448e2dc5e56ab6dd726671e20b813f3820326060fb56cafaff7814e2fa3b27320d716de34954f54dc8f4db977f3f4af4d5b5a118c4336515b0470c477679e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
055e1a2e1eeedd645ea758c065fb0714

SHA1
cceef82a3cb86ce23f829ad04d59e677b65390e4

SHA256
818cd8d2d8bf2d0353f8bd2535d646de374e2aea6958730bf57783a52899d2df

SHA512
52d77448eb0e79f52916cb4ec06daec3f8f1425073312cfca333d56c8cd7091b2b2e3934847f5eafcf0350e5e0c62a662c84e73822373b8e4b4e5daed058c63c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
aa7f77eed677e416ab8449b7a8404b66

SHA1
4707953dc504685850e9dc45d3e811f99fa77ecc

SHA256
5e4f4c4659032b6a32e97d0778dea1f25e51d76e6a94f5fb5d342e080c8af244

SHA512
d23218cfe600bbaa908cee089b0570f3f0193e956abd4bff4163ee30c0e585d70550b89cd0270b6fd83891b8f8c89d66e00e5f6912ec3906565821ff70278c98

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
f6ed2c51402112740f8465362a315c5c

SHA1
38add85ae7f831b163815c3f41e537e73ecdf19f

SHA256
b81e3c5848560c8cd3fd2876da214b91acfb74033dd51f527a447bcaa08af3f4

SHA512
988d2a2129b26c23e4d1e68833b22ec193a620106a8a4739a5787384d38ed9653d6f82b50a3ce0149d66bef78bd429b6a5b0c77ec83531c5f2f92250dfe6a325

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
473B

MD5
cf227889173f1a1502b25e3412f4fa6f

SHA1
22388402700c1e3e9f3fb1671161939d121617e0

SHA256
434aae0caac7d43268fcc46274362a589921e3dc4681d17529e3054b640a1af8

SHA512
5cafef02dfa30bb9eb13fe65613ff11971316fcfc7f430ab3281312bc558df45806ac9609ea746758afe402ff52c10f2643429d4722c16e3e4f4dce2376d824b

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
3b7964ef2b45f8395414c2fa59222f9a

SHA1
cc6e0643941151489c628736745111d94aedc3b5

SHA256
766ab2cb7548a38ec9bf88a2f6205de4b328c26457d0ae4087de75b812ab0bd7

SHA512
cb68c8687286cb9056a18ba1cd0df85a72d40b12a4f26c945f24503641a8d18d26906403a758e903498c94c61b86bd0a22220de46722297ef8db3216513caf13

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
94211fb947f1d5c6831b4cdefd1031bb

SHA1
5eae1fe4d82125d2012d0955c875ffb6a8d0da34

SHA256
4894ed30c35a43ff2f0af8c6ec6008991cbe830140614e22483dbcf466f2f819

SHA512
5736e682b1b1290ee9dcf2c949431ca387af57c2c8eac96fb714046c5059e8abec51e65e3597b7d3384cb7f70dfe0697cce26479d61b229c687daa46013b4d9f

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
3c2b62819a15b651acffbcff45f8cf1c

SHA1
2ab34a70a66efa66a92bde6d87c15d275d7d5d9c

SHA256
9e0f76d988cd3c991d208ab60befe7cb920341750d7c80508a21cd920339ef8a

SHA512
423398abd1997d066968ad83ac6c975eefe5960d959528ac58048b8aeb73c20b465f06f740b0c89b3f8739739a92e37fba7e26013ec56af540e4b89f1b27115f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
502a0d7e9f090be1efd41c61702bf634

SHA1
eb509213bbbd0f3c245560354cba3323511054ea

SHA256
20a908a73e1483a81c072e2c1966b8689e7569b137a093dbe44e270b6e3e0bd8

SHA512
851476ca0769b78d65899d7c3b667fe1c96a324fd281252ab0f4571b0e96f96b6a70fc4a12800e3d51f191b258c9d1745076ec9d62820505ade369940fd36669

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
7a13d63f35dfb327f92d1747173e0ae7

SHA1
607b1f4a6931d8a15afe52fae12e82f985ad0b3a

SHA256
ed9d275c2b0c1af4ec68925f2d50ea29b6af19269147462b79d9b8c564e692c4

SHA512
3fbf78153b406f2294649257ce0109f79171e4a7ea059be4add98448000163b58462f7474939297b4edf5229380c47b171b7835b653f1379d0b16af246600bf2

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
c02b010e4f4d6f3e4841510ccb7a98aa

SHA1
707e1959598a78d4485b082770dea600bd34b58d

SHA256
f73022670a8c057086b6b03b19eef5de74cf1d0d62b1194336b33994adcf0261

SHA512
9001704746b4ceb6b8cc431898aeabad3610b16712e74007b414e0447bba46f4f46036a41a3950dfdb51dc75dc1e102f48224751fa534110c9c8ff2801c3e99e

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
047dd728b8a2fb726b4c142cfff7ac32

SHA1
73d1da632d620d8b384984108cd36ddb54b6c8a8

SHA256
cb9a32be2200b662ea8238b46a72043f9896fd6e36891644e1463a0d6723f320

SHA512
0165400594f61272bc73979175fe853c18b196b7e37e1a11b2109225b4eb1ce8588f6f0276f0469e30bf2361f457b8e2fa1a89012dd83499ddae7b152da7e9c7

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
422cfed36ba75fa2db948f20131096ab

SHA1
fe99832fc735933974883a1de65171c81ff7b1b7

SHA256
eb248adc50bc0f698cdf70a0dbdc3b2060fbbb2efb6e8782f99a8f67b646d8b1

SHA512
d7367e7d395a8e3042251dcc5afe1e335ae146bdd31826633dafeb88320d526c341329af6afa9fbd36895b7c5d43b265633de9b677d5881faac4ef327037128e

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
34c7122767e81124ac2a37c5bb41d2de

SHA1
04e8563f37a214c70e9bcb295594ef5673c08673

SHA256
0e144005be5a9db164af4a9d6060e50a64efcaca61fe033a2061c34364d69aed

SHA512
1b27e4b899b17e9715fc4485bb1515a7424ec3bcdd2c98560aef97755728d980467971f7c5031cd89b688a0788abb26d9ed19a2cb08d840ed81d11ab4506d973

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
99d6fe87f33e7bd92795c7da0c69d7be

SHA1
13494f31bdd7ede68af25a43a3c8546aea645951

SHA256
2517cd2689739d3fac2ab8482090376f1d77d551be260b96120b4c60de3b886d

SHA512
360c8758e9a2242a78596d23b124cc3d6f37667a61eff2e4b841d21d17ae54f76d0a2a967f31014831d1d53c364cfb01d52277bcd034c688ccc01bcf60b489da

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
5312697f3e24ef0001aa4d3b719de2c9

SHA1
cf6f4bfced33296f2e493e3038d45104fcfc9985

SHA256
adc8f6ac73efa904927b54dccee6fe7c13b5628a1961f1ee0cd238a37916176f

SHA512
2fb3c529007de5a6f40560bd81e0ae998c6d48ec31dfb38a05ee15b68cf5008bcc7d5c00d2a67fb5e597a8322f6bb344ef1e32b7cafb9b2d39582e8d02dffbd1

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
9f5f115bcf891033f7ed69f8c851a436

SHA1
542c50f9c47e7d32043dcf6cd47623e91e35ef61

SHA256
3880b792749e6168ffe3da4752222ae3bb5c4a255d9df369825aa1332ee88c2e

SHA512
bb0cbfd0e01bf7e073d622aa095870ff2978b8077bc43fde527df96e6231b2739bbeb94a09a127e5efab329297a6a41f731862d5c138e4f05f1b1fdf299d2d6d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
cd1328b8bd1b251cac49e2960ca4380f

SHA1
30408a923b54e954a73a62fb7bef00cbe8da7a38

SHA256
c153c9120e113f1bae95fb81f40322ab7419c01d29eb2b762947615982ddc130

SHA512
2586252182ddcb71191021a63eb463b638c2d64fac77a31617634c1c0bf8822e682d5cc6b5b8210feb322f07beb669f82b2da6ab6841639659213d7ec8a8734b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
9d0fb25cbb1fc140f5a3e8c28479ba3f

SHA1
32190e0d8dd75f05870304e6780f96e62d1921e5

SHA256
3dc92e4ba3fe4d5e408ae68b6eff963374cbad27ada1cb166550f67699b7b8ca

SHA512
0111f3fc3ff20b0bedf3a8ecaa7916020bf363f371411a1c827aac71923e4c4a2eed1c186f99c8758d844670ef650970de4a56ca56d4eac838bf53a230a3c413

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
272f9f16953e86e08e6c0ebdd0e0f9f6

SHA1
a34d192374718e514c2de54b9fdf385547c27399

SHA256
9e99faa88c582a83930a36712352d037906d85e3947bfed8425730ec6e1c83bb

SHA512
cf9c9d469df4f30378128290c6ee31ed0db241cf90f5d0b0fb6749ec37acd3487283466947d67ca17f1376b629b383d506a9021e90cfe54d728c1ae22c6e07c5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
57690a78438db81020efcda67f7215b1

SHA1
e1f25c9866a94a5a397ce906b5dd95d43ece1999

SHA256
421a48b6e03c5cf06df5b8ee0c4c832c12c335d99375c0b6b51dacd3398f4864

SHA512
66dd855eff151ce45822398110a38ce1b8d95bc24fe0d81e9cb49665f5323d2a00eae8cd1ced4a64324f7ce64e2cfd8663279a2482a5126f270057ad2410ff30

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
3e632d246869ee697eb8b5adb10a9f05

SHA1
9c9a7527c1070127b8a9175a9418aacd87e4d016

SHA256
69fba34dcad734864763cde7d4214dc3de3ef6835b6b35fd43b73859bf177839

SHA512
1550a1b3cb6cfb20a17d04a04962e22e504feca455f34d012cfaf80919d85d790c971981bbacdd6d975dab4089466e1fd5afe9b442411d8ec898ff789f717e41

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
16ac98b7ca00f924759191392e94c0b4

SHA1
8aa588fa498ee4fced29fb2229bcf3c8e1f546b9

SHA256
57323552ba7502fbb62715efb8efaa9e7fa0adb4c7a17c63f0c85ba4efca06bb

SHA512
4b303897274766d1bc45d714f35ff1c30b96fe2d55f1e9c43ee63ca7c823b09be01d341147cf36ad8c0b0331654016b95512720e9eb9ff447bc1996390fbe76f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
621f15fcaf474f084f5e5d7f80297b75

SHA1
4aaf0f1d4c9cbc14b1dfb8543ee09d57e1716da6

SHA256
2e30ededeb1e1bf6a27f017abfba0cb78f2f69e39c4766fe43a660118c80f733

SHA512
9624e2c1929aec885df7eb802b1d39d26e3b2f10ee0dd08a869c4ea50690473d19e4942bc3b25141ce8f9a373f28603a22d6e09857ad792f76ee043114368dff

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
8bbbe6f6ab75085f234de789dc530fae

SHA1
0e2543687f89df3bf8c736f574d4d50d8ee27284

SHA256
2dce482a26b0fdf25e9deb42402eec58923258edc039cee4fa7ec55217d6585c

SHA512
d43db94b73d6c4e7d78da0f89a8420d6d080aacbc63365170f83eb45dc12e7248d52bfbd4bb6561d34216bb3d5313042cbf6316c1c809754f08c39cfda0d077b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
743ed0f13061de93f597eb5f7337677d

SHA1
8b593b6ff0e1f3acff9d7ae7ee94d99173327081

SHA256
3db7c2bcedad5c5a70286431fde56a16371e8cefd36c650a6b79c3721cef185a

SHA512
ef52eba9d7d6d9c5972538d80f7b4541a8f35c722759f3bdb77a3434c2f8c021592cfa280abdebc105b2d738a2abd33e246a7d415e8dcad9cc760152929daf70

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
47259ea9645ee96a5984f010fb147259

SHA1
31235eaf95a6e522a6982e7ebc03f5d16edda32d

SHA256
5239a550bc9875f0e44a8dd9b2c42dfeb19c09bff84524cca24628ee50e522d1

SHA512
49fabffd379d44b6f39ca393a5e2f948f44ff4c96cde2833d595ee508f76aca340bab6450beda055c08750941f4b1fc842ed881d371b1e31961b108d8ee8c629

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
58a8a42d2a1e012f89c2ec3d522d70c1

SHA1
f5871e4c64ab86d3429fde71b55a0a0214f51a84

SHA256
5c07ca6b0f31e810d98a5eab1aad7e9aab13c908b650bad1218927d8d7bafda1

SHA512
575db814e2a833f81b7e12d8b606fe175f753a30beabc8ca7c7a7f9fb6dffd3776febde9a0b62e6adc126c6417e58a79fe743e32179fbbb52ceeb6749ef651ab

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
31ce673beaecdbd5b8a66ffe4288b62a

SHA1
3540151647f204ca6c58c27998787c614c66900b

SHA256
b8d4df9f8101c5d675db8c1f05ac7e5380e09976b2d7122ac80ea7abe977ccc9

SHA512
3a4f17771b320bbfb260b4c7ad31b39e261bece5fb4f3a18401accfa64772edae1c82dd40e39a9b3650f99a67039de233b75b839c91e973c8b06406ef18fcd57

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
e25a908f9178917d95af76e458356324

SHA1
25e6f191fa988270ee25a414a6a53e9b8646ff4d

SHA256
4a94ecdecb07b282d2a5a54eb6ab39bf795937760cded37e70138692d40c9415

SHA512
7c68a927630822482e8927b5f3e67144dda4b8673ca572bf558fff343e4a7bf0fa1fd9a96826a0e336c1fadf10b7a3b0db7e4e6073c3e0c2b27dd5a86fdd4031

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
78eb72871f772095ee289ed231a38e01

SHA1
5bf0cf24ec8845d1d0e4697b64a1b036e778e5a0

SHA256
a0d01bef8ea301c3f4eb9c13af89c39cdbaf00f510b31877ca5096830c260b8a

SHA512
d7d374f541799a9b68fd8916d7304fe6609032eee80a4c2d85aba73090bb4aa401e98d8225bf549385e3bd859eb6d4160f545c4aa5ab6eb015d55c0ec63e1fe0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
010d771ffc0dbb4cae6471e8bca9328a

SHA1
a730bd646700e5eff30fc7b26d868557c2020307

SHA256
f15b1b2ac0bc8124fc1d23764b3c1fa203f2e5831e0de603314874deae6ae1c9

SHA512
921513f9a9102b17b1853e12fb04201021513e1ae7495e5a41400a4fc2f3b66d24794f39fa423a02a9d1cf4e37753fb57fade17aa10fb4a4c3764f146669a84e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
1e708142f01e55e697aced1258c588d8

SHA1
49924bca93213a28dcabeb67370873bf7d9c4280

SHA256
031494fba1e4dfe9c1575514ab1c1ee0d580cb3d04b9a26ca372bcfb5fc56f55

SHA512
9bdc622ed938e5ca80cb910503e3295db6c807afa3c93550309488693156f712b5db995d2c6f64e4fd0753f04a89ad039061db6b7ba370def30562d467f72653

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
c622fd78d8e29daf627a7597b4866883

SHA1
4edfb41caa00bd02dfe5142bad3f4045448cd2ad

SHA256
35385aa09834a51922123cf76a375791b6de1baca3ba56785a1a3ef913a160f1

SHA512
a863de7fdff02ba500b6a2050d20e364b312a02e0f1ca631c76b54d04408bc19d7cb60511702a05476245f0f310642f2d49f521def7bc01d98612cd240214a75

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
829e7885ffddfdff7fdcc87c9b3af23d

SHA1
0745ed102b5c5024243eb72594c4fe4464da6bdb

SHA256
858773ccd4c70f994bc86cf444196da210328727a64b2f0b4255f191766067b4

SHA512
f0703c7c4cf162568d46f4b77008ee6f78e77af2a7a4d264f76410bae93d6dbc575abe9f02b13a11655438bbe3d31e8a5eeb88ebc222c77ff7b3bc325035da96

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
2bfb4e35a0c854a081d7445b7228b7c3

SHA1
582c83740d74c426c343f83066762898ee0ea4af

SHA256
add198d097e7f8d850741d4a389449bd0bb2a5d5762c05313303a1ea4842a9d8

SHA512
8fcab8d252cdc316a7709ab867f07931713c405b244dc6595f5e70cc75e9d09d06f2a6bfe7049fb52989fe67b0b55e02e4b116d4ad9c88166be99d26468e33d6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
1b49a41da2c4ccc85b40280d7bc30d78

SHA1
fa599433832b1d8276b15bceb04c995abba92cc2

SHA256
43d3632f146cac9fa9bfc202fd53f0e4ddb3792905bf771003862970f38a6f00

SHA512
053b1778d1d67093dbb0a9c4bf8c363fe4019ca2c1a5c5561d89ddfe4f264269d6e6302d20be56e82759c53e5e247a782f1f15f7f83d4d128c432b50d0c12c39

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
0223d0d1abc869a518efe2c8b336c73f

SHA1
325476df9ceaaf261eec2166c04ad37203f824ab

SHA256
1aacd6ab62a5408b41677eeaa22e92eeb10bf274570f02c3bf15f3a34f04b247

SHA512
666d114edbc6b57712ff051ffb2533e52255fa857943e05fc83a3b96c9caa239d75fc258896cea5fcb405fa9baafdd7449d14880c37a58b10ff0306dc7d343a9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
30db27b3ffaab9785873e298f4868e3a

SHA1
cfb1ff94638f80d342355bd815ce230f494ba45a

SHA256
a3791cb36e1f0e0d95147936a21ed4c7c2f7005a17a2058ff71f7927268a07e7

SHA512
679bb947decaac0055d5adf8c34eb3a1340eb67ea84e06039fe6e54aeac9b815ab5a09fe2f74b138476c5023901a6e5b48809c2ae797c2a73aad3d8f715c1968

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
9eb4fd1c2e2ce612b6dd9a63e3ddffef

SHA1
6163db63fbbd523b0ab63d53085eb5b3fcdaff1a

SHA256
0df6b8258b9c67aed22ed1c2dd767c5c71f2695776b6096a433367dffc04b582

SHA512
b49fc3e5c2dc9978ce6fb342db11ee8ed0028324221779e1e9f51a856905497f3949883f3a1a3b0dfe8285851ac957c47a38370fff300161a4d4bf5228086e20

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
cce726f7bf3055e4a73f5e9ef8806746

SHA1
78579820dd34ee58920eec91b452d7d69f879108

SHA256
0626e5abc0a27a7d73caa63a58c35a9d8ceb4f719e079cc41bc04d890ecb154c

SHA512
f6abb701d4e4a003002243b8de27d9e273f4eb4b378975a21002e291bd590136652432ad541adcf0ef1a76eebdaa0de65b08466a5aa6e79fc1901dedbeef3729

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
e52f0ecb5c4c27353b09841ea126cd88

SHA1
86ebbde148d0bff542b914b1a091819e7462ae29

SHA256
f45bb8cc1a2d54206097a69a1a37bbc4446c6d11fa179283dd90f2067e166b76

SHA512
8039336b2fafab12c8afe5047bcb877ce240bf3681f77dc013a258243c7d0d6e38f2ea4ab31e03c1d693f8c1b517cbee8023b5be98d4bad4d6d46e11bb6c12d6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
a0e1e26c50848ff7621cf175ca7c1a04

SHA1
61c649d676367ce68dc125013ce88d37451c16f9

SHA256
77109e69f060f21e9a64f9d51f60a7c1bd3fa969a65b84f306d16c2d25895da6

SHA512
c7b3d81da2ddda8634a726cba1e067a7c4c6ae9dd59df605e9f80f325fc9d193b6286d75e1d1cd322b2747a11f2f669dc1da98be231e0276a9ca7d2147cc0056

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
3d136ee918a560b900ecbcb8b5a0a0cd

SHA1
86691c889fccb40fb296ca924f66405b480e6110

SHA256
e7f678586bde4bd0c01071cd84a42a8c583c2dec6e5bef5f59549c0083ac287f

SHA512
fa8ae57847e4b2542f859e4b05ab3f15df0dc2e3bce6de3b6128798f10e0766bc3576eeddab6db9a9f36448edc621886a8c55bf43b637a0266a84cb2ebfe70e6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
9943e6b985d5a202c48ef0bdff75c62b

SHA1
923c31d18125ff5790989feecf0e3d79b74f4c0f

SHA256
1ea9a2ffccf6ecfdb8110761dc5eef58ff8498b6b0b6a3f4cf87638029808af1

SHA512
4192c66e70b9481868710891177cf4704333572449342b668af5be37596754d5462294655eb3d6d60893f62905281c2934d11188b53385cb35861d922d0ba5a1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
c6418d3c9b1f21def76ba123ff8d61e6

SHA1
f4a7f0b13b483735b5aef7436c9c6692a43bc67f

SHA256
8a634ae0a23f45a528ccc5cc2a284eed2b85b22d15c9db2e727786fc5ed793d2

SHA512
fa9cf68ade3e2fd18aa297b065d9ece65fd54ae6bab56c1a050caf96d6d3da1e621841f55d1e841aecdb0c64f8e0d244094dcf8fedaf3a7655af99014d05293a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
38b401c46e34a7bfdf16d9c9eb35627e

SHA1
1499b885633ffa591c92ed35e994b6d09f2d7865

SHA256
2e86c84cb6c6da8c88dd8ea7c1e54881fa241b1b180d961685ca823d087e8848

SHA512
75dd31973fa95d62a616523d18050189453c81c9b9ff3934323a50e7ff51f7a36417241e8d16f36548efc61016746fd3dc32de4670a2c21348388a695d8ce5e6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
43caf75396f495da6b72507ed53209ed

SHA1
c6eddb9601d70d2c2121529e58eb8ea255328b77

SHA256
0df534075760356f90deac9ec1afc50b6968e94ca0e5a684ad1ce9cbc245fa25

SHA512
6b136c190bd6b20fbdb7e0bb66d05c960e1187f85336e0e3bd47c86f80910afcb3bd2a8112df4a8f90aeafe9f8a17962541c0fbe0996ef3bb9d37e9d5fc2e3ee

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
72fc856497f9505d374344301e64ea80

SHA1
72f7f8431359b92890c9a11da44f79cb902b1934

SHA256
09bd1c2243741e5a32089aaa7de8b4bbb2a3b4ec748a345a7cab0534b6ed97f9

SHA512
e64a1029fbe795d95ba5dfe0a196031dd49c67a206e07b19b4412cfd69f95f715018bcd53d557500e748ce2374807a98a406f4f73070a4a804052ba63deed69b

Download Submit
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe

Filesize
1014KB

MD5
825509361f9775fb55acd3b0769c2c91

SHA1
b6715d56b7d47091eaf348bc64f02f3f3b871e97

SHA256
c9210c1b6e43531f978b53ca825336e91939daacffc9ee3a547b54bc199a184e

SHA512
1419eea9fe0f6ecc86173d286326d77ca6ab22669d1b9ce4b2876ec7f6ac5e555471414993503b8b18197e4e42236eb53ef37a5f0d173e95c81e641a90ab9915

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727655840085328.txt

Filesize
77KB

MD5
ebeecfa636bb284c4c7414c0fccb0cb5

SHA1
21202b2fb61b1b95235a02954a64bf55c8a2fa59

SHA256
620aec42fef988c71ddf765f24617fb7ff62faabb3c8a0a51106f24f6526713f

SHA512
2629cbf7ef449ec6c2e5d04973ce325388919c818c7ab73074108a4dafb76b88c0cac56606840abc8c37f696069151744ecdf137982694fd2846ab30ed06d78f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656363999749.txt

Filesize
47KB

MD5
5d15803733d384f79cdafd777aa9d015

SHA1
b4cc6d096191f50321ecb3a1e13e4b3907623864

SHA256
d9fc3cb41394cb153ee1c74375df8fa535b39f655db7030f87305b82e4f83a85

SHA512
92109d937188d24a7d50eed20058804d6dc6cdfda4c8d010f32b9903556fdb9cd3846cdf3551dc83359cbaeace994466bc779d61ddcc4a40c95f312c226c9140

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662640605367.txt

Filesize
63KB

MD5
21446b9dd42d96a6f78d2f9ddb83c85d

SHA1
b2a106436c207b29dcf101fa2410fd89b3dae928

SHA256
4d32cb23e60255702450b5525e0591904047f2b2e1ea9f4fa7f2fc97e38eff5a

SHA512
25428f7d711a670e4b4b0124f98b309b38704e7c8c8ec286c53c2c97d155ac40068bbc85fefb5ca2036298303bec9cd89136ce00a3ab807494e09647e048b712

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665714398674.txt

Filesize
74KB

MD5
6aab160be33da6c8aa7a2ed8f309d91e

SHA1
64b3be699c15c41e241934c5acb1f18584058256

SHA256
cbdc69de9cb46f91f085fa23fce38f48ed73e35d0ce5f38645c83105edc99ce2

SHA512
303090df58af0f7d9aee90bc78aa93672e85fe38f06566212fbebb97904d36c8b47eb9c4388554fe8a99c308a98d3fa21a23840f3d58567f188ed959515e60de

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
f7a2907d02f797fe04811b73a8e97441

SHA1
3542e9d1343e4c50d99dd8aa0f7bcbc4baba317e

SHA256
bde8e88b77afad250f2dd33b18ee43c17a77c1c9ea1dfa2621570d8ae466d636

SHA512
6488a08e79f3bfcb1668d0cfad3de8d2b777bd198e7db239d746ea926cb800a651cf3c14001f86796ce0839afbbd8a4b01a8a4d0a0a46cfa3eb91614a9364dcc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
436ef0027fe99d218503f02909972f04

SHA1
0d8f993c07847561f0e199484012ae26cb20d795

SHA256
8db9ccd2678f0c1f8ae6c0e8ead2c9c8c197b6802838c78569bf997838ab6564

SHA512
bfc506d251ce35954e9d22d9cb51da3295acc02a08e41d672991b9b8539030c6efb103d1966ccae9f449e6f3c1b02c6000d2e509e0d8d807a664d8ad79bb89c4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
ab28d703d53092ca99ccbf0bf040329d

SHA1
1d4c48a1f8643111d1ca5d114fa0c1b1cb11faf5

SHA256
44748a2f5834239183de81a8b85ee0288e2a87bb09de499b4b7ba1e0532b85df

SHA512
646179f598ff74ef764e935e542369eb312a589b48e25fb9bb7695af31918648d436b1e45983b823ab8c50cb6e6df6ecd72aa5db11e79507dbf5c5ecf04d5251

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
03e6395fbbb5e2d92b2c8ab7335686ff

SHA1
81c17b1147f738c0baf3f646e8e8aa2df6709370

SHA256
9bf4e7e4c79e2da24e4d9e77b7a6b694771d97ef8466bad8be5536f21071fdf3

SHA512
ce842b3584518b5ac315a9f77773aa38615403f8fd9667a9b9dd0630d0c92196aab7b17dff29e500eddd807bcce00f2b9e1922afd1cb854c93b21afcce1ea0ca

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
4f7666e36f44ff8612ff1f64e4c44bad

SHA1
89ea0ee6f1d3aba101b69d13c3d406b572e14219

SHA256
7a1d94263ff7ee53e71c84b553c54af5f1163441b5669faa1b53167a587897c7

SHA512
430b249d96c2b24a42f202bbc6ca3a908921ce8ea35921cd88e6fc7c669a1050f664de19521c77bf03ab30cc1002c4a4fed4fa4700a7ff38b3f1893dca449415

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
1ff9d44251498afc4d2b5c5c883e92b9

SHA1
29f32f720ede9e1fb3ff091b363518089d27eae5

SHA256
32a3bd278724a59b4d57dd4f428249d096222f68270e1abd71c0b70192e3d510

SHA512
f9405398e5f896d0781fe1f0575b81aabad5714a43ae8f875d274cd125b4b2390f6a649352981310067669039ee57624a73f54751acef9ad528fd9a3b312e5f9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
106d914cf67e0d0b6f788553912321c1

SHA1
e4bbeb80a3e6052bf2a8f22d8e42cb579da0ecad

SHA256
c81a8379739e96991ced785720a3076a21b241c41f47c387ab5dbe54861e9826

SHA512
a2acc08f72e126a6f7f6d91ebb96f3ef303a20b2db06f04a421e493a1d9e2c3bd51eec6d875639d4fe6e1ca1593a97093a49cf8b2f4671fee58c6636d2393740

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
a4b04e3e34ece3a6e6b72fb829b1ced3

SHA1
571d8434c712f67134f16e9fb5ef4762715aded8

SHA256
9d7efb96e2f5fb41510d928e196dfc5bd0c0a616bb4cddb7f7584fd5547d6195

SHA512
002349cc02a8c6aaec513065bdbe239073182c6cfef44c7f37e9d47d9876bcaa14f679b2d26db99ffc4dd9f9245505fcb6ac2230d154fb4b550c635229f5b840

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
d29837d958c02cc11a75fb9464172feb

SHA1
ed8da428c63e1d8d5e2818afe98065e6c8d0d8b1

SHA256
6ee063b87ab765cc79cf4fca758d5fc84340d626e4013bb443cc0aeebaed95d8

SHA512
fa4593a6bc3e90d3cc4ed409808e0c05018811c7e65113ea5aff5c124c6ebb7bb3abd61749751db809ee49ee09bdba723ccea1249c0a6da7585299c38760f8fe

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
8a186cff614fca4a8ce915a171d1e0d7

SHA1
f49f68124cd16addcf2f593b53b981e3315ad571

SHA256
6eedbc9f12d2104162c92c42cf4d84c8084c3fb75005e3b0eb1263c43629a3aa

SHA512
a2e067ba344949a4258094a3ba3247244b19797f69091e32e28e613a1ff6ae2ff4d075874c5b3ad9bcc79c2c83385fdd2a972f9dd28097958a97a6a170abe9f1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
f6e361f8deab0cecb73502bfd7af99d8

SHA1
1ac4ace109aeaeb3d0027c4baccf843726674597

SHA256
764ab15401fdc2eaee751819a833cba3bfea3afd0a6de10979cab4d584568b7a

SHA512
7b9befabd9304a8564773b76c7ad6dbaa83f06a1b1c891cfe9271e146aed81801e7e36a64c6d8670e268dd96537563de478d0c1df6852f3dcfd165390b19400b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
5ca227d06627bf30c4606f2d41eb9aa7

SHA1
a5905949d610dfb471a4fe37901ed3671c750371

SHA256
e6072891ac803d1a82c0145ef59ec81ad2770b4ef97b801393aa67788a91f60f

SHA512
725b7b8b8695555ed3cb8de6a9604c762b0e2b87e27c0da6e5a16fee6b5d52c4e63064218283da940d925a2391d03b83795da056e298fcfa456cac3128094f66

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
0bfe69a3a78f22ca25865986ecdd40c4

SHA1
a8cef0de9a9ddf624e9ec742accc9c53aeda8a27

SHA256
d063c5fc297d399bfac20b3fc3a97e295888e898c7d5c3abd72c376612e0e026

SHA512
d16d513a094254897cfc69bb1d89b0bdfac920f32db74cb6387dc9e3905298f435bdef24c023e5cfc1ae8714b04810298dc2bde95459d602d43dcb687a85ba0a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
563161ba1016ffda2fed87f37cc928de

SHA1
35ff52ef2fdf51c6e2e94900b4f12ae7a04522e9

SHA256
128a284919967ad44682a5fa917d168c190fe9cb0586442517f17849a470fadb

SHA512
4d9d64961b1259acb7db65af2923375621effa8a01d8539fc84ecd87470432a81b74fbf4254abac14d0aceb3f72da668e99874bac1da2225b18c55c6b0af093e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
5b7788f3953c6849af5a651818d63134

SHA1
d95e61f0e7bd94062b66f0704a5a6fd4fe686b28

SHA256
81517e5ef430dcba8973eb57b4d6d594cf7be83efedbb10977625fb8a5bc4740

SHA512
f090355b4f7cf897b07a40b94f6ba4af2eb50cb76c817ec532f77ed3a2d00fee0aed631c1de0cb886dda79ed7c9e61f40e7ef62791dc508eb99cc05e538df66c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
f8b15e461902e85998782ad53fbfde01

SHA1
2ae0dc09e25ffc24fa5e655b6af14c2614dadff9

SHA256
1ad9ce3ec36b1905438a6120309262744b1e1ea69169a548fef7fef47f1abdf0

SHA512
c3ebb0b53def937c4a3f6f2baf853a1126e151d44b5e02b03277131491777ebb932ae893e6f05f153ef28a9a8ca8a701136fac82271f4fcbe39ce0a6bfa0d6bc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
a86209fd09158aad8a468b4a09ad644d

SHA1
27781b08d3b93840de22ec4604d5318fe7f6df1e

SHA256
536a85398109b0980028192c758f17474889623bc3daca9fd58c9348c77f4d0c

SHA512
58ae0ee6af78ee843dbaaf6e23a7e19ebcf4ce73318ba295e0531aa87f9b95cdbbae7c36a770feba6645176edda53bdefde3ec7cd6227c2973641e509f54ee1c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
695c076970b78f22ebbae2f601a5f8da

SHA1
eca8add4d3c18b21d81ed7f554bee98d18e2a244

SHA256
5839d0ae7a75abe07b90ff82842d4c54bb24a32887f5e807c2c6977dbc1326ef

SHA512
9f9ab5f6be3efe473c026c55c0f9d6005efa4def11de38b89a6aa9fd88a18cc0b9da7164e9912a1218f96983c859986897ae4afd05167aa2913974b712fd7f73

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
f7f8efb2fa21eaf2348628c0d4d6ddcc

SHA1
d66deaf22f7f3d11c9c1d3f51d4e7c78b2900621

SHA256
1f93768f4641ef927f62667e41d7402b52a3a26644f515bd153027ff3233cca8

SHA512
4395a9b7e4f8a3cacc853d9a40548f17f9a9b0db5885f125549ef074b87b87dffa1ddc1f0de52cb9951a40600b9685277f2c9ae9de3f074c3f458575c1150ac0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
eee7b02bb5c8d29fa8c42e250b0090f2

SHA1
6c572ac2bfd1671759b73bf091cd04f34bacdf52

SHA256
6840ad34e2b7561e6d3d32295121052304351686974bae9967899c89b31e39e3

SHA512
fc9bf2c2711873f3c6198a5880855d02208c26b06bfa50abece5d172a9d531b2e648587f9d493d4fdff43f8540d14337ca5778feca1c1cbffdf7729fc65345cb

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
013a126b3c71bcf0b6d0ac245a7d4a93

SHA1
862d0b7c170cff7ce9eed5c2a650aef4b439ca32

SHA256
c1a56cd72ed3f6265e870df8cdc5cec5bd6e57ae4a6c0d35797073262e4cbd9b

SHA512
d5351c109551fa4edd0354287a8d89b5ab43338e8484444e558734b5f038219f51b8f69ed239abe1b4abc367199a1a73f162e14cad51738ef1654ff7b30b3475

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
3c0e81d578bbe8157488a1167b63795e

SHA1
0d967e31d8ea40fa196263a8b9d6932706bac5db

SHA256
9fdf2a8d9b683763e405e994297a7a4d112da8d2649e61f97cbadebb6fa75bad

SHA512
5bb42f239936e8425be922ebc4df33e2202a774cfaeaa90ca574de2263a358b8eca03d7fcab7613c00aa9a6302c611a65ac721e022f2c4ae1ae3a4bf01598354

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
4ff5582f106a8064f50d080bb53c3f2e

SHA1
29473ba1d1bbfcba1f65fc7d95bfede925740166

SHA256
dd1f24983eaacedc1cc4633c9a5a731384ee5a24a134005cb84026ae67409688

SHA512
21607f221a3d4945796c132a8e388799400c9e23549608baae87cf5c5af5d562c0b0a94142b16ea6dbc429fcd98a2df1b28416282d300fdbef28decdb9d0ee2a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk.EnCiPhErEd

Filesize
1KB

MD5
e31aafe6cb457bb70cf4a0c7691b423f

SHA1
669f1f09b278d88ab41dcf76d50aad369d86d43d

SHA256
2e648d1deac1f53001571e22aeb1becf2fd08d62ab688b23edfaf3bb90b73f4f

SHA512
1731d9bc1c2126a2fc9dffbf0717f5e431c77b8e83d84e51b92495d2b9ac7b746ed8f7ac0a43a9652d077153987e9510ee471ec8a5e1554b16f78bb4245cd079

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
55c55589c26e79fb8ea21f5cb43af250

SHA1
a08166a2da5bb4c305e820f36460ee1797974d8c

SHA256
ca04600399e8a63ebf488908c7a4f821dae8a1b2fc4ea0b6e62308a2fbc1d635

SHA512
aaf3933d7b93c0d3c940c1eb694c480a55210b56bf6384ac4cfd0e2f32b4099ea7b283e1c15cedf0bcc95f899f7606cf7e5a42c69a88027c11a0ce9aabb05a85

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
f11e049e0e105fc2a5ab37ec1ba3a36c

SHA1
fac6ea72373d39f992264932c788e4769bfeb6a4

SHA256
63dcff6a76efc8fef2d8011715828246effda1ca6df72d4559d10ccf07b1e732

SHA512
dc7375eb458d81f4ebd2ca0bee9ebe70d9599e369fb2322c5f0c657a64e45702fe1b5583e382ffe6aa7f18f3de6b0b658191e3c08a5c47c1d094f65a4f755d59

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
8d5a1e888205e2d90c974c74b101658e

SHA1
e8514506c6bc085be4b4e6faf98f5242ad6ca48b

SHA256
45f2cda3ccedb137ff069e73b25b9dd250e2076bcf6327efd132a6a2e3ec6162

SHA512
bc8e0986726dd62867fcbc32bdcc6c410cd73f64a8e45eefc6bcaa866137a0dbd41a1d01efad6589d90e86c42a2fd38496fb187c1550037b5ac42b1fa908b63b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
0f4133747edf4f2b8bf905ff3228c841

SHA1
8193cac8f3419dda612b1c2be98682f727e2f7a4

SHA256
5fe66844be51f3bc5eb4c0d27d5ff1544e0fa971c4d099d22b0dff4e3cc2361f

SHA512
866f3d8094b8908f850bdac2d2c4891424f9a50b02700f75de1cb438c742ab54218ca647dd68d845d140b118fd2d51ea0ce66985f22f3bf96373666c54093cfa

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
4a1f5ac0c7bb848f35243b7cfdc84f16

SHA1
e12ece9c8b804f664e574341291629457af52fde

SHA256
194e3694d1c0ceab84d8b5b3c26b9e1ec9eb99ebff8b736f46f74a0c53d37b14

SHA512
22151a8958e5386c4797d90fa8ec14cfebe2f0561ab078eb0db8d371a29467b4c2fee71667a9dc87b77cd453269661444e464b8ad265a88d8d5467082ea75dc9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
59ed0dbb4d3b57347959109e6422d17f

SHA1
4398149af5e79ac4cdba849a6cc195b3909b5a88

SHA256
65578e52cac21c226a119fbffabc9056036ec7eb2d5d8951f69c095b6087b6d7

SHA512
6fb38468f0e3525729815dc0c524a62e6164aef5f92f2e64d604068defb64431ed9ba66a3b8886be93aa5e093d4aca82a2cff08efd41b96fb367e7087c2cab03

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
d8fdb46f1d6c2ffbbad75d80b2be8ead

SHA1
6b63dc5ad1d23deeb4e15d87c1631aa4e0b48e89

SHA256
5e1cddbf1572f2c3b524a4106c5b1a8388b2eee22d5d05e4c3872d4e2d5251d9

SHA512
5608782076ee58b9690c9a21b51824a96b3faa7c2ca7bd37be54688441143fb7e7b5cf7e895792c5110b5030c7b0fd061357e34353d5d6a77f471ec33d8216df

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
59d85f0f08354225649cac8e80838287

SHA1
400797ddfb6f49b50a2b1614ac5da79ddb9760b4

SHA256
0651ba3b82f862b37ad7b186781c48abd2818a170729e9e97d00b02b8a53d228

SHA512
4d0a6e5ff5590aa5c1306b0f4ab7bdcb7e921cfcd23ca677eb9108010905566349616c693d040e61a48c75c852e2fc7aac86d8c233ce38668c11bef1b095e660

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
a5adbefc21029c7fdfd55f73e109d5ca

SHA1
bbbfafef3f6636a1dc6d39c52a768fbe67a7a990

SHA256
6b57273ffb009590f3b27a6a8ecfb2379b3208c63c7ac6a176c95a630cb0deae

SHA512
4ef93d0fd837a67f87a27884c23ec65a103849c1cddab76a6e027eec5fdf9fb036311874ad5c322756184d2b1f114f76360d8e24ac863c88fca5226313e36037

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
3dc2fdfd34b51d5c5176ed694e8e3fbb

SHA1
540c9752ebdeb042f3e8fb28f0dad336a9f7d496

SHA256
230438372e5a129ee929358d63e4557f10a5bd0163a92f231c8b274c75cc0d00

SHA512
36e75985b55064bef8fbbaa42bca5c2ba3fa150ffc466a1859205a8d91b0458662c00f2a90a32a8a899613f2113b8f62754350c3331c09765da215e01d6a4d10

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
bafeaf4f17d4994e7090f7794228d714

SHA1
d076cdc4e11831c039823f3d665d396e41a58862

SHA256
21109cfed03f36dc6b3365bfaa45831d270729a0959b9f1ca1a2d43759f025e6

SHA512
de93dd5e43a03a07a67e1d10d7090599c4b54d38bf1b613c7b64b1a121ae798f0770c509d47d99311b80ae4e2a6b5289d1fdd3a7fb79d49916676fe471ac8fac

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
00e10f15b15d9fa745f4466e784bf4c4

SHA1
e0312576b8712c0f984fd4386420d6c3a687bd56

SHA256
55e58bb2a9752ff97b2e93bc34be1401c7372898d267a3cdaa36e5e30ebb7e49

SHA512
3a09209f575efbd2a47e1462850504b5df8816521148bedb61487bcb95902ec6898b33f5e130b691605a712fe21d09b6734d0156d27b699da0c865391603b74f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
ddc4757e2485c3243e22b2b604fb7d2f

SHA1
8e425859d5b6070dcf3d23229b7ce2a24b97cb63

SHA256
2727e0a9d8ef89fddddf0f7bb5fea3525cc36eea15d07059e0ab4de29bd5567a

SHA512
a3c16a3dcc2b197ba6ed3287544f8ac393d855d9cf7480aeaf9999960f8feb4e7ea7dd8cf755e48141338b9ec6e7d86950229ed1ae0408806a4bc9a94001bb0d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
49c18141ea983e2742c9fee04afd9832

SHA1
16eebc2f2c6b5c2e5e48bdd3a9f9736ffd7c5ee8

SHA256
9896c0053e58c9a4c0aa6bde515522f6b23ace26ec3d7f8f21be096117153432

SHA512
6311b3df0aee3db4d646b6fe3985a7bcbf4e8273aeaa5cfdeab27f925b6bf1c30ec531cb88575924d28983ab808d7de08bbc11b1b8b0a4204e2fc122a120a0bc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
a337e42f63520fce971984cf4fa2ccad

SHA1
bc2fde22c82e9915dad3ac4edb95aeb83edc70dd

SHA256
5e1a2caf82f584c26ca08822c6bb33d3acbdae5fd73916308b35dbb98f48aeb0

SHA512
2a9b44251697101cafdb756e3a03b540680fd9e997677ae2506bc15017fb5e8a713e9396b253eb2739af7e70cebe9ec088e04f2c51c99d222012112b2aae1703

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
a4e0d8f01076044fdda8906efbb5f7f6

SHA1
ceccfe833b98f5cd51fd81c7a2a86434eca83c20

SHA256
eb71b4a5731a1508ee604ee560aeb67329d8b066689ec668eb413f252f947292

SHA512
8ecae66fd560a5695c3f0ff661c33ac15d1d184a3421ec5a725c2ee2c8e6f1a549ac6bf4351a870ee9cd613399af36ec1bddc75b5e49737ef6c53bcc8fb7916d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk.EnCiPhErEd

Filesize
1KB

MD5
650c451ce028bcb66de18a8c3dfcea99

SHA1
fc7e3ae5bb5d98f4de43f3f8efaee382155ca88b

SHA256
1e45d128f1fc2d9ed952959acd44e2e33273712e2bf9997b041ec73527ac2ea8

SHA512
49ce1e02eaffb54254c803e28ed347e2c8a34b9cdcc98b872056ebf16706adc28d42f63b23e658007cfbb66a134848dd32637cec753f5baab45631d69b7c8615

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
db082cec49a4711d59ba8bb1b4ba8ffd

SHA1
11e373b1affdc336480f3ad8ee17a78c04ba8c4c

SHA256
d55d71a79646b322a4b994f84ac5e6dc4023752b6b9d07e6925542c9281eba86

SHA512
501d014df9d6603b8a2f75222d9825b20f7f34ad2a96d150d57c7e34145afb4b51466fb8c0008e99cb3e8a606e9973ee3dd5895a34f2a0a49392b8316b809f04

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
5d246ae3767a574f6729f46d2a73beb4

SHA1
9435bf178fc4e5efea17cfd13b0232f05cc9d412

SHA256
722636c863f6578daa813b9f7a8e3f38ded435a42ddbccf4375594f3be7a44af

SHA512
2e0fb7dc3ce33bdd93bc6c25fb253d78309f493b39b634afe1f13da9698cee6b574b64ab851ada92cb94f5b11e0b56404f8085fbb5ee9d50ba3cabea388d43bd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
bc523931fcb85589f226675209d0f480

SHA1
c2c14f67ca728ff6fe0bb09c621496ea91f1bc4e

SHA256
9b01cf465178c500b9d841006fef3001f0ab1ccc3422281f014e2eaebc9dc52a

SHA512
8293ade8fd7f2c6cde0702c5121be6aed7a8af8e1e41e4b733a9e7dbc9a88e582d7c31697051a4b009c76e5ce632dc9c0738b1280e334d4210408dd581dc2a77

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
7c2836e4fc6156babdb24d9268a6b0dc

SHA1
66ac20d9a0719d377284896f749d6a039480b276

SHA256
8aad46201ea1eb8c283a3b3242fb99ba771564982ecd01951e510bbbaf2339cb

SHA512
6c4f87d0dd1eb92ddadf2837e4efc9a677af94e23aaef0ba07710194c765c9672465b40a71b12cc249fafe42d49079c76453f1869e977adccdf305326e77fa6f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
a4cf840fc789717f2e488a8e2c6c71f8

SHA1
a6564cb9f9436d7316c5bcba32fab5ba429f958b

SHA256
90fa8d7dcdeb3aecd9793f62492e3021fbb84ac7dc1011c3be80c3cc4f030e02

SHA512
61e7a391c65d9f46a212cb925ec4d17209b040c72c3b3ed0aef91a2105a2749644a669c21859d97b216d681bc0257f4f544fa09c86dd28d99153cbf8c9b4dfdc

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
08cff08944f376e9c92f9469b269a058

SHA1
2922d382ed5e64aa688d9089650301f45832cacd

SHA256
7287009e88615dee24735a0e7ebf1204c5867e41b18050e8a3f9b31e6d1f014c

SHA512
73a2f3ba3cbb165eb647bf80df537cb10c6371a642bd1d8b8b51c892a865c4ed19f82a98988ad8957703ddaf46be1013c14d2bedb6e41e73a04f7db1f6df8514

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
c2c787321e1ee8c2ffbe876e53d6cb1f

SHA1
aa56059a11dbe56fc47a3a010326f91a9d8a3e00

SHA256
994726e2d1f1d11c582a3486ca56670742153a2a7dc21237df1ecc9d912cc4bd

SHA512
605df26a027048d07466953891199698e53d3dd0ff2fd81a38bb63f542aa6babf982b482c8680e4d4fce8f08d8c9cde469d5caa1dc379e8ab1c5824bce1da945

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
1e14100d33b0aa5e9c7cd9a2df7dc4a6

SHA1
a3d1b045df0fc242bf0b69f91ddf1febf7b83f44

SHA256
005d71d8d21793964911f332b4a43d8a33aebc85d5b138048e786ed87c877453

SHA512
62038f2292060574114dc10ebba3ee32c6b6dac4ef663b246aa60a06de0f6345cdba47cce75657f3b0fc6466392180aa445dcbb2fea35c6db7f6f95665e3e6b3

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
925b9ab6a218558f30e9ce6cd02b57a8

SHA1
3f340fb1846578d1dae51fa193d06f2763926586

SHA256
51cd4f98b2ed6185bab38971312053584e1e0a7c910cfc9a5e6cbddc0e01d55f

SHA512
f6a2ed27a20000a92d977d1e91b918acaa2139739dc2d6071a1f1ead4774383e9d63930fa5505fa86efcdcce3a60655359a6e345b2811a58e1bcb1c4969551b6

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
f3935c7bd8f37849d4baa6142161be3d

SHA1
9015b8bb2335b4800e701a0d9527d8f8847093fd

SHA256
6ccbaa152f9da6419c8ccdd59d1aa37a5fc77766b4ac63e0e650888f99429ad2

SHA512
2bbae795e069d563fd23a70b648a6d2416e89dd1ebe98ed409cdc3bdd80ef0e1faa5fb3e2b90d587fe45c7f91c9002ad517f220fb8c2a49626cdf5a23b30f4b6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads