b860589bc0c02e342d327a5be7a3cfe78f65f4ed0f67d06d6caa204b276add87

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
Size 1.3MB
Sample241018-ecttxsvgrg
SHA256 b860589bc0c02e342d327a5be7a3cfe78f65f4ed0f67d06d6caa204b276add87
MD5 55522c1da2cf9392d2258d90652114d2
SHA1 1188ef67038c2f14a754d89e994658ca716505bf
SHA512 e68442753ef81c446f3a4a88e14fefee1302bf33c193018fa8432cd9a15c6d9f0bdb660dc9f5a029732045b0ec0d225c18b7b498e8f65d19efc1ddca56707652
SSDEEP 24576:gzOUxaOWk01G4fbu/F1ZYDnaCXtztayjngSPjVh4L3GmPA705sCvsk5Xf7v5lFW4:gzOUxaOyGaupAa+XjHlAAoefkVf7voFF
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2351) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ld869rwRuHeO9Tw.exe"	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\et-EE\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\hu-HU\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\it\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\es-ES\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsupra.inf_amd64_ed209c9a3da66777\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mssmbios.inf_amd64_9fc7fe03de136fc1\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_c62e9f8067f98247\Amd64\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\en-US\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\es-ES\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\it-IT\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tape.inf_amd64_bf051ca3546a5bf3\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\hr-HR\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsUpdate\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_battery.inf_amd64_5637e58e54fb24bb\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_sas2i.inf_amd64_b4e933c4540ad3cc\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sti.inf_amd64_096c9e42fe4749d2\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ja-JP\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\040C\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\ja-JP\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\en-US\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_wpd.inf_amd64_0245a364d71cf6b5\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidbatt.inf_amd64_a6fa9bcee39a694f\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj4.inf_amd64_3bc71c4327f9f94e\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_hdc.inf_amd64_6e00e835fbceac58\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis3t.inf_amd64_9f214efed426c12a\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\spp\tokens\legacy\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\es\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\ja-JP\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrm\0409\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_b8b0fe7bbc76405b\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wdma_usb.inf_amd64_e879d41db6fd1ab8\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\nb-NO\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DeliveryOptimization\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nulhpopr.inf_amd64_9839c838c72c0594\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-MX\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\en-US\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DiagSvcs\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmotou.inf_amd64_8370fa408706074c\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\megasas35i.inf_amd64_4df7f6223ebcd28d\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MSDRM\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\uk-UA\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmirmdm.inf_amd64_ba5b77b7d46bc10d\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdpbus.inf_amd64_05ebd3b4422f62ba\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0024\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\en-US\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_mcx.inf_amd64_fcbcc3807cbf63ec\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pnpxinternetgatewaydevices.inf_amd64_82b90e51473d48ea\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetLbfo\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\da-DK\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fscontinuousbackup.inf_amd64_4db9ca877f67dd36\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smrdisk.inf_amd64_bbef253cecafbb1a\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\en-US\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ikknaacffhkknpfh.bmp"	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square71x71Logo.scale-125.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_contrast-white.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-36_contrast-black.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Info2x.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1850_32x32x32.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageSmallTile.scale-100.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_altform-unplated_contrast-white.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_AppList.scale-200.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons_2x.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\3039_20x20x32.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-400_contrast-white.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-64_altform-unplated.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubGameBar.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-200_contrast-white.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-125_contrast-black.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlFrontIndicatorHover.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-fullcolor.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-150_contrast-black.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\eu-ES\View3d\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleSmallTile.scale-200.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-16_altform-lightunplated.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarWideTile.scale-100.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarWideTile.scale-125.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-125.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-80.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Logo.scale-125_contrast-black.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_contrast-black.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-200_contrast-black.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreWideTile.scale-200.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_contrast-white.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail.scale-150.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_patterns_header.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_neutral_~_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\THMBNAIL.PNG	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\195.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-125.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-125.jpg	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-60_altform-unplated.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-400.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-48.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-installer-engine_31bf3856ad364e35_10.0.19041.264_none_e15c1f0e12661737\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-qwave.resources_31bf3856ad364e35_10.0.19041.1_de-de_83b66c93b1b67629\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-pdc.resources_31bf3856ad364e35_10.0.19041.1_de-de_2c44c5daa3200302\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-setupapi.resources_31bf3856ad364e35_10.0.19041.1_it-it_acfca3ffe0eaab8c\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_f79b680f94668688\r\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_wcf-m_smsvchost_exe_cnf_31bf3856ad364e35_10.0.19041.1_none_4e866ffd000dfd40\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_amdgpio2.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_5e26512b8e6d8fa8\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..xtservice.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_c429f54b07aa1ba4\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-directx-dxdiagndll_31bf3856ad364e35_10.0.19041.928_none_944996301d66c5ae\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_deb6833aa5253e60\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-winsrv.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_963d202796c2872e\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-storagespaces-altspace_31bf3856ad364e35_10.0.19041.1_none_9cd773e8b774f780\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-healthcenter_31bf3856ad364e35_10.0.19041.1_none_6ba2da093792c423\SecurityAndMaintenance_Error.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_cdrom.inf_31bf3856ad364e35_10.0.19041.1_none_38c51c6c3f324b9c\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_volsnap.inf_31bf3856ad364e35_10.0.19041.1_none_0e763473c963a110\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-h..learnmore.resources_31bf3856ad364e35_10.0.19041.1_de-de_d11b99c14f1a11a9\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m...appxmain.resources_31bf3856ad364e35_10.0.19041.1_zh-tw_6470ac13a60309c8\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..voicecommon-onecore_31bf3856ad364e35_10.0.19041.1_none_eb3285727ee1b51f\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-hbaapi.resources_31bf3856ad364e35_10.0.19041.1_de-de_9d9e833314ab34a0\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..owershell.resources_31bf3856ad364e35_10.0.19041.1_de-de_f8317cae66c8aacc\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ivesyncprovisioning_31bf3856ad364e35_10.0.19041.746_none_770d9b7d4ac47893\f\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windows-application..cts-winrt.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_15987d372575fbb7\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_10.0.19041.1_none_6fa7e5bbaa15a17d\image1.gif	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..taservice.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_db0fb555c771b7bd\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_ialpssi_gpio.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_76ba7f51e7cc24d5\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation.resources\v4.0_4.0.0.0_de_b77a5c561934e089\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\NearShare.scale-200.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_comsvcconfig.resources_b03f5f7f11d50a3a_4.0.15805.0_it-it_835d3ebe385afa54\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-l..alization.resources_31bf3856ad364e35_10.0.19041.1_en-us_dedb4a4b06dfd99e\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-spfileq_31bf3856ad364e35_10.0.19041.1081_none_f4196659a93ddd93\r\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.423_none_204af7ff19532470\r\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_a63c154de6e4156a\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\Splashscreen.scale-100.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\404-11.htm	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mdm-adm_31bf3856ad364e35_10.0.19041.662_none_d7bee5e4f553489b\r\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.windows.form..alization.resources_31bf3856ad364e35_4.0.15805.0_es-es_8bbd3a4535e2eb12\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-usp_31bf3856ad364e35_10.0.19041.546_none_95486a60ebac6ca0\r\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..onfidence.resources_31bf3856ad364e35_10.0.19041.1_de-de_67e161fa2b5f0735\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.19041.1_none_22099da5cd743768\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-ie-behaviors.resources_31bf3856ad364e35_11.0.19041.1_ja-jp_4a7e8ea9a7968b76\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars43.contrast-black_scale-200.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.19041.1_none_b174c6b066f29f19\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wlanutil.resources_31bf3856ad364e35_10.0.19041.1_en-us_19ec72bf503086d4\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-proximity-commonpal_31bf3856ad364e35_10.0.19041.746_none_77b18ddf81476f08\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-broker_31bf3856ad364e35_10.0.19041.1_none_1130ced19cdd5598\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.19041.1_es-es_b0edcf692b0fdbdc\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\v4.0_1.0.0.0_fr_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\privacy-icon.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\Square44x44Logo.scale-400.png	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ovedevice.resources_31bf3856ad364e35_10.0.19041.1_en-us_76bcbd669813aeeb\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-o..ct-picker.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c99b8c8b56859548\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..k-qos-wmi.resources_31bf3856ad364e35_10.0.19041.1_de-de_fb4790c5a958910f\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_c_volsnap.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_f10129f07919aaf9\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\retailDemoSecurityInclusive.html	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..vider-exe.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_8cd52ba97d780ce7\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_halextpl080.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9d7f4d616bbc92f3\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-dims-keyroam_31bf3856ad364e35_10.0.19041.1_none_1be9cfd6015b9878\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_10.0.19041.1_es-es_ca3ca8d6defbef0d\HOW TO DECRYPT FILES.txt	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoTorLocker2015	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\ = "CRYPTED!"	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ld869rwRuHeO9Tw.exe,0"	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\shell	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ld869rwRuHeO9Tw.exe"	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoTorLocker2015\ = "KZXBQDZALDHFNGD"	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\DefaultIcon	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\shell\open\command	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\shell\open	55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

aic_file_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Size 50KB
SHA256 6dd73094b29127c60cb6e497ff0751c475de206f56000b45b5cbc93f72847a82
MD5 0fa655a02c7758444963ca8e589e2abc
SHA1 17e4e5229c10bb21851f775ba997ddbddb10d021
SHA512 4f92bdf7dfe4b0960954a0b7735e8ba988eae182ac928435e213db07bdf964e369fcc562e471f304f54707b5012766991c7cf433d2feac7548a496a23f7b2af6
SSDEEP 1536:r3kuTZX5qsOoOVP43RPfWTEDT2lMI8iHrw88:r3k6KoOVP4BPeA2yI/g
MD5 SHA1 SHA512 SSDEEP

Submit Download

selection-actions.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Size 1KB
SHA256 562687736cd82d295206b367166bbcbafe642cffa5291647e76302d0d027cccf
MD5 1601e33519cc534894fd53ebb49e8fb8
SHA1 eeebeb8992a9dc3a0f657d70cdb2d95aac5b629f
SHA512 0974eac42017680e31e50ad906171f4baf51748764e1efa7d1b0a737fd2bf41b02007ae5c403b37c33de65fc589406dc0de13f8f6c5e41b1d7f9688ada6a5f03
MD5 SHA1 SHA512

Submit Download

selection-actions2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Size 3KB
SHA256 a8029026f9ebbb833ebb77b4bd2c013d59dd511c04498e226a0f23562a07a714
MD5 bf3fc563f901fa333308d461bc6abd82
SHA1 a8185e0a2377c4283f24fe3432789b5700f83873
SHA512 9c2442576aafe33929091559ee183fa573e95c6d1f79d92eb066a97b7a2f1c314a1d5e3798bc6ead7ed8999f552379852a2de84142520309343dffcfa78f4ca4
MD5 SHA1 SHA512

Submit Download

example_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Size 683B
SHA256 22e93d1e941186920fbe0c715718b2189915b99e5523c0c7a37690a9a5547389
MD5 d60efc3dbb75ea0839a94560d9a0bca9
SHA1 733af187ed2cc49ff72241556f43a046193242c5
SHA512 3984262726c3073a52b36d2dcef2f7919092079e2417f11e5187a3ab0bb9e5dcce9bb5ba07fd1a42af21d75370b40096efc4aeea72753dd52cb5648c4d06010a
MD5 SHA1 SHA512

Submit Download

example_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Size 1KB
SHA256 468b6214e67f42219e2e40ceafff1f616ae1a8c518d1b6c5825fb5e95b71d027
MD5 a2beaddc3262ec5294e4bb036c549974
SHA1 aa3dba819abf679387943d813efd47aadb9f95a9
SHA512 93eb5555630121c9e2cf0bd1973b488cf4ed3b9641cf94719376868be72edf4c250a98d2d99baa5b951b96c053a577b35377188ea378ed0d30e0e42780cd72ab
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Size 445B
SHA256 ac0cd6b431ac7d09c639d48bae16b6dbb14dffc088bc1f3b05869e4813c12829
MD5 4f12872e2943cfa3ff22a132cd094184
SHA1 d5a6095f16978237a3938d4e300ffc7f0978fc4e
SHA512 5545b16abf79faac2b37e943442b8ef5fe94f97f0442239602d969e51954ceabf1abdba073a204fcd96a44cf45bfde1d67bea174e90285f3c31831ab7262d97e
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Size 611B
SHA256 a820311f8bbaedb268ced7dda117c8bbeaa4bfb84bcc68f897e73d71b91b2f67
MD5 0f2ba6537a2906a18d33e655321ae77c
SHA1 59afe58398d3158e304ad192592ec520a1a45a14
SHA512 b3c80e9a910eb6e1becaf3e22fa762192abf765484a46877a96ea40ca78e3a8cdb0571813132eeacfb50bf09d5258a686cf58608a8d8277766dfdc05053efcf6
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Size 388B
SHA256 bec2e7f99031fb567beaa48a4cdc8794ffbc04b9badda30c947830b2b898e3dc
MD5 97b0dbc55540feaa048ad1037d8f0b16
SHA1 355009b817999a85bca748d411642eaa05e6aa94
SHA512 53c5bf6402b9db02454816eb6f56374bfa85e0551e78e44c542c100e1712b249bbc8e3954e4dc685e074c68070f8a55326e2854c2248b52a940eb578489c80f5
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Size 552B
SHA256 28e0e7f31748c87e14690341dd0ccf9ca0c7ba46c6d9c842f1d23e9e43148b14
MD5 4acfcf4778305c7e9d6d11b5b4ee2ea0
SHA1 2a39120a7116ae6d84bdc448299576e907a96f57
SHA512 c16588c244610e9ce640306f973e7f6efdc6212cf154518c15ff1c4d49453a20d158c4c2b130cc291ccdb3b3b7d3d75db489c5585e36578ddf6a8ba1b901d8ca
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Size 388B
SHA256 39c17b6666c25f45c9ec66a528e972cbe8e1e13aee5711320e84c97d2271898a
MD5 0f58b3f8534fd896bc2f89183a831b44
SHA1 fbac8ef53f0ed61a717669e8371a80ca18f4c29f
SHA512 fc48a1edaf4728a6ede52149177d0836ae705c529a189888374dc105c82c615117dc19b6104f3756f941c2347b83f5334b82bc3fa91dbec1fcbd0ac09f0fea64
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Size 552B
SHA256 c693b8ff139580dbcd84a9592946ab72633e9eb4de339fef127d34404b93e409
MD5 905ecf6cbd64c6fc6e81631671664bef
SHA1 1088d4a19d7c8cb8ff66d4e6c7118eaa7cb354cc
SHA512 6f355fbf692aeb5795a18b0eb66692c495bea19246cf1ec6683eef16c57ec7d3eb3a176d802cb96f98eb51d7340db9d5ef6271c2a277ce8ec1cc4a020954c81e
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Size 388B
SHA256 6c783d7f8665d6e618f4dbcbf32f91c2acecc07c9523d8c830ad914da957f875
MD5 54a80ae71328fcb35771a8e9bef09bc0
SHA1 75c9b36b7b38858d8cf47d5b2698b39e830d88ac
SHA512 ca32b7058e0f4a5c2ef9d2a3d32269ab1aff93ca4a5a5e1059d6ec36b3890400e5dd2693ea3bd58a57399de401fe7b0ad41d5245cb55b086323c974deb3affcb
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Size 552B
SHA256 58cda660a59c46b018f349f060588f2bb45dfd92add72399b69512fe57775cde
MD5 6db3f03780f83f5c9abf129781434254
SHA1 857bec99b1c7dd55742e4511b241a683e1294ea4
SHA512 5801af98a20656495eed59bd0f3f349439d00424e2123c64692233ad836d3c6d3509b52c486302026a85afe0c4fd5462a2f877b4f9d843ec12c3e7cfbe292a70
MD5 SHA1 SHA512

Submit Download

icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Size 7KB
SHA256 ce1f0f96597cb6eb2c20011e790c9b4b76b5190e79998055ecdbe893b0274f99
MD5 89a37c11b34b59f32caa821d889dafa6
SHA1 6d2e8eef34e29529cd500d73b0015a3e97d6640c
SHA512 43961533aa39c69494ae90a52e4dfc653839ae200042267c0814cb4ca2399df85668976a18cafe8c182cea8dc7be740d1398a3294c25ebbffb4655820143def6
SSDEEP 192:vixT5Ds4AyHq8R2GsAXohaR4Bm2UAlo+rFtR35Ackc:qFAylTNYsR/2Ur+rFt7AK
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_ie8.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Size 7KB
SHA256 f7a5f784ef3843900d87524a12dfd1663e778957ed3b98404e5470376950eba0
MD5 3d4c2243d7160964c123a06dd7b912ae
SHA1 8bbc60fbbb9f8f91d11d2b4000e06f9a7c030dd7
SHA512 f06dc8a731355edb2a2f469cb1534b9ff4df856cc75483af610856d2def7d5a2de36c9bef29edfd16929192fae6c67a33262435618f30f139b9080675da44174
SSDEEP 192:qbNChSJ5U26Hv8ohd9Q3Qb2N5ADqEodNgK0:qbNXS2mEohh2N5ADPGG
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Size 15KB
SHA256 44e3e5ccc9394148f32e7c1eb9de49f4cfbbe5ef6552de3b05d70b3be4863c57
MD5 dc5845467e9574d6a00a3305143bb533
SHA1 3d22c371479eb1e44377c47f01d223ac08de92e5
SHA512 5359fe74fc406abaf5861072025f50f58d1af989a1b12d8a7a661b88239fd62fe67876d45d1c8355c77e0807ea0b077446e7ff8c1c4b13d8cccc252eb2722aae
SSDEEP 384:jhkySsKGKvals5OwDkpA/japXDrbJ6e/J+00YdF0Nl:1kySsKtamCpA/jGDrXJ+00YdF8
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Size 8KB
SHA256 05f353657368d084f666ad916400de336d883ff7f08092753869eb6d08a3dd57
MD5 d4468a87f6693c143a95485397a081bf
SHA1 7457ca8288a69736f426053647456f21265c02f5
SHA512 70732035e8b70d3ea25992277f9912fb38aba5164bfb4e2b6dcb260904576f4abdd7c0745cd3f0071d4726d045d4e8c1d3377acbd75c464266aef073764dc13f
SSDEEP 192:HLQmAc76vrQPAuvkJ1Xrb0GWp+Jd9Bh4WIxORV5j2ReNEuA:HEmAg6coekJNXWpu9Bh4LORDjgog
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Size 17KB
SHA256 9cd228bdd63d8268eaa921d72bc3d3fa66c8b007cf275631f378749cb24a949f
MD5 9d7e55a9d649c97020fb75ee3c563359
SHA1 b9fde6ab32032b72244ee885eb72934b5c24a23c
SHA512 b9e717a656bb46f03c2e76d57ae5270c5d75dbcc9f3023e4a24094c6cf8702d2148e270b20dd560aa9ae46fcb55a1ee7219c254a9df763566507802b1e02d8eb
SSDEEP 384:JHDjp5C+YQh3V/0fZaQOAb7wZZzDvBS028qCtLQQIcaxcrJT:lXC+vEx/OAb7yZAP8btLMxgJT
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_pattern_RHP.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Size 179B
SHA256 2789e898e495662f5b929860e8570cd0b2b57916067ad7514775b8ac942a508a
MD5 1846c9f6b494980db59172f800c8f5da
SHA1 9edcb105d88eedc0a54bf15149c29625fed81f12
SHA512 f52423b54c79c3e11eb0455b88e47d28c32b98e0385ed5c83e26c23dd0058960276c166fdda4f01c76ff3c368f8e7d4d7ca76493072f1743743db3c038ea6064
MD5 SHA1 SHA512

Submit Download

bg_patterns_header.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Size 703B
SHA256 a5dd63883811f09aeb57af96299c3adec30047aa15264feadf611471e552ae28
MD5 1333d06d27dfcd89ab798154b318765b
SHA1 cb87c537e084787b3e6804b1277f6020b8277a56
SHA512 a50f796246d5c230ee57f04e09c9d963ae4a8af609183915ffa630b73125b64dd0043589f4688f09f97ff120ea34a91bc2bab2cd3a589eb3c0b5c206415c8e86
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Size 8KB
SHA256 9b5ce3d9f49a3ed0a18320ca648e965655e0496f3e41b003467facc4c1c5bbcb
MD5 28e3ab9ab77e7597744e32aced326580
SHA1 2cedc61e52bd49462e6bcdf85dd1a9a25fab0a99
SHA512 f1968f6ab14a32df6e6a37ce11fc54ea577fe8aa7204ec2be7dadb8535b015f74a339b7f4e8421ca9793782f56771a30853486afecafd442217edc7c58497ab3
SSDEEP 192:WMce8Olcabsl+mJ9kU2c4T5JbcFDRk/z5lVI:W7slcabsl+69kU2lVcUtfI
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Size 19KB
SHA256 4f1284a56d3861b976286e54016cfccb22596385209a54637ddd9ecab2fb063b
MD5 644ed7b0861549709cf76efc672d6ce6
SHA1 9f6370c8fd9af4b009cd7fbfe7a62243633f5054
SHA512 83540376ce591fed508247e560d9728b4e292fd4d83a885b3ee773838510c95460e3ee99c9237f499a28f2e986850b9fb9e4f758f013b93032717df4503dd638
SSDEEP 384:SDfd+66elwQ9ccQAoftYKWHx4E7O1DA3z8DBION:UV0rQ9ccQA+2KWx4ES1E3zcqk
MD5 SHA1 SHA512 SSDEEP

Submit Download

progress.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif
Size 19KB
SHA256 f84c76878f1675887561c27a16b40165a355dc4dde96bad9ac1175e5b0d405b5
MD5 2343450a63f063d124b7d74257ea2cf7
SHA1 c94d475326d69f3893d03e6b9958666d2e3b02e9
SHA512 71c4dbc53840a5a32734d04a3106c02d2f14bfa5ec06a6962b007033bf9e1bf5b21c58c629cd756a48c58cbcac7252691f8cc92130422843127a31a3794f811f
SSDEEP 384:/4aV/ohHGWlW7mFxnRrrPik6pqu53tnthtJ7kIVMDXsmAfpr1gYa:gm/CW+xnR3wpXBuIVLfR6Ya
MD5 SHA1 SHA512 SSDEEP

Submit Download

faf_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Size 6KB
SHA256 20165b09408c1d03da62a5c86bc5fab0416c893356c214d4f80449d61ee9fb64
MD5 5c230afeb0a8afe1968dbb10b9c64610
SHA1 466b3c0d96f886418d7cd4db441565640faa2244
SHA512 56e88e3917c4930bf26e5bec036c57b15908de16f9869409d7a275153d26b1ee848ac62f6f7dccc47aac2c3fc5179a6ff7c051c11c2805afddd4bb672e229735
SSDEEP 96:KDBdECvL+xRx2+sPBY9WMLWu/HdMEUKYb74OI8I/hKK1IJAuq+HN1PlzifMwM760:YBJ+xv028DUrCgGSIJAsVikg1O
MD5 SHA1 SHA512 SSDEEP

Submit Download

bun.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Size 2KB
SHA256 40745f7fa68bb9c952b55f1215fc8c8d58632fb1b032e0754c54309101a0597d
MD5 8137a0a2da891105651099c010cf7a5e
SHA1 f3c0ff7460f714bfa41c7f42f9b6a78efd5720d9
SHA512 4fd78305b78d316a0630b823e2829e2c0512a7ced6075f72654ca24416c922c4846621033dc77ed3f138dbe0eef4c5f08d3c38509dd767da395a39b4c3c3a9c6
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Size 2KB
SHA256 99c0876e323c53b860804e02dcc92f714b20e04a84e48c079116719ab0307967
MD5 fc4540a5406adba425c299e4cf29e3c6
SHA1 e1002e44823ad392caaf7e5f9f843c5de572efce
SHA512 5cbf47a8c4eda03ee73e77ab394b236a1ad0bf992f33e53c25f87ccdf04570f86628dd263c92916f8e89998441c0ee6874386703107dcb5f291ee65e9d9032b3
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Size 4KB
SHA256 4480b533f8e4bf94c5d1fbf50e8540d19251eca2a723d5cc8e880fc598db8dde
MD5 619b33308b4941bfd793f066a8c76fc5
SHA1 da663e3b524f5398ed8954ac9cbd48a59bca32df
SHA512 e8c22376dde2504ebdd3bd0ad4137f3b06dd4665d7acb8f6f74938d73b5be7ab75adf64ac4b36a9769f4b02a068d790b158b7e38d6d6a4066f9d4b23cb090f57
SSDEEP 96:9I0IEvJrD5UQdUNG/q761nlgXNulNIlSEiBJL:9I0IEvJZMNse9ulyPw
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_arrow_small.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Size 289B
SHA256 61a06d9e44370c312fcbb2057c8160d7838d877c86b14a827752fe2cee417b4c
MD5 86977068884e4eb365fc5f0b9d663d5e
SHA1 89e5131e4518bd66ec35603489d92f0b50d14ee7
SHA512 9c4427d9855763d7f767fbb8c04b46d451a3f9676e625bb15243b84bfaaaea38f7abc22e94940ec466650d6a277655f5ac2d83ab46ac6d2cb3720a62f40f5c8a
MD5 SHA1 SHA512

Submit Download

dd_arrow_small2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Size 385B
SHA256 721e0032665add400a0b6dff1127ed02e52753926450a54ae3e91bf034b6892c
MD5 af5397dbc408cdb6f5ef2fb0791c4b01
SHA1 3e739518a37a9ab701501ec50abc1d5557a02fe7
SHA512 d259d86f5ddf98c887f46ba82a8c35257719704b82860050fb1e1650eaf1f2f1846873dff34385899a6767e84fcf0296569bd27e931bfe26b1dd05c001472a5c
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Size 4KB
SHA256 e56510ad5892c2ce772f74fcd7535d49672db966a3982a6ada76f9d48d35bb87
MD5 b21063e8c8aa5645a8634e87976a73bf
SHA1 4df3bf4de84f7d755198a55fb54fa66448a50b62
SHA512 feb13e0de4e74dc54335f5ac20cfaf1e70623ed8b9e80b6b5490b59eba624522ba661d0921c0dd18a16daa5ba7b6e7cf34d94b57e83fea479f72a8af8d43d4fe
SSDEEP 96:fiTrF8VrfpHpojQ/E/CuiHhof5spTdOsRW9UgzOt0yy1:OujR/E/jqhoCvOKSB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

nub.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Size 1003B
SHA256 a10618000a2ae5b58456a30d2d2a39c2437779a2ef519734ef9678d9121dd166
MD5 c1e5ddce631b7eba5deffca4e4b2311e
SHA1 e1c460419bbd2b2af50bcd9a343e9aaa8b2b2456
SHA512 d6fefab3a6be585b619d412c446340d1d17dd816c57ca3b2d912e39f838bf3831e64be5fa72f80bfe986cb28fe64339ffb9c3a8304f3943760650960c2958715
MD5 SHA1 SHA512

Submit Download

share_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Size 1KB
SHA256 1c8c12baeb1be6d9f0bd75be7839958ea38ebe8e28919a3a7f06344ee7868bdd
MD5 b253f180480dc9de3f7bff95dabab1ea
SHA1 86e1fed0683c8ecbde8992e73659182532c26474
SHA512 b470156c2bb043daaaaf2254c98557b46f6c397cc1a8dd6fd68dd7820e40025898ccdaa7fedf5981b62798d0b24094ca45a1ba1ddeabdbafe9e87532d9e4a7ba
MD5 SHA1 SHA512

Submit Download

share_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Size 2KB
SHA256 7e6de442f04d0df7633ff63c865042247d50497baa58884d5dbf711e8a557493
MD5 aff0d746a423fb590fcadc50f54d7f3e
SHA1 101dc0d50c79cd10d1235f79a0e1794830866310
SHA512 ea2203c51b5423e7459db09764caad5c8de70689dc4e28d57d842386337923a58dc9ad965a75c29b5409e084ef61a31330862425ed4b40066b998f6ed15de1af
MD5 SHA1 SHA512

Submit Download

adc_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Size 3KB
SHA256 37a0de436983eb4622f75f6ec360edd4c99defa2f0c18ae18fb5d34e10ec165e
MD5 bb623d28042841b780503083ef7e25d7
SHA1 ff02cb8a9efe747c31baee6fc3a4f6a2673a09bb
SHA512 4c92b75ddc9954fc0e4404661d7dc4fe5601da5f3fffaafe7d46cf2b66a3b0ece64dd27a3b7cadcefa25fb58afc3d6a7442f4ab76190d45cfccc81d2b795a45c
MD5 SHA1 SHA512

Submit Download

adobe_spinner.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Size 556B
SHA256 8cf0e3086f9a77849d1f43d06cda13f63885db2451e71202fb570845130e572d
MD5 3dcdbfb58125cc7b84adc46adce2a857
SHA1 f1833da52c590f69a9126e36fac48540dc59a129
SHA512 5e0192e096fcdc9129f2c708a5924e6b8092a7b204bfa5b00c8755eb91cbe06995163291673eb8d86e7e5c8318711f85bc731e918cb555b7104de11409617086
MD5 SHA1 SHA512

Submit Download

logo_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Size 6KB
SHA256 ad8298e95b1aaaa9c26f9927192b4564bd2e2428c2f03c448d53b671902a8e34
MD5 b6aa54e784ef123388cfb62a80505c04
SHA1 de7cac2dacf6157d39bb9f548590d19882b74f2e
SHA512 f54d8a0136ba0ee0de7491b49ee643f00beec8915760112727b4d5d24e30860a4f58c7d376bb0b14227453f6655486037a4794c8d7d21aa07ab2fd03c83ee7be
SSDEEP 192:rUz/3rSa/yrTPj1BLwYhDK/qGEcg+VX3lzx:of/yrzXkYhG/qGvgy3lzx
MD5 SHA1 SHA512 SSDEEP

Submit Download

sat_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Size 826B
SHA256 167db846758a595e593a1018991296df05531b0deab413c15c65a891fee66627
MD5 ce490cad37c2038ecc6e57087c87a774
SHA1 4fc9951c271053216e922b9dc07e19e5acfc3f56
SHA512 2fe0ecb80cc10756a78164c43247d31e1be015a01d200d201a15320c623a4aabf34454925742613d503ba2fea723d30b7e07c534e6232acddf68c0338172acd0
MD5 SHA1 SHA512

Submit Download

sat_logo_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Size 1KB
SHA256 1800c9e2a28a2b266c179dd9b013021ba300df8f7071c2d46352663505dbb3e2
MD5 35c7dcb21dcfb4d76d31a9dbc250f094
SHA1 5d75c4dbe58d219427cdf086b97ad4a9dfa42a90
SHA512 809249773bc91a0ddc9ec66940e74b1b8d8f2cd0b0ebe9e4a37c9ec66c0cdc3f339a81cd3558c2eab91b7168304a837cc32ee4777d7e3c7a8ceee48adbb6c062
MD5 SHA1 SHA512

Submit Download

DisplayLanguageNames.en_GB_EURO.txt

Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Size 32KB
SHA256 f7dde1f898054c382c61d67c8c984678f38162a6bf9aa0877a84e4560d086439
MD5 c8a614a6fda80a0440e9f4b2450129c9
SHA1 d67b030fd1895b3a0188212f08eac8b01c87358b
SHA512 997211db1192dc65d2feaa8923bd4034108e53b43b63b6d7d10fe2133f1c6f643229374fd81f7eb879e42e67c72b86b53ec491b8f8a3ce554786754401660afb
SSDEEP 768:ZVuJh/CEn0A4vmVOX+wNIItvjbCn3pqQPOb4ne6h3lOPNGp2lq2PZZ7HsEFMloL5:ZVuJh/CEn0A4vQOX+wNIItvjOn3pqQPq
MD5 SHA1 SHA512 SSDEEP

Submit Download

HOW TO DECRYPT FILES.txt

Path C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt
Size 1013B
SHA256 21efc99273c3b60e01b4df75dc2c96f8aeca13df0ca77374b00a2368812db6fb
MD5 de3a3b707082b03731cd74bf977523ad
SHA1 a9fcbea5239c1b8c0597c784603f3a67fcb1ffb2
SHA512 b7196c3be7230914ac2378574e3b72c9a4a4ad17d36d40a5bb93eeb4d50be72a94e397a8fd568426db85682615e2522ce1a9a4a95b5a73e5633099c4ee3ae6bf
MD5 SHA1 SHA512

Submit Download

win32_LinkNoDrop32x32.gif

Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
Size 153B
SHA256 39f6ce804e25ec1131c30085684d368808b793a4cc71641c76912d84038f6fc4
MD5 57a830c949e2f06785a8262b23c8a733
SHA1 083ad85c2dafc16548b7f05141b888104414d379
SHA512 711cf475f6573ab7b07d75e460ed61684e703997c1fe3a42cf52dc6cfa6de6e19a8bf6a44c17579cc5ee9eea2a086d538a2227c798ec1d371588f6ccc33d92bb
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 190B
SHA256 e9d3302f968c0e6fa517b253361d89795c88d1fc9ab8865543407d8a9377130c
MD5 c87fe9db162768b6c0381b4c0c2bbfee
SHA1 7e30a7a70c0d18323eee4dc86adf90e8f2c49008
SHA512 0a70cb48593c0d87e3024c40f143f3b331adb2c0d658179db2d96a59f98fcbba7aa434e12758edf2891e000273cdd42c52c6f76fa9ebb599ab56377ba4d7a6f8
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 190B
SHA256 df3f97500c1346561d432bf762f0836f29f36b041db2e58d3fc732add77a556d
MD5 4ef9eebbb5fcf838be7d8935ceae2c78
SHA1 d997c714d9e68815408ae5e9b385999801c93305
SHA512 069535d0e305c80e2c299fb008986398250772528609c14055a2078abfa99c20b5f863253e866c3c51504cefbe9a24cd71a3112ab2f4f4b35e827a2af08f7a0e
MD5 SHA1 SHA512

Submit Download

directshow.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
Size 1KB
SHA256 e4ad0546626e60fea85118b12c465bda320a2654ee4292e37e87c3180781f008
MD5 04a8ce61fa75f61f12c531f777acc1b7
SHA1 073b5c13535329a7de755c74b1ed7e4a84209979
SHA512 b784aa17ec8909071e254e27bb49a2009fb523064cf0568358a82bc3ef6ecd102d73fc957fac025196863b3edcc6a9e61badd0c6b5080d14568a50bd412787ea
MD5 SHA1 SHA512

Submit Download

glib.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
Size 31KB
SHA256 49dcfe7eca65b2418448ec7c3fd1aa69241cc1ab6f7b005031b43c0fea5f213e
MD5 07762e3096dbcefb6a0afd6808111210
SHA1 c19e5120484b34048059e51a9a9fde2f13be0316
SHA512 9c66b7a3245243686594ddcde22ed91a75837f098b789eaec0078e1f91be69cef1cd863c5b053c5ba7503c9e384da4b2b36eb81e1e9f9b97e2cb25cb75cd5bda
SSDEEP 768:MjHXWt7nzIm6ruyNDi0GaNyKU5CBZ6rdGnF4Om6kDHeq:M0z6ruG5Ga920nF4Om6Eeq
MD5 SHA1 SHA512 SSDEEP

Submit Download

gstreamer.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
Size 34KB
SHA256 ab7936b9287c2ce80b1d35c5c00c3ee1c4db706d73e4f2616d5517cae71a1c69
MD5 5cb5710b38d8a3e43d9ae4d13b7d2224
SHA1 b51185b65dc7fee68d76bc412ab92c600f4e8f27
SHA512 7a50ed573cf100e65e9cbb3a0ad4cea81159e9fca0b0365ba2ba56d788230c86616a8f73afdfd091b1e7f9fc837db735c095ea33b797d4b3d2dbdf909bb09e81
SSDEEP 768:i8Nnm+79SDHjfjwDL4pBdPlqyztbdWpJTGISet/4:zmqqf0YjztboXGeO
MD5 SHA1 SHA512 SSDEEP

Submit Download

icu_web.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
Size 23KB
SHA256 b37d86a3d5a640959d61d0fca422b8b65d54d588b671dc2103e62f598d34b11a
MD5 faa83b4c11f50f82f441b8fd6035e35b
SHA1 fd7ac9d667b74886210f4840461e8a6755df4c20
SHA512 79ca159ac4ea32a7d101ed957df23854c36ebd6332ae9e81783238c07bcf07c43f9a61a2e9c236e4cd8bfb5ffd09b0740b6402e27003ad899d5c0f0e2e936a75
SSDEEP 384:IQXK6AmJ+rY/6fEjrNgjWw3QxqVl5u+irKAt83sqWGT2IKq:v66AmJ2DfgNnw3YqT7iQ3bhd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpeg_fx.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
Size 2KB
SHA256 2d420dd69dfc2b7a809df4031de6d8f52c3f9230838c8da82f90d535fc02971a
MD5 2ab6accd01fc32b10172c8b3d628c157
SHA1 4d1e8349ee2da451137f1b9b48f65e86e22ef851
SHA512 270be63c75ecfa63f8276f2b438c777e6465034c31ecc3600295b60c8dea37c1c96eba076eb99b9d56e5fb2db8d4d51cc4d55202146715c89ccb7c837d141f07
MD5 SHA1 SHA512

Submit Download

libffi.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
Size 1KB
SHA256 46e8d82e52a47e6a19264c9108413318a0c5e0e8d45ee8aa7ba5a7903ca4f9d6
MD5 c30b94c26355a285148c70ba660358c2
SHA1 5012662a17ca464e1775bd36c1a46d8d1fbd4a91
SHA512 8dec8ae02daab8099b50610467708a143915b5a5728b34b2679a9557829c8d60c65953063194ff4a90b101c0b2442ef048ae65eef70a87fd97a040ac8d134e21
MD5 SHA1 SHA512

Submit Download

libxml2.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
Size 3KB
SHA256 cbe4ce4899ca9ce60e25b4cb07eedb366cc136eb93a4f974d4616aad81046a8f
MD5 9a206f8efdf0151836d8c24befe3ceb5
SHA1 f9d4ed63d985aee593ba770cc5580672f587b9f3
SHA512 b6ff10f80f43513e547c40e1cada5fdccc7f1464e4cb0aa16ed4d6bcf33744f3280547f1880ed05cd807e6004ec20ced0b82ccb11f6d5dfd6bc8b91166a255f2
MD5 SHA1 SHA512

Submit Download

libxslt.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
Size 2KB
SHA256 2c1ba4f0e94179ad7e8fe262c3d98275e28e5b6d93a7cee178d5b64a4ae178ad
MD5 45fcb40f7d0e3ab2a89e07340ca53bd0
SHA1 0583b4062610c40107b95cf3734911733ca602d5
SHA512 87f9883a0186271aa59a47d60c0eb7c7e2da5af4452141f869105b8a9c5a79b8e113faffb65c81ecf7940cd1a6f7382053b5cccbb1dafe40980e88bd8ff70737
MD5 SHA1 SHA512

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
Size 5KB
SHA256 4cefb11c36da6d2a55c999fb0e8116f820977d12fe262ca6c09998627bdf712d
MD5 da31ca1bcb76820d945c436f9cfe0951
SHA1 ca36dfdb7e4cb99a97f28c1f6aba80bc080f6f0b
SHA512 3643014ad94fbe4710c2e40d22306677e6a49ffe91a4c184827126c766146cbec785a94161e19f0215a42eeed848dbe3138b01fbb6a8195ae8915a9064e78713
SSDEEP 96:cGEPr+HrId0hI8DiDe13Nx3XAXfXpQz1Mfi4bHN0c/Wm2wgRZCVp:cGEjCpO8DR3r3XABQz1MfnhgRAH
MD5 SHA1 SHA512 SSDEEP

Submit Download

public_suffix.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
Size 17KB
SHA256 d61d944e80fa09728de363907848315e7c5542b07c5af1bafbc05be47d30ee81
MD5 6e1874257dfa17a52423b10c18d00bf8
SHA1 b9cb9780850bfe88d5b9853eeae55a99bd39327b
SHA512 8cbb273a580bacefc9e43c2c0a31a5514d2368c7f97eda26a82f0e2a95433784763d5868e85bc5e4159be64083136726d16a22cf65e715095db2cbb4859e4ed4
SSDEEP 384:gZwgKvIoLvorbETJdvewrNGGC6vc2PsBe6Tz8xOMTCul1RV6X:gqgm4EzewrL3c2PE5zLMTE
MD5 SHA1 SHA512 SSDEEP

Submit Download

webkit.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
Size 320KB
SHA256 0169a18e1b7f68f0aafcfbb170ed1bcbdd41c94a6bfa81aede07f8eb091f814a
MD5 930e367e023e6aa4ef165f55f56298ff
SHA1 df57e904fc9ee0142da40575d8f2cecd40e341e5
SHA512 2771c849147693e73b67e18e0d1a3e0ac3384e1cac9b4a4ac0418f13bc7e6d27bce64d40b70949c27da42cece5f7bf29055a923ad12d272160ba98e47c30f7a4
SSDEEP 6144:7fxrBRoIk7ZFFKNhnLoufdJK7qNuoTJIUlFeA4xPn7vVJd76IqsFJP02Hqb4zEVd:7Z9Ry7l+LouFo7Wu3a2xP5JP/bzEnJtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

asm.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
Size 1KB
SHA256 9034c76a6050b2d15d2ab7d4078484fcd2bd5e4c1d420e43e1efbcafcb2c5d65
MD5 e8e2c9e30dc676a97bcbf4e9c81781a4
SHA1 86ae68f9ab22a60e7ef9877b0b3feb7dabcca68d
SHA512 28a08269a58615ab1bc9dea21ab1d11198614ee774a6d73f70518d8d3c1784c9c2e12c7b2de1f60b2b92f6c517f89951c4ac166409925ab9c77a28bf8ac49022
MD5 SHA1 SHA512

Submit Download

bcel.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
Size 10KB
SHA256 fb1645d52735bafce74756a801b57a501a658b61ccd934f6a4caed4918ebddcb
MD5 3607c7b46ad79f22f3b864fd3bfd5a72
SHA1 a78554f47c43ac5c375cd576cd39b1057b1c34de
SHA512 723ad89cf4f6a438291dc0b92df9f33ec56f60e4f89bb95553a4b372f737c50ad29d4611c2a436cd045ea526cbc55895dc306930280fc49a07118c27f192bf0c
SSDEEP 192:c+Ql4JahLWthI9SZ5tmAwg1Km0PMI42SEyW0DDGPM6rbe:OyttqHm0PMIHylWEc6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cldr.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
Size 3KB
SHA256 720b571c7cfdbeeac008430d908d4fb5a7168be397ff4699793fb716f45046a0
MD5 cbfb64ffab50180b397fc2f6207dfffa
SHA1 41020872384f960c18379275f588d3c8f79be2b6
SHA512 cd930398f5f3d040fb091b398d618f6a4516b43c61559ad28912ed964e2bd21cc1c414f6f2ca912f3c07af6fd073d8e9422950be148a382493cacb738d9ed295
MD5 SHA1 SHA512

Submit Download

colorimaging.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
Size 162B
SHA256 6979015762ec7633fa67c5643d0083329196d782ae03a95bb3016db2588ae001
MD5 df2fa71228a6c5da22956cd1e84949c3
SHA1 edfcc85fdddd51a7957695f3d069aa12587940f7
SHA512 b49fdd34daa57e61098c7366b0075301795d06d1a55b8ed75cea4adf9a8a99506e61b23ce69ca9945e55144a940b27ea5ffff131748abf248ab044e63b1f2d45
MD5 SHA1 SHA512

Submit Download

cryptix.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
Size 1KB
SHA256 7e7793ed99353fdc5e680171e0741137a59a2b7c0d0030e59f151c3cb3dda84e
MD5 be4ae324e81bc48ce5cd0a1e6e2e719e
SHA1 887c18e7f08301d4f402d9871383a990e34ade3b
SHA512 b01d4befc11e3eae7b863be6b3b722448d464157f1f57690c1c0eb8296331cc778705ea62c6ad017c21bd109248574f88010cf709664b0a1f519a1cb0e781748
MD5 SHA1 SHA512

Submit Download

dom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
Size 3KB
SHA256 726701a5d3c051b108052737b652763b1417a29cd7b62759c22f820155a69a0a
MD5 9c232d293cd967ada7cad7837b7d87e9
SHA1 ec436894f8c92298cf15dc7db1bc1f849038e416
SHA512 2538bafb450c71f0523b31af90e9e48beaf69b37abbc267525013eaa8b7531d70d5462a4d208326b55da939cf00815c138e8ab1cfe91b04a0a2db1071d0696b8
MD5 SHA1 SHA512

Submit Download

dynalink.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
Size 1KB
SHA256 1133d919cb57c1a762cf4be00f1718874892cd818420bde76b60285816e4b713
MD5 8b5e41856805bd4091c2445d95698569
SHA1 6887a4a567b0f6de5f5077d6b4b1a83949610198
SHA512 f48d60e9397e887ed69259c53e4887d71b5a4df3f566406f9b7e3dea5aa67d0a517d7680008a9070c65b824ff19fe663df4f2ababa1a9e9989d641ac6f62a88f
MD5 SHA1 SHA512

Submit Download

ecc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
Size 28KB
SHA256 564937d4b0cf3ddea6ca6f9395a0337b35ad824f3c10045a6a8812ab3b9f3b9a
MD5 f51e873763d776412d5f174b6ff7c7b8
SHA1 d277b4fb5f3b8a82d5e22ae8fb484d17c2ec440c
SHA512 e25b39f684ae014c94f2eebda9511c15a92076e9485a8b1bf8236172be58aad7e7087034cd2442dfb7bc8e0c324c8ae4fbe40afeb577034b09d89e1a62fedede
SSDEEP 768:qj2OPqP+2meRbyGatJWm0ZGlJJXyl6BiYcgQVzaNy8e0:sYmeRWGa7Wm0mXyl68zgAaw6
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebxml.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
Size 2KB
SHA256 3471becc886dbe7bebe60b414c5dde7ad977bd64c8b870dd405d12300db52df8
MD5 dcaa84b0934a8ace5f16da2b3c8f675d
SHA1 2ea364cf7bf9156e853d1c451d25e5429596db21
SHA512 87f931a2104c3c371391e1145c8a72e3b1a1b194d50398f58ac1a241214d19d778ec452ce5017369524f05aaac866e05edfde1bfc48e9308cbdebf6d22b8f8ef
MD5 SHA1 SHA512

Submit Download

giflib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
Size 1KB
SHA256 83e76e85d09e470e6154d670496eba031a928f175d85732802ae3f9ffe6d0f6e
MD5 91d59e106e864aadd5bac2d4c4a87edc
SHA1 c64de7ff0fcebea81588b4a5e7ef7690e71f9a90
SHA512 6e8abbd6abd8c300fdaf9c6b49a797ca954c034194e644124cb6c290c02777367fe667aa40af383f5535c1eda9cbb34fe43ad4a28786ef7b96d8d56f82bc163a
MD5 SHA1 SHA512

Submit Download

icu.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
Size 2KB
SHA256 f7644ece7b6600169d5ba689c3e0c02ee563374a341dfb02895cca5ccac2397c
MD5 e322dfb7a06dffc8defb32227a1b3b28
SHA1 9ef5931ee85896870e68e1415eb6b34ed4e2c888
SHA512 8e6662592571c9b0715e880ee330b75670d8e802d81b5444e298ecbf5977fb62b5585e11538f48e51a869a504c83829b21668cff85f88ef36affa5917b71daab
MD5 SHA1 SHA512

Submit Download

jcup.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
Size 1KB
SHA256 2482d58d9a898815cdad4f123c24f6dbb0a67750526dfd118e8b8a4156d29fb9
MD5 c30643dc666b001cb5abe4744d014d8d
SHA1 d0faebbb2dfdd8adf0ee7c67d3aa4d291f8291f7
SHA512 edce834efe74c1cb96eac584d2e757f3415c2cdc0a75132efbdb99d34c9dbdba721e33ba6cd182ce6460bbe8e1f7c213b21887b91bfe7c30b468fe6cd9c0aafd
MD5 SHA1 SHA512

Submit Download

joni.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
Size 1KB
SHA256 c81d94df4efb902455e534cad0298ffc064410c84ffbb719b2ad64ebc0124edc
MD5 0701acf83f43d24661cd80a1163bd8ba
SHA1 6f2f25c092f7154a93eaaa5e2350ad73e5e3f366
SHA512 fd94a08c899fb55652494991be11638f316582f491d6a2da4a529586814d27220f84d889bad628ebf52e94d23b1ad59c1aaae6b71d6802958990afa735237b95
MD5 SHA1 SHA512

Submit Download

jopt-simple.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
Size 1KB
SHA256 7fec6070785587cef474c8d61be4029f1f32f067b60e54169d1c5417e271472a
MD5 26f52d3220badcd298f500bd42e7cfd2
SHA1 81e41c7eb3fd9fa4c161245b7617353531f87da0
SHA512 15707c08249dac9e64fe7b1c86953c9ead321a4f33c6a82d3e75b9a7ebf869791dc372c9896f2f6a52427e299cee04e1da5f957902a8f978b7164f790d6acd67
MD5 SHA1 SHA512

Submit Download

jpeg.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
Size 3KB
SHA256 a0ffc0436bb31f94250cc29034231a8f5f04589015719568c1a52039bbf29a9a
MD5 d7e82a7e2ad7cf2adb089bc938a6f28b
SHA1 6e7730ea3bbe201fd253a950b32acc6bcdf09d28
SHA512 d80ac23a2e8a2e96ec9e64711e574b872b1b79a9151e1f847053e93ac69653acf2a4a80396fa2da1c7d445cd73f2fa18366306a77fa63f25dd8e115ed81015fc
MD5 SHA1 SHA512

Submit Download

lcms.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
Size 2KB
SHA256 100c386e5f190d4be95f2e249df4261a85c9812fce9b780303be0f986abb3bd7
MD5 4a60ea55227351845ff44606c0406f9e
SHA1 c439a01c8eb4f98ea27f57b9e63950ffbdbdb5eb
SHA512 bc06b461685395934ffc44100cdbd284bf3f2db0ef09321f10558132e4656c0da0294d86f641f95c1ce1aa0036fbb57023b83dcd6fe6812d3cdb5353f0056594
MD5 SHA1 SHA512

Submit Download

libpng.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
Size 6KB
SHA256 e5e40d3e00bb89e8c817ac12b82fb1ff35dbeb74b1a04d08976112d44cb0458e
MD5 2a4fcfc629c6fc856e89a6c42e0f22ca
SHA1 e928b728858615e287f64582b821fb28e976e720
SHA512 162db109c2b28ecedcf7567b4eb4ba44fa31c1d63523a443f0e46df5bc86d5ee27ff10bf8b5fc938b2beddddc0854df24569c442309f2f37f67495041e8730fb
SSDEEP 96:A0rOA5rK6z9GJhwZmO4msAJL+1WoFP1bkF1T4azSfRm2oYEPoVrUdp8Gmt:B5rl9GI0OsTuF13Sf4lYEPoVkmt
MD5 SHA1 SHA512 SSDEEP

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
Size 5KB
SHA256 63e3dd9480e231671381c0dc2b8a6f9bccd19d4e96f675dc2ca1c3e2fbfd1707
MD5 b17fae1535a10739c43a47a040273d9d
SHA1 9fd5860de006e04d80fca667b809a89956a6f09f
SHA512 9b6c89b46ff81cc51e6e8addfe65bc47cb37c0a19099fa9e5bafbe8b1bf3f01889a15b237def41d783b0df2ba723b7d40d75769d588e9600a89c9803a2d2464e
SSDEEP 96:EGEPr+HrId0hI8DiDe13Nx3XAXfXpQz1Mfi4bHN0c/Wm2wgRZCVp:EGEjCpO8DR3r3XABQz1MfnhgRAH
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkcs11cryptotoken.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
Size 3KB
SHA256 7f26480c9363ac518a07ca7729d406176d3cceadc8df32a08eda6efe45249ea9
MD5 a00e529fe9129b1e7650a01e533dd70a
SHA1 07130515c586d71a234570d213c25e49ed2f137f
SHA512 e58809d61bfe4e7e3c7a4c0a63450f44038c0ebb7fd3149a97bc8bea558e48194b3bca13da827a438baebc044eaae12a03719dd1c4b5d0a3aa79a5aaa32c2fa7
MD5 SHA1 SHA512

Submit Download

pkcs11wrapper.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
Size 2KB
SHA256 94bf7d5541db615a1f64af1a00ec81f6545109f1579cab99774ffa65edafe3cf
MD5 094ee3ce3f2ad12eaf390314d9cb0d5b
SHA1 3c8d37e8a7e826432244bf0ac188e6071b744687
SHA512 68042a5611a299a260cbf60e964558688967a7898b0165e456d1addcb96d9991ec7440cce2c2b9213cd9751a5ce48c70a17d84a21c74ffcb6905bec5fdcc4709
MD5 SHA1 SHA512

Submit Download

relaxngcc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
Size 2KB
SHA256 107f5356e9374b9307842dbd484d5ddd15414f157b9a5b7410348fb978d27fcf
MD5 98c531026bb4cf4ea4d379b4157b18e5
SHA1 7944d589625f11484b338bbaf308be5370b16201
SHA512 305ab24bfdbca49f6b655db44268f4873c792577d5fe10f5d7bc1a7a5f5d857e13df2ac547bd2284e320145cc6c3c6c6424679cbd92fdb0f972819e6ca88bd83
MD5 SHA1 SHA512

Submit Download

relaxngdatatype.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
Size 1KB
SHA256 4e37644f07d24fea40bc88221dbad907218195a9a499a617727381e13c0c459e
MD5 55322f2a6b9dd767cd92ef1b87f42b49
SHA1 b6234a0a0ff5412eaac83ec7b653abcbfcb68ef5
SHA512 09e5a20ccf277193c54a53bf47db088cd26facfe417a94d21a743b0f9602a0c2fbdc4b7aa046654ff647c8c9b958297e25fb4c995231e168f3ed8f2242caa63c
MD5 SHA1 SHA512

Submit Download

relaxngom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
Size 1KB
SHA256 1d175404349444c3c2d30aa6bc1d493ef8271f6eb10dd7e67226b791bdf0fdbf
MD5 61df05eba895837c555131f857605d8a
SHA1 afd51ab5686a6e156d4cd46b0f4ba453de2ba7c1
SHA512 d5804ef3c2c8c223aeb1335f2400b0606a93d5220537722622ddefc94f6a1956bb5b3c8009c178cdc55fff600533845eac3f495a80497a5dbe37c773f99eb5cb
MD5 SHA1 SHA512

Submit Download

santuario.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
Size 11KB
SHA256 87c86ee6646e90d393877a9c109317ee86963357e5e077115b25388372cac3f5
MD5 7211cc4b7843aaec13b7f5e7f0739039
SHA1 c4f023b699465963dc53462d3c96221f22ee42ef
SHA512 4479a92e5dae21b0b56c7d6d4e292325038935bb200b78ecdfdcfed3e1662afbc997176040d00e77611c8f08cd7eebcd9334da38d2d90c00473fbfe9796b59c9
SSDEEP 192:jzPhDGpsRGuvEclxmN7lkzAK7OBi2vXMPJ8+BA57XtYDM/ytS3JB9c9RJ:jkpqv9WgGiGMe+BW7d0Uh3JHc9n
MD5 SHA1 SHA512 SSDEEP

Submit Download

thaidict.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
Size 1KB
SHA256 52aba23d28f9cebaa58483ebfb63e94d6a604f041610cec8c99da5cbf9c12dc1
MD5 903c3067e879eeebcfada2b0230b0fab
SHA1 7f61e8ef4a12bee3d501de379d2d04f815613200
SHA512 d4fa9e9397e7d9962203ddb5d0c9ba36b3a23fc632ec7ed81bfe43ff591545b9351f48c5371a92946b51b8c7037b33ed1b8a72fac3dc4b5a6d9e4d4eed8753ba
MD5 SHA1 SHA512

Submit Download

unicode.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
Size 2KB
SHA256 44a8b590fe69677c1ae2ced372e0add1df4e9fabdd8209fd8db281dac2467dd7
MD5 5b683eb27d0f8059b116bdb01a2613b4
SHA1 27e0eb2cc45dd48dfbb1e3a3bcd70eed4495e3cf
SHA512 93ecebdb98589fa8b8f1c54e88f27f533272899e8aafcabb269181215b91a48f912d7ed88ca95402c47616bde89059ea5fe1e7a98e9825db2e5e0479a8b5b50e
MD5 SHA1 SHA512

Submit Download

xalan.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
Size 11KB
SHA256 13eabec8c8900dab5b533a375432e2bb203f86c991cc3b1255ee4a77089a855d
MD5 b9d07358e884e418365da008be0238e7
SHA1 4045a6bf023f5dc7cff29bd8dd0f15ff2012dd89
SHA512 9e85b6458996adb6b0789a21eb1bc0e106e8ea2f9247ca6cc57ab58e2fc8a2a78c5bfddce3ab9ac12b783f78e76c75fb9eabc2a06d86c25fe9dc609ac4188c60
SSDEEP 192:PyxhnAjh+08Qqui7h5S39UDEPi19GRu1Qi7uiYavY8XR:P4Ad58QHi/GOqif2E73vTXR
MD5 SHA1 SHA512 SSDEEP

Submit Download

xerces.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
Size 11KB
SHA256 ab6ce8a3a0a7b056f30448ed7a8bf9f05cb7de015fc831585d2061d42b715193
MD5 3961a18ba8f3d775734f2796bbaa66fa
SHA1 85d1a2344217ec330a3e2cd8b14ec2a05e383f13
SHA512 4ceceab05621cd5124d0055358eb10f1c64634fe224a1f0b9ce8a0a90e95b9adda2ec5e1528bd56c46c23333096d84f3af671eba26ca191f419d0edc8227b08b
SSDEEP 192:ydwkYZDqPKx25QdE3nHW+qf/HdldWUu9ITaFWkwaf/KfFRM4HfgDMVYG6mFT4arM://dqPKx25QdEut/+ncaXKfs4HfgDMK97
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmlresolver.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
Size 11KB
SHA256 515a412817b0cfb996d2168bf284d413e8892ed29e87167f29d2d54516891ca2
MD5 1a564286a412b036d96a6f4536e21736
SHA1 13403dc348d4842c252fe6188c47bbbbf077a2df
SHA512 906aa0647ca12b442c31068a31d22181f3ad95432117300f2890f578b9ed047c9e737522e65d4ae97c1e708c317dccdb9115ba821d4fb1d278c8a1a4fc9efef9
SSDEEP 192:4vjh+08Qqui7h5S39UDEPi19GRu1Qi7uiYavY8X/:4d58QHi/GOqif2E73vTX/
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
Size 1011B
SHA256 9c56904480d7756bd7850ad2eda2ea1320186414c905d31b129939b5b040e714
MD5 dc92d60dbbaef2d2bcdfcb8d0f2e5d21
SHA1 dd7a55a3a8e9c0982e24e364472d24b9211b6bce
SHA512 4ea595ce95f8c23b7d8e642fe95be96376ae5ff71add28799176ff1d32631894fd42f00e8a34155cadd1d57e1955bd6a59e4b299d9ffff8404ed8279f99dd51f
MD5 SHA1 SHA512

Submit Download

AppCache133727658720680492.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727658720680492.txt
Size 77KB
SHA256 c591e87e138cdf707ec70ce6449d5237482298448161b6c15ea58d49520e7c42
MD5 490c7a7fe40715120fd88c70047f0e23
SHA1 d44134997918cae663c04f48f47ceebee1977737
SHA512 adb5982348177cdc8f80de7c0ff4c792478882ab02b221da7939a983108b72d5268d2adf64661f33b5cd6bbeecb5a542a8e722f2609a203a4630e5e80d1e16d3
SSDEEP 768:ecZLNOypNsBOU2ad+pJ43eoDuk1RXaz2MRDsZTV3qF34nsyeh0X3ztAIH:TLNemS3eo1aJNF34n/L
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727659161166784.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727659161166784.txt
Size 47KB
SHA256 dae44cef0d9a985fc1172824ee6f23e74fcf4b4250b24b1a87dd0e8a498d4188
MD5 dff814510af3250d1726d48846f63bf7
SHA1 5711128a3cf2a899ada12c413b588e6e67817843
SHA512 919eb11389bf07c07858967730d3031774f6416134c92f417e2b3f12063e91e2f6aad0353752957c49b6c5dc4ab92329270ad50658676759e2e5d97a90ef21aa
SSDEEP 384:0vl6r6Tfy+PDfLMSr6QS3PO2qu5KkNyrXxfhIXF8CqDmZr6yd1Y0KDKNzHdBAr6L:0Oa1zMYVSGOhErBpzOVyo9YV3s9CR9S
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727665191668352.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665191668352.txt
Size 63KB
SHA256 d9b4d7887cd6d9f5a175f697968fa2ce4090c5aaf85a9696949bd393baf463b2
MD5 d80a5315ac03d88f34f3873535d581b0
SHA1 87cd09bb23a438ae26e1d8b86e06474653a020f1
SHA512 6b4b5b7eb49dcbd144589fbdfaa591e86d3714fa43ba5ddccc575dc5ab33895fac43cdd4b85f1bdb7a5e7dc9556025f858f3ebc1f58a514cb490a37e6788b2a2
SSDEEP 768:Pfd/ZG4N7sBhKDuk1R2ebsx577k3zrkiv:WcsvKkAYU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727688804020994.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727688804020994.txt
Size 75KB
SHA256 129e590acc5d7b993feb9fbd70b14988d865aff6fb9b883cac374c0a42125780
MD5 858ae0b2c5081a843a3268ecabbc4504
SHA1 b7396d11a6b5f047da9f386c3c0020e6ab1eb4f3
SHA512 97408cbb68891c459b45bdf527a7c667044873b63df9ec6af494899da70241b9a941a749983ca6e24721b3a2b1d96d43ecb6eef097cf51496b49536d30a20804
SSDEEP 768:a8hduAj9vMukgml7A7C33ObV3qF34nOHNjKAopyXzakiv:aWu6lMgmlwmewF34nOtuT
MD5 SHA1 SHA512 SSDEEP

Submit Download

File Explorer.lnk

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Size 407B
SHA256 60abf90216ff093b9133544e39f79db14a967e88a7cfc0245d983eb9d10a2fa6
MD5 8b32df1a4e72fdd156f5d04ae6354f88
SHA1 1780b4e9a8f9401b57070d75a7f46e57a2df78a9
SHA512 4e76762e6de23ba87f4e4c25b304f0d11afb47fdbe43907dc95750c22459ed549f935d00982670b996f8557b0d9b815230444a29cac77e8606740b2711060551
MD5 SHA1 SHA512

Submit Download

ASPdotNET_logo.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
Size 21KB
SHA256 5865461ad13d737ea9e915e788f957eb87b0fb42f69330d6f1b6e4eb73cd1687
MD5 dd95eb82af1cb745b2ca4c3301a5d937
SHA1 4bb7c2af7ca9dcc0e482f65aeecec3556b4056b5
SHA512 671f4c939cb5268315d9fc1b766538037f33e77dac9ec810124c04b40f401d14a1d62d4f8bb3646b8a7ba9c6f3f16ec863af308697248357fdab934314436b80
SSDEEP 384:t/1wThlJf0Eob2deW8LGUqnctTH/cyofyAdJTb+Kpv1YgkqwX2Ss:jwTBf2b2dgLoE/EfyAD+Kpv1pk7X2Ss
MD5 SHA1 SHA512 SSDEEP

Submit Download

HelpIcon_solid.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
Size 1KB
SHA256 5da7bf87988f29b04517ba7b20c1058702a2011e675d765a95783d4cd3da5090
MD5 77621ad0db95cd7aa3b18331bb78e8d2
SHA1 6c7d3cde5521aa243d8ccb9af2d2345e4f361799
SHA512 2c27ddc88d62a30533cf4d9b08d465eade79c37b2c4168cfd383dfeff11ba671ab1b86e26741e9f4379593f2c9b0904a045283202a298e14ba270e706cdafd6a
MD5 SHA1 SHA512

Submit Download

alert_lrg.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif
Size 952B
SHA256 1bc9f4a76a209a063197e6c98786fe46e97a85c6e9fee3e806a45d146dd45d46
MD5 e841b85ca7a8599d0f049b58727bff89
SHA1 747944e20f878a203faa0f0646edf9507d3456cc
SHA512 c8b0380a57c10b22a08e6c4842a195c6b8ca0cf02a62e35a5112c81ffa20632e864ec0c12f329fd3816a8a21b052eff56011e82def3059631088414e9743326f
MD5 SHA1 SHA512

Submit Download

aspx_file.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif
Size 121B
SHA256 682cdd99930d4a45de6730d5a7eb27726dd70a63d71d2e87f43f33dfed49bb97
MD5 e87496333cad95b8e46106d6df381cdc
SHA1 58e0307579cc8268f72d7fbbc1cf541685024999
SHA512 74ac90b467302b4dcb2b50752ebc3a1ef230f90b884258a6917bc9c6d8714ac0e238ed8c464fa2e9634b358f139dead052851bfeb13b1b293946619553526d56
MD5 SHA1 SHA512

Submit Download

branding_Full2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif
Size 1KB
SHA256 82ff24a31c042ea6930c70c2fe200de83c9b4ccfe08d29744b9bace629d4a6a2
MD5 4e20fa35bcbf9f033b49d59e54acea7f
SHA1 186956e9223bcb506cba537ef5ff57551c2188d1
SHA512 d91aa67998896668f4479fefd6823aa97c0d77d58b0d085fc0bdeeb20c58baa360ddb3402bdd7f37310f4869e296d88c73a609cb578758672197c1f0800bb25e
MD5 SHA1 SHA512

Submit Download

darkBlue_GRAD.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
Size 8KB
SHA256 b1d3778117a3d17e122b53cd09722593eb46ce8a8b7f81b38329d6c1c89c5a9e
MD5 f5ca0a72e88687188f532d8187ce1c03
SHA1 e621b26daf130cf5831ae115b1caa6bc35cbcfec
SHA512 efc5cd587c4053f5c9e2d6c7c9eeca86c5235ed30d00bb049c1c57632d246fdd9dea922d80bb1ae8ef868f83f7d0e186cd2d88192a77f69034bfda6153c222fa
SSDEEP 96:+0/rN0RJ/kdsjBGAsFO/GNz7FTQpZ27P4Vi5Ku4D7/v8:xDI/kyzsFI0ipZs4Vi5x4D738
MD5 SHA1 SHA512 SSDEEP

Submit Download

folder.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif
Size 914B
SHA256 d43826bce1d5f3c9faf9f7b1205500b1309b34d24e42ecf0e2f1f3ff0d5d9a3b
MD5 2e41ebef7742876009d1fb72f3ce19d8
SHA1 f5c031e2f4e9870d6d0249cab70813a165df54bf
SHA512 aaecb12b6cada85043c626d183568a06ab0e64c2853b9c1bb40ff5d42716cdb690a7d28a1a512d17398253fe9ea0244bd4ec46e553eba62fe8c92eb1d1bf2cac
MD5 SHA1 SHA512

Submit Download

gradient_onBlue.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
Size 90B
SHA256 841f0fd2181138316e809298be2cc522fd9fa723afa5e5992ddc50952ff9c054
MD5 a259c3ac00e96cf08d2275548b1cb876
SHA1 a2e9f00db0ca38ae43981f7382f798b626b805a2
SHA512 48883922d20013bda59c8d3fbaea40d36b06b387c935cac6784511912cca91a1be3669e6ae2fae96f54aa9511d8388a7b6eba4892b430346c737536365e4aa06
MD5 SHA1 SHA512

Submit Download

gradient_onWhite.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
Size 90B
SHA256 c6a5a8060eae79d8ef967bf18665b9e977c6fdcd64cc03669f64dea5cd85414d
MD5 be9fe65fbfc61621793bf89536f7954a
SHA1 6f53058bb15ed6eeffb365f173d4a4eee0e81f9a
SHA512 d54dcf9d1b6fc0a85be546e54cee057d58d3263162b8d77932185394df0d247cf63f2f2e80209220930618dca65c347b7f5769941399c89206459efe84a21ea8
MD5 SHA1 SHA512

Submit Download

headerGRADIENT_Tall.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
Size 328B
SHA256 2c3b78fceba0aabe7113a0de3d6703bb14dc346c93f7dc14bd5ee81fefdc84b7
MD5 9b0bd05208a5ba2020033788e7979a04
SHA1 bd12653cf4ba32db4d739792e847dc2f086aa816
SHA512 1f16daa98b9e4255e5e1628f42d21934bdd94c136af0008ead70d9f0f4f6470481d153e96791037911f2054348fa4fc891208a80051da351f46e72a057b02d14
MD5 SHA1 SHA512

Submit Download

help.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
Size 1KB
SHA256 18bbb6ab207ff52badfb6fb38636e865934764f4eac24428799917656fa517da
MD5 3ccfaf44d005819cef439334920bb340
SHA1 e0c78ac672e10ad655f6360e115f72ef77048f42
SHA512 37da0d2bd7534d26e2863c768d5e3f6116eab944664126c53edb977f649604703320dffb4060d7d995631a2adf18f11f2054ea19571b464fe0c095e9063bd236
MD5 SHA1 SHA512

Submit Download

image1.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif
Size 162B
SHA256 509a26b2811348cda04734de3bcb6cf1c9b75c1f2e39f2ae775c319ceab75fcd
MD5 82f1bfedce7e7b611760ffcf22993cd8
SHA1 9a5214ebefcd028524e63b7556e39c627ac74846
SHA512 f13c666af9cbbeab71c03338a941732d039a670c7b7a8904159ec130a59bb3508ec61fbc5153558ee424013e3e5a79f6cf5e92afaaf7e98d2ba30bb83421c44b
MD5 SHA1 SHA512

Submit Download

image2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif
Size 586B
SHA256 b229020ad39a2b4707f34f31bacfba9d1e9d465be20d8dd3ae9765c25b85c494
MD5 b51a56346d58b0fac59af274ff3279a9
SHA1 339e23d11069a2f8e4d82cd93294838996303fc8
SHA512 a9882acf4e56a7543001d0a8d61dea92c19dd264f6c7c0b559eb84e673bcc58f05e8717b686e96d14113219a379d27a33f50008525a3a961d9ebd6050f0212d2
MD5 SHA1 SHA512

Submit Download

requiredBang.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif
Size 124B
SHA256 f850cec607088830be8084ac4207dc137d81d5ec3b2b1b6b12cd53600ebde6aa
MD5 441faf5cb3be6e74380fbc118dc50aed
SHA1 9ab30ba04d852d1fe87d0ade6e5471e0fc0882ff
SHA512 27295068852229e2607390149d7c47efd5781ed947f1a05b897ee3ae34e2159dc73d7609defd3c5da298a0bc6b6127aa5bbfcf595f9db9559b8f250e0040dbc0
MD5 SHA1 SHA512

Submit Download

topGradRepeat.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
Size 8KB
SHA256 67cd596e4b11850054916be44e50077c1c2c46c0c7727718aacd199a93dc50d0
MD5 eac6b774af88cd2ccf20983b32687982
SHA1 6a577f56531e5ce18849d633db3821cd947e8aab
SHA512 8c03f5b17f6262c866edf31f1cd23f703b8a2dcff9c6b9b6fd3117844632630a249a3cf5ee747fefc47bf9bec31c6a9cc1f8b0dac2d46f084a6e6fc4d753da25
SSDEEP 96:uIbN0R+/kd8RP8v46GnXLCinXvkozTIaIkS3aN/P4ViGQ4DT/v34nYN:Nbb/ky9t5+ifkozI3o4Vin4DT3b
MD5 SHA1 SHA512 SSDEEP

Submit Download

yellowCORNER.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
Size 880B
SHA256 f1950f445c0a2c561ec4ee234527aba545e09a0261b905069fe4ed82589e6ce9
MD5 819a8e49f1223052d4e30cd9b97c973d
SHA1 b180a701732381c8181c2aa934736f2fa6976feb
SHA512 2f11de6bf9ad373ded1ead2d5be8064f645adbd9a75d324f7306fb541bc743634a59618895d41a990264d392441010692294a941a37cdeeec08b14dcc7db0591
MD5 SHA1 SHA512

Submit Download

InstallCommon.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql
Size 24KB
SHA256 1472725202e817a3d6cf400d018a66369622be0c987c5404358ec2ba7b1de172
MD5 2f5e2f5eb831c19fe8c45cbd207eb65b
SHA1 ec94349e8b057d70b1f184a25b58d21f518537c6
SHA512 1c4704c087e52c824a7fb47a09919f9449c11e2b29876e71c440394e5fcca931440b26d7f76a89fe1efa2f6cab82b44b593fd985510081f055648aeda2ea9f45
SSDEEP 384:fPFYno76MPgFfE7f7tGqCFq5ejwxWrcUwuRERXM8p4wSgR5pOus:f8BMCf4fEqCoejwcYUa5M8p0
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallMembership.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql
Size 54KB
SHA256 e8480828262f4a9f4d24217a2bb6ad991e1c5e94debfe2d3dfd3ccbcb94e164d
MD5 347df849cae49b62f220f52688bc7ae4
SHA1 deab52ca391ab902fa39302bc073ce218bd9d63f
SHA512 cad254dce3cfba470acb9dbadfedb18b3a48879a1799857ecee77b376c59cef486d022510d914f9122522c4cbef019615fefa76e46aea171e668e612134c6f6e
SSDEEP 1536:6GvKoxNROZKE6RX0F7ICy+Wg973n4Kd/ULBL:6GvKoxNEf6RXy7ICy+Wg973n4Kd/ULBL
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallPersistSqlState.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql
Size 51KB
SHA256 e5ca1ccbf1fbbde25d797d10785d0d7acada9b048887d6bc963546abd47b2f39
MD5 ad7aaa67b6f2e63d205d97da8f36c82c
SHA1 6abdb36d9781217ce6c17ec31dccf15bed9faf45
SHA512 209fce4301c82deb3726bef9adb966a9d9ddaa5f763285f11d41cf41d3ab751bd927890a2fff41c88723e6269940822b9badc1e711e2d40be41b69cad3033cd7
SSDEEP 1536:UFibGFkOzJcs1p0LYe6duJHqu0P9nVMEX9:8iikOFcIaMeePu0VrX9
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallPersonalization.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql
Size 34KB
SHA256 f831aa223985c7e4a55ae094dd82da43939fc6257efbaad6aab291a5fd46492d
MD5 a86ea9ab1938f10f9693ea5555a5c69c
SHA1 19fbf46161306ba06656c5fa6bd709b9b1f892f7
SHA512 cea451d976454bf49c04d807ca0a4f42331c358823325d0893ede025d90c2d4794decbd7e02c5032a60952e5adb7f83fca883d5fd8381e8cc221be708b6b9b4f
SSDEEP 384:ukXQrrZ5/Qb5Navpav5J/PHgIJoHR9hm9IcvUQkkkBEDoTBlb4ErvAJ60m:ukXQHZ5sagz4Ie7mycvRk2DoT/Xo40m
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallProfile.SQL

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallProfile.SQL
Size 20KB
SHA256 2cba2497a7b5ff73dcc3d86edff23a5d8c352c86222b6f81894a34a51635ccff
MD5 c53df44f083a63ae9dd2d5b06dd7a012
SHA1 854546fe3b52a93f743bbdce985c79f27b0c215c
SHA512 a71e58ffc61d435c4fdd29014578d66636ea7ef31d7874bcef20d7200cbb4a51cd4d594ed34c42cdbba033d0d57e0d997d7438bc0cb256459330548e13a90d83
SSDEEP 384:adAq5ZCTO4eTGrjxzF5MtNhtvuQt/KSoEJt/poPEv66VeYO:aiOAODTG3xzF2ht2Qt/SGtBiEyCeYO
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallRoles.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql
Size 33KB
SHA256 cd11c2a12e9e188ac188157e96989c2a8429f0e404954c9fc9d33e940c8ed00d
MD5 6a3a8256f36a153d65fcba43fbbff37f
SHA1 17b79c20f63daf1e72af9d87bc26193eb31a29f9
SHA512 989c7aecf304f36452650a80b29fe00ecf06f623e10ab44a2fe1e2b0687d5519eb7bb9f17014254fe665c94ebc18acaf85113715a85e1d8b6d33fb2ba724319a
SSDEEP 768:lTXfILEebFYN7fH1mSZzUHCQMlo4qspLi5PQmnKxgFC04hZ:lTX+YN77lsb4qo6PznWgchZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSqlState.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql
Size 50KB
SHA256 b01aa06ff2e4bc6073363588f875a52f9cf976bbf2208021f8af83c95787a675
MD5 30c5a1180cf5cf312d5f9e592d573e85
SHA1 30a0b03be30ac9e1f65a36e9ccc6174d15def1e7
SHA512 13acf9ced245848702b1e469d0a4aca5a45a59c9858cc2c472a4535ee29c47b5ddab8f8bb55063d1dcf3ba135a89234c89b68b80d9fe116d7cae1e1c0075ef7c
SSDEEP 768:55r64m1amLmumavWxrBnYPjdGHi7AkLNCjxrkGT5X74Z4oLjmLZ/t:3rPbakNSkfMNExrJ5rw4oLyd1
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSqlStateTemplate.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql
Size 52KB
SHA256 665b76832f9881f1fb7a643ca69590df8d9fb194493afc81d1849d1be9f1c8d9
MD5 918fbd1d2041c7d1e4ce2246bb41cd15
SHA1 f2d0e578263738fd655f118bec0c4fc273cf9395
SHA512 14d6af03a1283b1c892dc7e250c4251d7ecdfa7f269dafddf55d66eca55ccfe7cf6c762ba00956c1aef5c7cfa11034607dcdbc712e6bab63a846dabe43cf8f05
SSDEEP 768:hkUqPJBmKtHckJz7tL7rjiAOVzxXxe3srF5tt:2UqhQSHc0tvq1zxXxgsbtt
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallWebEventSqlProvider.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql
Size 6KB
SHA256 d988faf1a1f903d16c7437bd0ed1b60ac0d8562ce579ab533d188b5793d1f96b
MD5 3f8527e01176f9dc52cc37ef973256e5
SHA1 d1a932256ef9de61aad199693244eb38ba4a2a18
SHA512 e573b45a3ce8194298fe7cc61a6a7e730fa998bddabdf4019697429161d910dff827498f1c96a697908dc568214c95d08a2289bb962dc080ce85e64197d0d8ef
SSDEEP 96:v5r+Yrj6AGlpbZjDo87nCYJPFZgkFmVDlQHg0TNdPMHkPuv9zsPQjP4IW:vTslt7GmP/gNPWvdPME2l4P+P+
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnInstallProfile.SQL

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UnInstallProfile.SQL
Size 4KB
SHA256 aadf222b34bdb651709603ef6e5ae03cbbe7cb9ab2e602dc45f1e9ef171cb7e5
MD5 bffa741d6728a267dab7f91f69bfce3f
SHA1 b9b30edfbfb9b7383aa9c243c6ae7ea60a416bef
SHA512 d960dc2c101b59621e471c268d3686c625869174c8bca3cbc1519ca340db8b1cd4491e4d3bb330da462ffb87459566ec56e21f3690329dc19babd5a27941f89d
SSDEEP 96:YBvdg8coC5VsK6gH+cCtzpyCbS14uiSAXF+AXzhuTVZawZD5iKEZ:OcoYjBH5G4/uIAXFzXzhKawZlY
MD5 SHA1 SHA512 SSDEEP

Submit Download

UninstallCommon.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql
Size 3KB
SHA256 e129c64254a19dab17659ea515edeb97c76d6d3db5efb9d35bfe22f3d9f92a0e
MD5 01742d1c533dd3c1f4cc209eb26823d9
SHA1 72a84f81b0b53f754f794e070fad381080ae404b
SHA512 e53b70eeb81879714c0e8c3fd74634dd2cf20c82bffef218fcb2ed741451a0eeff70560c4fb8726ab6976a5f163e671e88ecccde2fb1bac7ce5defff3aac1fb3
MD5 SHA1 SHA512

Submit Download

UninstallMembership.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql
Size 6KB
SHA256 da421342e6991d6d6ebdabb51be7e07997cbdaf2e12cfb1b1c49f34713d9e769
MD5 d86d414de312bc13e74fb9d4ceb5c260
SHA1 e10281827b477b052037e567c8ac9a220dd97d2f
SHA512 0d0dae34820e19408097282732f99ea03d3c57a14daf1f5dff8ba1acb793feb14ffa009cb417f3321b68946a131aa76b03ae45c422cd3c3e81e33d0b11c28ac9
SSDEEP 192:XMIcul/a7eULZxzdnBz8ZuwE8YbXFXSQpBT5q5hGG:EuvUPdZ8LE8Y5fjgvGG
MD5 SHA1 SHA512 SSDEEP

Submit Download

UninstallPersistSqlState.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql
Size 9KB
SHA256 ede516cd783c0a2c6dd96d553ad8b2b9b1e822812762c6f4c6a53f3986d17254
MD5 0850a128de1a82cc5f9a0a17881c1f6e
SHA1 cbf573c2f4fba4b6ac0b0ebee0a14296aedd2de8
SHA512 8012b9d8db14a8bed99b74f03d8305e938f20162716479d8f4dacbd318b9e98df519fd5b24d6267c5c34561875cbed9e3e25bf675f18f090de076ff23ceeff6c
SSDEEP 192:ybbekolbMs7o6DVhxVnRDszioJlJivftm3ng37QrJ:R3lbMs7ogJ3oJCH83ng37o
MD5 SHA1 SHA512 SSDEEP

Submit Download

UninstallPersonalization.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql
Size 7KB
SHA256 a13ab5d9121980fa262db14982a9f5c43b9e71037698407499c79b26f9fab620
MD5 3b3e1960c944512e3c73c9b1b929ef01
SHA1 2579db5774dd6264cf4333bd063192ef2fe59a21
SHA512 240effca032f23895e332d5fc5065b67c8909562a775f727136a81ef11ecd0749fbd1f0653a1ddc232a4b5b7329bdec1128fed1cbc661f4520bcd5e014858b1a
SSDEEP 192:O3tcoYz/bweM1tKrVGoXFieknzerUc3C1Z9og:TgeMWrVpiyjg
MD5 SHA1 SHA512 SSDEEP

Submit Download

UninstallRoles.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql
Size 5KB
SHA256 52088e8a2ceb737e6b01ab275f06c84406a36f2c5ca481e53eca2f874ec32c8d
MD5 d7679b06ea3ecbdd56212b6e6e5ed99b
SHA1 7e21ec0198f0740baf544ac172f0eeb69f4df4a6
SHA512 ac9d6eddaf473be09a371be9b7e8c5ef2519e61e3031532ad34f49fb28daffb9a5b8382633ebc316321262bbac125bc217d4264422363b594515924bb0c5b27e
SSDEEP 96:BJnfYEpvUMRbuocVScBy21zLqEnXOSUY+rXF+4u5RAxMkuQ7bY1s:Dngw/bBcd5LqEnBUY+rXFjaAxf57As
MD5 SHA1 SHA512 SSDEEP

Submit Download

UninstallSqlState.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql
Size 9KB
SHA256 e178ab75d6524539a9c5f89d8b1e4f847e66b0b225767b2afe6a5d93e9784dec
MD5 30c69867898b89e64209cd32f799f0b8
SHA1 2e4683bd9c9986492564bcfb9884c1868e3fe3ee
SHA512 672277a2323200ab614996ccb268edad23c8b3571fa323e0543b51ef9976bd2f4bd4e6e1e1a3afcf69ebca973cd2861c59ae8d55b1db4edeedafa5695ceb5e96
SSDEEP 192:qVYA/OoYQSI1zmWQ7SopnLttvlpptpqlpLsbmiWgyvfY:sYAWoJqSoffqfLWmTgh
MD5 SHA1 SHA512 SSDEEP

Submit Download

UninstallSqlStateTemplate.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql
Size 11KB
SHA256 8852f69921e30f55940ecba38967c9f6a463edcc3c2e2db3d545172023cb8f29
MD5 a182309970f6381106eb78c5323e450b
SHA1 2dd1656756bf1dcd27a029c3ec72efe0ef4dd462
SHA512 964873e3134c60a77e106642aa8ccc6ac0eee6fc2f0d0b9d6040c64400e3a8a98100f594d1fd2ece82806364fdf9aa8d062435a9021bb80a6098cde0dc0d658e
SSDEEP 192:41p7eh51BkT8r6TgeW27CQMUZmjQgNcl0Zq+sa5ScmlUCGZK:41NehGQ6nCQPAkCclTPa5Q/
MD5 SHA1 SHA512 SSDEEP

Submit Download

UninstallWebEventSqlProvider.sql

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql
Size 2KB
SHA256 461175c174063d0bd5088437b948fd3c48eacb19dce70d579e83c269b487d7cc
MD5 180fba033218b528a4613ef7d049c283
SHA1 c09b9a25d60304f7d1045959e083298a006aa5b2
SHA512 91aaf26982a5c99997e524d06c93d6154512b222b991604a0bda26dcea74466923c0cd21649281828e085f4b73d48057c0e80ba19b70938933b775099c0658bd
MD5 SHA1 SHA512

Submit Download

SqlPersistenceService_Logic.sql

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql
Size 23KB
SHA256 930ab5f94640fd3a208b52220a34899e952bd63bf79e8052ae86996660ec4c4e
MD5 90b0cabb51844f14482d16f8f462570f
SHA1 7c0156ae6142af88c9a3c8ae4cbedd869070a0b9
SHA512 978b2729b4670c8fc71e4d61c090a5963007832c4eba2f30e30cf53cf17ca0ad05a8ca1e1cf7c99b576d6ea7a26ceb909d061277234ff538b1de9add1c9b5d2d
SSDEEP 384:/qyUilZQ1ioZ7yMYWDAEz26BO+rwyByRFwUKqRHy2V3U/sT+yxoBzLJnqKYqbzcm:/qy9lahhYWD/z26BO+EeyRqUKqNHWu+x
MD5 SHA1 SHA512 SSDEEP

Submit Download

SqlPersistenceService_Schema.sql

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql
Size 4KB
SHA256 bc5390eb9a58c1192764554db53216fcad1aebc6ee027b0d79fac646edea84aa
MD5 eacb7bc7db1a9066ba9e328650f1a872
SHA1 52a37ed5a366eb191a9543a7b65a09e90e3ee344
SHA512 603fe9b71640e82a73f2f5ade0a827f11df789da1c81e0d6058df66b954034ce3c83b8ee181f9a6885ec503c45d3819661356acba4dfe3db0798cdfd13d70768
SSDEEP 48:PO3RmS69lN/fh7P8hx8FZBECTYymqLPYX/VhOrmripHpu3XAsReSBBQlbip9L7bb:PHhLi4ZJ0+LQWBpJurUYpJZ6H1i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tracking_Logic.sql

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql
Size 372KB
SHA256 bb308c19646aad0083ea4b6e8a17bf6bf2f70e43e6c1882555585b1667ed07e8
MD5 26d88cbc4f4ec65e960eaa3fc3cc1ac4
SHA1 7b3dbd9bdae7fc7946ca9e27c2a0d5d9a6d8a5e7
SHA512 7896ae0bef3782e322d273cfa9ef21be1f28fb7f64573c0e429c0443bd847b1a0bf36cfadea7f64817e8dd9968204a8cfd1448b27ed9c0746caeb18e4074effe
SSDEEP 6144:ZfroOgLSHOrdyVRMQPx9HFi9Tri/aOMBgqQGWaDQ:ELSHOwVRLSPOMBgqQGWaDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tracking_Schema.sql

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql
Size 49KB
SHA256 3d2f288bc88b484338ee61f339d353897ad80b4d8fb095ff731d9d1ec26ded6c
MD5 a5f02f79f67873187936065ffe01b4f3
SHA1 3147e67aaa752e8c4be17e970f33aeb7250ad27d
SHA512 47fc44c34bf67557310f262e866e0bc181bdd7b419c0c1bc587c3f2cf81551fe8f9dcb809bea876e8ee22e72a1070017d56aaf4188388965541fc51966667df3
SSDEEP 768:8iOqggIkFxMsqfdZIqDUSwtPSU8FWQq48fsB4ep08puswm70XoPfu5fEeGhJMnmH:85qVgCoF1rHYueGkm+E
MD5 SHA1 SHA512 SSDEEP

Submit Download

DropSqlPersistenceProviderLogic.sql

Path C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql
Size 2KB
SHA256 dc714b27f7d06b502d6c0a3fde5c25f8de910c563f8c53236e875ac5c5da7563
MD5 eb45050384f460b8359de2fc6c20ba15
SHA1 499ba6dbfa2b7a21187b6d05f6f647cdfeb3e230
SHA512 35abd26db6eff92da3c9255cddb249afe50deacc90dd6b4c3c9b5768ac3da6d88cfb2a7adbc8c31bd37a7346c485e53de4e84caae1d8b0a358ef4138a3f132ff
MD5 SHA1 SHA512

Submit Download

SqlPersistenceProviderLogic.sql

Path C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql
Size 13KB
SHA256 cb876db64268be8ab0d4aa924d1fc2b32c0f4304a17a319b717e39145277efbd
MD5 62e40c4abaf9bb39463c526abaffb4a7
SHA1 f85a9e1d35fc457f67588ccb47216dbd8434bfac
SHA512 03160dae2e382ce820a08a181a83c31f020dd31815986308f5aefbd43cfcc740096b004a64714e4128ca208e9089b8f67c25b598926343767d40121524cb6599
SSDEEP 384:cU5wA6PT/UKBw06b1njK8l3yW2+GWyW7ulq5tuYfSq3/M3E9ZSeboCNV+q2nWb4N:cU5wA6PjUKBw06JjR3yW2+GWySulq75o
MD5 SHA1 SHA512 SSDEEP

Submit Download

1 - Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk
Size 1KB
SHA256 e3cc64a26a6f652502fc27b6199b0d2738fc8f701dc5273109b868628eb79f81
MD5 d6e06d66809475cee634ce41e1892633
SHA1 6970a603908f68672b4daadcc1247760da3afba0
SHA512 f3791a0c519fbfeee998cf311291609623d8e38399fc1f51a9c3d29b885dde8802d8d6e1c06da19d6de22d5e611cafcc1a691867156dc65a5ea90bfb010b6252
MD5 SHA1 SHA512

Submit Download

1 - Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk
Size 1KB
SHA256 eddea8e5e721cbdb806caf8ea02ebf9fb018cbd0d284048e778b81804006bca0
MD5 fd08a85824d1eed0fa8b5d344c159968
SHA1 6b9dcd4f4d7c1090342cb880e4aa73b2f52ec2a7
SHA512 51d641ef51a33c9eb7ac942b6dc730767e6595a2de926cb57d2c4695382066f85ef16f7e43f7c8aafd41819449708129c93d375ade61aedb92415d8a429358c3
MD5 SHA1 SHA512

Submit Download

2 - Search.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk
Size 1KB
SHA256 0eab908d326599bbbb7f42426a92caaa073f831d5303e93a1ab3fba4f34edc3e
MD5 829646cc5ed9f5fb435ab2e61bcfa8fb
SHA1 6bdfa79c609a3912767ddc8c4d0d562197e87736
SHA512 76630a4bb4ae3609e88b097cb434190b19254f926c9ae95d011e3d7431b2fd33a2435c361dfa91be716fbd757e73405aaf066117de9c5f6254d78a37128f6603
MD5 SHA1 SHA512

Submit Download

3 - Windows Explorer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Size 1KB
SHA256 0fdb7b9154f70d87efff2de2288a5b2d017fcd286c0f79d2efc64be9f041e9f2
MD5 41c8e1c9777930575baad062aba21c91
SHA1 f3f0838c21f9b59ab0c0f3e87dad6e97bf91ceb2
SHA512 fe99316983426af18de7acd1e1d505ce61279bc9641e4c9abde485aeab8e3ad40b113ecb5ab35377cc109577e2615ce06ec5a2b869719fb8364a49900527830a
MD5 SHA1 SHA512

Submit Download

4 - Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Size 1KB
SHA256 5e42dccae04c05054719d1d23e5f9303f2b266f80ac6ec43b7c6f35a9af25c9a
MD5 79771edb2dc0bc4f8c896f60d0cc8ac2
SHA1 b614162e5da0a8f57f290b35922d7f280b8affd2
SHA512 9539feb5df345c4392c8097d246bcc41eb262d2603589599bdf0b1ad673b06a4e95f3ee1c26cf3e2bec674be3286256a045132d3b88151f788f43acf7d608640
MD5 SHA1 SHA512

Submit Download

5 - Task Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Size 1021B
SHA256 64890381d9715c0a3402b90d16dd39af46480c3dae7b95f8f05223f831cdd68f
MD5 5596b5b1fec692b8538c3bb9f5bf8494
SHA1 31598b64960f53cd9ede5e9084c74c8a1b612af2
SHA512 fd9991aff8257d3264f1177b480e542f796fc77b69488571fb49b52e54b0fb351279c5aaf9b730baeaf3bb0a7940a16fdbc2ed0d646ccff8b04cf175a76fcf90
MD5 SHA1 SHA512

Submit Download

01 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Size 1015B
SHA256 16c27c4075d40de3b901ee22a14277ab989b99fa96cb95def3c0d987d9928c05
MD5 dad3bb97df4f2b9c6f8e06373c019409
SHA1 7fbc7add69836b24da4609e49b96c075aae12727
SHA512 e99ebe43502b37f01a482912ad8b771c6b64cfa05053c958f874e21257649133eacc0f9a6f87bce0ace39c1aeaa8256a0b6245a91f81b36f5eb707e9a37dfd08
MD5 SHA1 SHA512

Submit Download

01a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Size 1KB
SHA256 85aef602fea806ac6657e055965e35891ad689dfc6928b70f3842b5328189ab9
MD5 0b2510a28014da8d8fc20b58b93cf2fe
SHA1 e4b13459bc793449575fc77c543a5df25299d3fb
SHA512 d4a8f639c778f0ea3824a603746f29aec0bfb4adad03a2b1de3cfbf899adbd6c8da58710e1dfdfe028341f990c8ed8acc0451f225caafe7ca31d0fff90558430
MD5 SHA1 SHA512

Submit Download

02 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Size 1KB
SHA256 638bf739837c4b23fa3cbf0d35f16c82de785ab849530f01a4a0e951358a3946
MD5 bc44972a98c986ff1e1edbc60821567f
SHA1 f810f632ea08127ebfad81d5f8b9ddec3a5f24ce
SHA512 a3178640255cb650118971567a114696a695ff9dc1f01127eead060db4333326cd32ad764901a5e3cec6a6169e2e9c0ce1b82d89805287fc0ea3e4fd7508dd3f
MD5 SHA1 SHA512

Submit Download

02a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Size 1KB
SHA256 cf00c7709aa94cd90ffd2fd777df91a94c724787e0c865aa14d4ce7a6175529b
MD5 1dde611707c0eddb12b8a7dd8165994f
SHA1 c9980d500d02567f6bc2fe26e951a0bfc4be1e20
SHA512 fe329b8b9e716eddf30c7a1bc35e6e390c974482092d58bd84d0422f09c48fedf0686c75d4e0c2c7b6492046beb18ff34e2ce7b88dea68a09621de05f43ff020
MD5 SHA1 SHA512

Submit Download

03 - Computer Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Size 1015B
SHA256 e8d2973e04227648e081c5ac547e0b8c1ae87eaf941fffcc63895a45d6512999
MD5 058e69c3bf0ee4ad362c99b647b50681
SHA1 270c4be62ee0485143e17140a89b5c1d7783976f
SHA512 4afba80e4765391a1b1a8d7e07c5f170d12ad31939132ea2aff1042167ca6781e934eecae8f7b5d20fb500be054de40e36d9d12c5e7a87a3fece977ac635bc48
MD5 SHA1 SHA512

Submit Download

04 - Disk Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Size 1015B
SHA256 447513fc2008b28b4a8fd6cd79a154bd35de1dcd6b15f0938673b21b96b6b669
MD5 20b4a58517f84e35b70ecbbd4b8adb93
SHA1 cb8dca157e5f2c02dc0b9b531cdf4b123989b3c0
SHA512 f1b3d6ea6c64c78ada90a60f40ca4ef15abb0f983522264028e830a344224eeb7e8788e8c6b4d7e5f8d84367b9d39259ed2178dfe3f2f4e7093cd5463cb65f1d
MD5 SHA1 SHA512

Submit Download

04-1 - NetworkStatus.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Size 1KB
SHA256 7ee8888dbd561f230f0b775282cb494443617e45b2b1a2ed49724f6c748301e6
MD5 0cd0169498d337a24e364c1cea0d27be
SHA1 89009b12d652a7ff29e780c4e7d0ad46228cc87f
SHA512 92328e075fd49cc44bcd89705a0d638b400ecaa7e24302ba8be0b5e3dfc362a7848c1b4ef8c4c720bdcda3ec127d05b8256bd4eaaa109f308564430eeb49b07d
MD5 SHA1 SHA512

Submit Download

05 - Device Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Size 1KB
SHA256 789dfb113e9cc459641f3cf2cd78e3a14a9e1188eb3fdf10fddf987a59ea93c1
MD5 715df31b9f1f5c1863a7b8fd061247e4
SHA1 cd771185afc0d3c61b1250cf56989e5dfa9644ad
SHA512 ff5079613e978f01a84aa094a3bde6019b99fe2be835bba211579452c289a357968326c6d1c8e4cb1f62d0bbe186eb295211259753517d529852b91d3c3be7cc
MD5 SHA1 SHA512

Submit Download

06 - SystemAbout.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Size 1KB
SHA256 bc222f98183e22932455baf722cfc9a795286efa613ddaa86d9dc75374ba45cc
MD5 7a8ef053a0ec1eb7b54fbd699844d20d
SHA1 867e720ee1a4716a308f91661cf4dbbb89157d4b
SHA512 779da29e90118a02832d853f2dbccba98fbeb5942e89625f8b4f63cabd1701f6f8e5889a344ce991aca280837940119b2905374ff04686575fba3f01bf4652b7
MD5 SHA1 SHA512

Submit Download

07 - Event Viewer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Size 1015B
SHA256 d10d7556419d8a39f7cec8a71b6ddf48019870991a407d695143fd255d942c84
MD5 bc5c8c276c6baae49f324dce9195e858
SHA1 ca4b3d05d030fea91e2c847c21f9627beae8240c
SHA512 adefc1cb67c733d73b2552f0fcac318f5c691d1f544baeb5c38c00847258862e6eba06fe4e743a85b93089947be6e1a6237a962785c23e79f365b25b2fc130a2
MD5 SHA1 SHA512

Submit Download

08 - PowerAndSleep.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Size 1KB
SHA256 19eb169621078a4101b2de7cb7a9594b98e232d7487d139066b3b18b242fb794
MD5 8864996c7dea4f6ed1d315096524894d
SHA1 4f32b03284b3ecba0e3a9f0ec75743434d22a4c1
SHA512 40db22baa513f6648dfb31b17504b4a8b9f6e8a7d3e491a1356617e274706a4ec5215fe19ebc27691c15ca4063866373f966493e5fc0c7f493310e38967b8763
MD5 SHA1 SHA512

Submit Download

09 - Mobility Center.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Size 1015B
SHA256 8eb37062982232a35c385b8f089f6eaa436e545cbf2a0adb7d0a8494699617ef
MD5 e8b7424d2d16f647441570c03bd78a1d
SHA1 4d9fd7065959b081a98d722636beafcd0db11149
SHA512 6c6a5ff151c971b7c93095e75cae8d01b951c615ba482f228952aad0c778892dcb292edf2dec9f10826e8e30ad2efa392c59bdd8ee84dc8a70fe873c0f004a68
MD5 SHA1 SHA512

Submit Download

10 - AppsAndFeatures.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Size 1KB
SHA256 dda1d351dc32fd669d4b66b930be83c8a04a306c23b161d2d608b2d57308fd97
MD5 f5c64fab3fb65f7050b3b19090334a34
SHA1 3ec9c4fefbb181ed756469116754e3ff7a0714a6
SHA512 12dccebdb727fe9c669004f80a54f4ee7fbf1c031d8e4a92c68573b4c7cb7eb20a66657e50651b64926137fe049fa458fe1647ce41aa4e3fdb766b533635763e
MD5 SHA1 SHA512

Submit Download

Shows Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Size 352B
SHA256 aaca1d5ff43f0b9c7b3bc8ce1f89c46792d36c490fd5280a35f6dff5de7fd04c
MD5 75d943e19ff42cf784fd3e6c798ff355
SHA1 4c9179362358f17baa25733e1d4df0609f78c64d
SHA512 fb8beba6f6feefc862893bdc04d8cc882e07444e8c52d975669903963a91aadb8350741571d2101a1c4c98463b1e609fb3772870e69c3892ac868e6fe94f2695
MD5 SHA1 SHA512

Submit Download

Window Switcher.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Size 334B
SHA256 c198a4bbd00abc6b092c1613221789f4b2b2a0269142de964a534345fb2a765a
MD5 d8e89bebc73798ca21437245b4557e1a
SHA1 4fc955bfe18791f805db63618022f31ce3ab3f8f
SHA512 b96872ba8442706a176ff3b92c506fb737b2c997e3f4b8eb89d0ce611b1a659d94969f8659c44cfd7394ded4efb4308803fcfe7e0afd0d936b01f9fcd1f738a1
MD5 SHA1 SHA512

Submit Download

Magnify.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Size 1KB
SHA256 d3bf719216b11c65523dd39c4cbd052dc65b8790252b7fec575ba29991375c48
MD5 f3a251639c88fff4eda16837d1c8affa
SHA1 02c136ce497996468e55f76d791ae2c09b03025c
SHA512 cedbfbec2cd74f658da70196644ac9870e658c95c59d7767a07e7ed8890a1db1d19e1fea1f8e680b1fede4e31c0739aad030ccb9f347eca04afc5b679ec98498
MD5 SHA1 SHA512

Submit Download

Narrator.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Size 1KB
SHA256 e13be769c08cb095baa87f6be39507f5eb390d8e65a0be448f80c5a44b1b4d23
MD5 bf9b0d6f56e7157b95737df0cc747641
SHA1 8d70d7f2dd2b3a0f9df6e6b34024644dafa27e6c
SHA512 3dbad4606c8cb08167112448196422aacabb1ad16b6b2d78e23e181f4d9bfbeaec138accabb7e1a4beae4b6a530509da7787218dc13b62b8df0506a5ec7e7990
MD5 SHA1 SHA512

Submit Download

On-Screen Keyboard.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Size 1KB
SHA256 8c7c88e9b6de6c7b531fca54e31cbc7a92b8b38c99a004107cf4fc779c855cc3
MD5 98b258731acff1683768500b6b129fc3
SHA1 a6b131944775f77af52d4035146712ef92313657
SHA512 edc8e89f545318592503bf7d9a1b8a15acc17a76350087d3bfd86ecb2abc44496acfd2be8d5ad81159542109d3fd3adf24a74ddb9f597aa21068dafe72f5460d
MD5 SHA1 SHA512

Submit Download

Administrative Tools.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Size 1KB
SHA256 49e7726d51bd91d3811e2cb81d4d94e0014ddd92c55dcdfb2194be97fb4c9a8d
MD5 eb2410563c93d73926facfa066bfdb6f
SHA1 1d5abf362f0c267b760e1114af5fe81a2c7d5390
SHA512 8fc775551aa331520a97634d997c1075194c960df2f4d23c9f5f91ab95de1ec14d7f949486fd06952943057d8cad9857d331674bb39933271fe2ee9e362226a6
MD5 SHA1 SHA512

Submit Download

Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Size 1KB
SHA256 061a6fdefd7ecbc1e88b94ab2969da4de9ad2af0b378404b7baccb589d6046d5
MD5 cf1e737b92a6a16395f5f3cd595e9265
SHA1 0ed1c3dcb82ee30f0851e191cf6bb95c717ef5ed
SHA512 6780cfabd6e996adaf5c5143013333136e4dc3b77391ee496968e9e7bce650372d4183bed0b949984bb4a0fda062e623446991ba4e5b1369fe7e71e2d343d2b1
MD5 SHA1 SHA512

Submit Download

Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Size 405B
SHA256 32bd5abf8d86052ca9ca4277853bc1c3018f467486e00cab33931c1850d637c3
MD5 1f9bcf5f9e2290bdfc1b8f6c5d4af708
SHA1 ff0f9708df4880a7b09c93322e904693bcea8ee1
SHA512 d192a4ede90a1968d635f001027f1746ae96b1e42c01a2352d6988463817b5f72c77faa4228451bf91afc40b8ac84f53aa8b74aed3c6c1957f7b91f96bebab7e
MD5 SHA1 SHA512

Submit Download

Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Size 409B
SHA256 b54060697eedf1ea753b5e45c81e502306f8bc229d4df9e3a38408238ff95f34
MD5 d69bbc30b07e82e958acb87130435acb
SHA1 53ba05ab6f6b6f542a5bc279ce97aa9c588359df
SHA512 448af740ffecf7bb8ce01b593121c15957bf42c14c89ea7fa796ddb50980a63a5ef11dc8f4b6398de26eb71876c5d9b6fed890d9a38c81dceeff17bad71dfcc9
MD5 SHA1 SHA512

Submit Download

computer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Size 335B
SHA256 3244ac2af6854c52ba9e2e0b5581604511e8463620996644251ee99fd46e9fb5
MD5 cb75d7234d2f1b14de2940f793bcc74a
SHA1 a202e191914279a49d43802f36cfa6d305ed24f3
SHA512 0b23d80318508fc95c8c9bee359facbccff34686740db0170af3857bcb5c8cdc3a2c91ca9556e9da0451c9cc59342245191426c9558a5f3d767651bb0e7c4fa3
MD5 SHA1 SHA512

Submit Download

Windows PowerShell (x86).lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Size 2KB
SHA256 d5164bb218498a5b30ca943e87c8cc9a83e2bcefdd0f33f52921db0e5f99ec38
MD5 3ff73947c07524164c633283db31ef48
SHA1 f8d20e99b6c80e1558ba5162388bb5bc807aeecb
SHA512 ec70c50a35d21f4a68259601b656a96c455d5e03867ad8543201b4c96c46b58ff25dc2e9226e23cdc90bf0be012d0f0de73391b2216a1e62768a0f109e84c336
MD5 SHA1 SHA512

Submit Download

Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Size 2KB
SHA256 b5bcbfed4680634090aeac9cf1fc70d1e72846bf0242ca1ed6fe88054dd703a7
MD5 f306f65014d12dedab5a5340ec60f94a
SHA1 121b24504f42b73910b3c1d0b4203c759f29acae
SHA512 03fcb95cc1c8c3d69b26c5f484f2818f051bae8ad1c225b648483ba68b3c06107e30ba53a3c6c34c9764c71e665ec763bc858e4b5b4741aedc92c99244ec313d
MD5 SHA1 SHA512

Submit Download

Quick Assist.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1_none_b3f1d9ff0e206c99\Quick Assist.lnk
Size 1KB
SHA256 94e0fef9aecbbe627f8562b6164ac12829bf148f4e23510a752f5a3d53ea6b32
MD5 dcc575d29b412041be273c9ee0729806
SHA1 85702620489231ed1c1829a9899c3efb72686321
SHA512 1677bbdf395f0df40c5f45ba1f1d67345b580595f6e824b048d56bc8c40484a09aac336d6560e635d2ec4a18b9909f03c9e6b99047ae4637578a18093f8e51fe
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 d1c596c3b316166be6e11f1a7836d02375d0475041d12e65c1d5d4b4de1e5926
MD5 fa551e41c42b920a61d7d239dfdc3414
SHA1 74f9b0ace251a8ef8d827c6cf8be1464f0cd1208
SHA512 ecee257bfc67eb82b358d15edef8b19ef31f72f0a269f0a307e0012cf668baf3a95a6d768c8b6241f5dae659c0cb0222460129bfa2bf3ede445ef2f423afbb28
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 e1598c9a5c04f83f4eab075e14de275004aad79d7d391ae48e25fb22ab36fdbc
MD5 437353c9dbc738c7e67f3755169997e4
SHA1 048507376ef8a856f604c1852861b5ff8b161804
SHA512 9d97a19e9f3a0bd43e6b9dba2eaae89e31c64d0221019fc28398ec4626323ab18b34571b32e060102c4af388f2fc7a53be9babdb8422886f8b401ae1a717bd61
MD5 SHA1 SHA512

Submit Download

squaretile-sdk.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\squaretile-sdk.png
Size 501B
SHA256 4b288c879a0b7a1ca6a9d5a1680a94a926c66362162282739320b832311edf06
MD5 6198b7ba00be74c6985d3839cf0b433f
SHA1 42b3fb77bb7b93d12464718847086358c1b7c495
SHA512 d8e92cfaebd29526430dd31fcca7a650eabea324f805e960f99ca67384d53023eaf69d6487677c68ceffbbcc538f3aac4b3b734e90c3dd93f8f2700faaf5a786
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 e45f697a81e1cbd46046a50597ba9af08e1d8311647d62a17402cc418b0f63e8
MD5 55c082e5c753a3be7704ddf066d0e895
SHA1 ced13c44a19f82b143b033378d601f93b1de3388
SHA512 8a7dff042cf53601adb5212f9bc6a21e48de61faf38096def0a733188e22b57d0141a7b2885ab426f76c40c73ed92fb0ef80abf0e469c83a7c14166a6830a0eb
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 403a36ada7f7579d09670f9b98e7dafec1c2e1beecc5fd26ee6b5fd0b4f2505c
MD5 c4be1ce9dc39fb83fd5a2d617c2a4837
SHA1 eca34cd429eaf350804bce704d19ea61c74fd54a
SHA512 3e736e36954c970143a82baa806fa88a36db812d09c08a6ab4d19a78e6d0fd2c42c6b8e59b62f7f4c3fc7806f5b1d9f30e934b404de6465e9280300b034fd64e
MD5 SHA1 SHA512

Submit Download

squaretile-sdk.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\squaretile-sdk.png
Size 501B
SHA256 a836ae986ad1fdf66b57b8f55eac652b146a474835c2c0ee3a6afc945bd60bed
MD5 cc732d0bd874a5559714f32366affe1a
SHA1 b1b7b5585059d53f44d8e0dbfc260472ab658c71
SHA512 3d9324b6ff7f7db2248f609f2364c515e39985e7db154df70926194ea141cc67a8283b8ec91b0c0f71b97476755cd272ab6af1d5b44c37f1b5821c91d18d4890
MD5 SHA1 SHA512

Submit Download

Remote Desktop Connection.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1_none_03cd5b18c0751679\Remote Desktop Connection.lnk
Size 1KB
SHA256 9c714f974b8083e63cbb6beb40b3c14d6eb69bd365420a3b5b2f82eebbb5ce4b
MD5 27eccac46911147bf1e8bc7a730f67b3
SHA1 4dc7f515188ad12af8e221121c3dcc901d731706
SHA512 4c2144a2529208a4b3a0b82c92f8d16aeb7824c7b682dbda190e6af0a10c4c890277070a1977d5cc7cee473d1efa5555e6b3da5c22e7f2614a460b641a608202
MD5 SHA1 SHA512

Submit Download

OneDrive.lnk

Path C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Size 1KB
SHA256 f018e2f7bced508ccd64f579d22930007828ade5fde08c442c9d0c14b1ba6b7a
MD5 6118450a0158591446f0b517880a858c
SHA1 5f2212cffb59d2d3b79210e6834904606eb65054
SHA512 78d4dd56c67cff814b1476fbb99ce9844ef0287ed778fae297b637c4073220c10636180e938d6fbb203831fefe360b8913ee25c9f193e12fa307106ade731e72
MD5 SHA1 SHA512

Submit Download

vcredist2010_x86.log.html

Path C:\vcredist2010_x86.log.html
Size 81KB
SHA256 f12330e5ac2aaa00dc853490c2b4cdfbe0886f94f35c6d4fed8611ece159fe40
MD5 49faaecc3a6e5da87c45cb87d720e128
SHA1 84a6702ce9168091a2f2f4ec14db163ff114c6ce
SHA512 1d438b124f385dd31a37939970cb5a33edb4415dff113843f2b24bc2305de8607d446023c5b8e37ff14cec7fc731e169e5e53c406810432ec6de5f7986a1a866
SSDEEP 1536:ObikR72N5Fre5343iy7GKaVm64RvaDB1iiR09Z:ObB9ELZitmLRvC8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads