15783432882849722953fc7630cdcfc4259d1caf76ec59f2c1489e7c20b3c0f5

Analysis

max time kernel
141s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
Size

12KB
MD5

576e1420a3799486b3a3d9303a81fc27
SHA1

7f55e29abea48dfef713a9d82dfe17d01dd4493f
SHA256

15783432882849722953fc7630cdcfc4259d1caf76ec59f2c1489e7c20b3c0f5
SHA512

6c7874e843e276c9f61812c1c7c41f3f15355ca84bffb1f3d542bd7bf2572bcdaf38d48347c163103aae6308bf7753432603b5aa427405236ec0b1d350edd8b0
SSDEEP

192:m/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMlSjt+:mebFNw4Pk1itKkpAjjI2YpdmlJ

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2602) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55KxBjoUfA16ngr.exe"	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\vhdmp.inf_amd64_aa94d04ecf56de1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcardfilter.inf_amd64_3573afe136371e51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iai2c.inf_amd64_a77c815b2999404d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\perceptionsimulationsixdofmodels.inf_amd64_acff50a7960b7d19\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\setup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acxhdaudiop.inf_amd64_78faaf2062860ce8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smrdisk.inf_amd64_bbef253cecafbb1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_system.inf_amd64_184528953a6fb673\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic_shutdown.inf_amd64_bce6891915e70bbf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DeliveryOptimization\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_sensor.inf_amd64_b8789b63cc1d26b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_sslaccel.inf_amd64_ed6849ad81a24c48\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmfj2.inf_amd64_167948d0c94abc27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic_guestinterface.inf_amd64_192114845ec44b66\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbprint.inf_amd64_86cdf3e1f512cca1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsencryption.inf_amd64_b4b4845819a23338\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sk-SK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@AppHelpToast.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\he-IL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_keyboard.inf_amd64_56ea9763e933f7c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ntprint4.inf_amd64_0958c7cad3cd6075\Amd64\V3HostingFilter-pipelineconfig.xml	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wave.inf_amd64_8e8496aa33c0a7f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsuprv.inf_amd64_696bb57f8e3bab65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNote-pipelineconfig.xml	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tsgenericusbdriver.inf_amd64_bcfa5f586783921d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Licenses\neutral\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\AppxProvisioning.xml	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_legacydriver.inf_amd64_c07aa9c633b5271e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ks.inf_amd64_9fac168e1cbea90c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Examples\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmhaeu.inf_amd64_e0c209c891e162a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smrvolume.inf_amd64_1d430c5b72323a1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8de1181bfd1f1628\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\termmou.inf_amd64_c4c8f901e3534194\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sv-SE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Host\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\6.jpg	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-60_altform-lightunplated.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\ThirdPartyNotices\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarMediumTile.scale-125.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-64.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL065.XML	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-100_contrast-white.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-100_contrast-black.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-72_altform-unplated.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteMedTile.scale-125.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-400.HCWhite.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-100.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-125_contrast-white.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\3.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MicrosoftLogo.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Logo.scale-200_contrast-black.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-200.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-125_contrast-black.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-150.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsWideTile.contrast-white_scale-125.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-125.jpg	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\8041_40x40x32.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-200.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraLargeTile.contrast-white_scale-100.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarMediumTile.scale-125.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-black_scale-100.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxManifest.xml	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\video_offline_demo_page2.jpg	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\WideTile.scale-125.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-125_contrast-black.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxAccountsLargeTile.scale-100.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons_2x.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-60_altform-unplated.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.scale-125.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\WideTile.scale-125.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-24_altform-lightunplated.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-60_contrast-black.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-200.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.19041.173_none_af877ec0b0472fde\keypadbase.xml	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_bg-bg_dd016b0b9ea8d750\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_sysglobl.resources_b03f5f7f11d50a3a_4.0.15805.0_fr-fr_ec0ab30e87661d0a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-bits-client-proxy_31bf3856ad364e35_10.0.19041.1_none_270f544d8a73e4bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.19041.1_es-es_8145b05544cb69cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_wstorvsp.inf_31bf3856ad364e35_10.0.19041.985_none_9ec3d9e91b3d1b4c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-c..ehost-api.resources_31bf3856ad364e35_10.0.19041.1_de-de_271a01bfcdf68e87\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\CellularToast.scale-150_contrast-black.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_faeb9d41761776a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.windows.s...commands.resources_31bf3856ad364e35_10.0.19041.1_de-de_db7ee98be4032274\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-onecore-c..ilityaccess-manager_31bf3856ad364e35_10.0.19041.746_none_e990cd28d4ab1a98\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-composabl..ropcommon-component_31bf3856ad364e35_10.0.19041.746_none_ff8ce67e324d12be\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-theme.resources_31bf3856ad364e35_10.0.19041.1_en-us_87edf218e14c1622\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-iis-bpa.resources_31bf3856ad364e35_10.0.19041.1_en-us_4e12068e40413ded\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..ovider-cimwin32-dll_31bf3856ad364e35_10.0.19041.1081_none_4488d70abb2e9c55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.19041.746_none_a7b9026d89f6bd59\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_wcf-system.identitymodel.selectors_b03f5f7f11d50a3a_10.0.19041.1_none_2459ed2ac211ecde\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Assets\SplashScreen.scale-100.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_c_netdriver.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_7bb0d3822d84626d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..ileserver.resources_31bf3856ad364e35_10.0.19041.1_es-es_5783d7d9a273b057\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wlanpref.resources_31bf3856ad364e35_10.0.19041.1_es-es_aa88584c86f4bb6e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..airingexperiencemem_31bf3856ad364e35_10.0.19041.746_none_0980040c81135574\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-msc_31bf3856ad364e35_10.0.19041.1_none_e5e2af57be7da553\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..grams-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3e122afc5e1accb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-credprovhost-library_31bf3856ad364e35_10.0.19041.746_none_9176e7768cf05100\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-webdavredir-webclient_31bf3856ad364e35_10.0.19041.1266_none_d44047949d43bba5\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-c..s-manager.resources_31bf3856ad364e35_10.0.19041.1_en-us_d71078bcc64e33c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\pdferrorrepurchasecontent.html	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-white\AppListIcon.targetsize-24_altform-unplated.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.173_none_2dc175215ae8ec39\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-devices-haptics_31bf3856ad364e35_10.0.19041.746_none_22cd63b7691618a5\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_tsusbhubfilter.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_75318fa995287079\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\WpcBlockFrame.htm	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-n..framework.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b9badb8731e3dd15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..cationcompatibility_31bf3856ad364e35_10.0.19041.746_none_567822cb71b23197\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..orking-connectivity_31bf3856ad364e35_10.0.19041.746_none_107481d48533d9d9\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..2provider.resources_31bf3856ad364e35_10.0.19041.1_it-it_dd59f10b77106ab8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.servicemodel.washosting_b77a5c561934e089_10.0.19200.110_none_dc55e96051643a72\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-telephony-voiprt_31bf3856ad364e35_10.0.19041.264_none_2bb47dca91adaf58\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..cconf-exe.resources_31bf3856ad364e35_10.0.19041.1_it-it_abdfa14e21a9ec0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..andgroups.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_02b5417e30a372f0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..p-support.resources_31bf3856ad364e35_11.0.19041.1_es-es_88bf10935c18726c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.1_none_21244f0b33e2b22d\Pinch.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft.packagemanagement.common_31bf3856ad364e35_10.0.19041.1_none_cf035f195a2a1927\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\AppxBlockMap.xml	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_c_fscfsmetadataserver.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d391e3229a40d133\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.management.resources_b03f5f7f11d50a3a_4.0.15805.0_it-it_e6a88fa70866b773\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_xinputhid.inf.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_9268221068da4eba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..ileserver.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_81c1aa0cd067ecf1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-x..ectdialog.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_fe2a3fc32038c1d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cosa-desktop-client_31bf3856ad364e35_10.0.19041.1266_none_51e937c8b7fb1678\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-charmap.resources_31bf3856ad364e35_10.0.19041.1_es-es_9cfb5ed19751d38d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-portableworkspaces-sso_31bf3856ad364e35_10.0.19041.746_none_f65848af5d6acbb4\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-100.png	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_hidbthle.inf_31bf3856ad364e35_10.0.19041.746_none_093bf0d9d1b20fcd\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sysinfo.resources_31bf3856ad364e35_10.0.19041.1_it-it_a6f332098b7620a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ETUFMQVMTXXLOPY\ = "CRYPTED!"	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ETUFMQVMTXXLOPY\shell\open\command	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ETUFMQVMTXXLOPY\shell	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ETUFMQVMTXXLOPY\shell\open	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.PoNk	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.PoNk\ = "ETUFMQVMTXXLOPY"	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ETUFMQVMTXXLOPY	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ETUFMQVMTXXLOPY\DefaultIcon	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ETUFMQVMTXXLOPY\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55KxBjoUfA16ngr.exe,0"	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ETUFMQVMTXXLOPY\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55KxBjoUfA16ngr.exe"	576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\576e1420a3799486b3a3d9303a81fc27_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
fd443c71548f25c13c9b59f90c419733

SHA1
e2ceecff574f187bc3d6293ae3d971366ea518a3

SHA256
f72829c4bed8034d3a1e036e388876f6bedc58d44d52f44a9853c4c230a41fe9

SHA512
9fa0bbf3f2f21a16e27c1bde3c613addaad027fd566ea5f488b96276ce5c5a2aa17e9d37327df4f3c5ba6f5d6bf47e91bd2f748253c72990650f3b4f7b65b179

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
e6c8458650d148fb1c9beea79f63a53c

SHA1
55d3f264cbeed793451f7a11c5837b1a95ade30c

SHA256
51fba7e0dbacaf546a79e762a1f941e253342d6fa207c7d44a2f113a1d5bedfd

SHA512
8980e438b7478727a7e647dbc38d91d94c309a446351d731c545b4ccb733b0b5a50cab6a5d7fbeb025759ae9cab1dacadaa31432a6f17370390988526b57078c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
849628d78c6a5e29ce5a6ce6e822d617

SHA1
4b1579e96f88211c7ca9b9ea16f99b7f19a8c78b

SHA256
4bebab8a6720a681dbcb1712549bdcfdd92a9cac7ca8192ace8a688090fe3734

SHA512
703a6ecb253dbbed1a0f88edf865a597702e656c401b8d35089b2fdfd07630da1c7095902218d1559b5cea7d0fc16bca46ab323d1c3fd6c4579e2e0c6341f45b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
8d392a731f659a035f4a63d6cfdba26b

SHA1
87c85d8cae17e2f3d5a92d0fc9fbdcff7e4f855c

SHA256
f8f815ca8edd87b7529dbdf4c3e65324c96aad810d89f2a37366db07ed61ff69

SHA512
1e20fd4636aaf7e90af17e49bef10fcc0d88f11438c07b61c8b1408a91b9b0010bedcb97fe80260ac66bd5d4d3509f2ce901d4d994783b6117aafc4a67a94325

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
155f52bef443d9fe0f1794a321fd35a9

SHA1
5b6fe5485336f1a6111edaa1d97088e51b46a357

SHA256
4adb49e08be1ce99461beb9e59f4adb35a81c51e12cbf908336bc20dcfc31575

SHA512
b95a7bc8216f7d8bc0ad5ab6a4283bc2d0bd2545d038203eff463c52ed6065e6bc66ac703e2a5c947caae2db09fa2f2d9c97b960b657758fc3ff278e600bc06e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
b62aa175a2c349dd5f291630b40b5dd8

SHA1
629bd316fcbb60a7b9ed1914a3f3365e5ffb5047

SHA256
534cb329741692dc71f8a27ddbbffbd1e2a86cc3bed21d691e02db650f32af49

SHA512
46d7a57f233aa1e5cb0ab2b08b8f03bf327039620cc8f2533e7c5486eeaa30de03a80d41285ba89c88388bce727f9ecf3b6f38079b58b86c66a95eaeeff0a722

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
0a581400a24f6914edb502365f5b9246

SHA1
555671eede1c712c9417f9bbaa72acf2be306ad3

SHA256
b8c465b421fbcf750e8f82a5c72e6edb8d9a1ebde23ce424460c83e26e00ef67

SHA512
95b6553a1ff093522a4ca528769a96d839608910564fc79e51aef44a1fb09913d9de15a1ac95b7782aba0ebc8f087ac997a25d7b42e9d45fdd0006eb219e29ea

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
e60abfe1067e985582b95bfdd9f750c7

SHA1
081ee42b29d6120f39f479b054b3894815636fd0

SHA256
dc3d7c7a47596f0b355eb12997242a22898649667dc6be6baff2aa2cb1a4dc67

SHA512
6919b45bdc1ff58824fa5113f6e7be7432b535d508efce640cd21b885177335c460c2cf9ca979ced9fe1e8fb17112a8dcb6b6fef5effe27f1ba92fd14aae4e20

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
7a97f5598e8125f4a3b0425e0ada4397

SHA1
5df75ac438532f01adf501c500601c5849495fa5

SHA256
fff8ed414cda6c22c49a9a0af68f308cfa9b5f3ae40ffc0e2cc94725cbd65074

SHA512
9bc9d97b0cccaf4df197e3249124eb25df24b08acbf3d186e816d2b43783b22a1d1f57e925eb1db398112432113c14d7a7c6ac9c311ec0952ae4ffee774e4f6a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
01c41e1ac95f93eb2e62286c19bb95b0

SHA1
d983430cbe1c6e8abb9ecfa1a9ae0ca5f42a6b9c

SHA256
6d04e50c91ccce70a8b591c40d6facf11421c7f6bfed07e9215f27d2fa7511a7

SHA512
f96b92d5b637ab49bcb9db4c9c8357d058dd33e36de5d4d223f8f84b400dca52ffbbd704c473e74334e22b98b51b4a77dbb3b350a05d02921ff3eb9b5dafeeb1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
966af216dc958bb8d107d9d13389ed9a

SHA1
042904d85a77e16dfc94f9d9e224c783a41d739a

SHA256
7b5fc7334c33d9e2d30037ff52b67b788cecfbd17aca5dc401a765981216374f

SHA512
42ae74128643feb440ae0357a661e9986b7439fe6f3a6285e3e3b76f8ad938da1f91f9448528bd05483d9738442fb0cd3f21dc930608dbf155f98ec26ad2fa56

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
747bce5456e04d916bb9998e899a23b3

SHA1
380be2c4e732227ae744686a9e947f3c243609c9

SHA256
7e7d9a20e508b6656c9ce266b26cd7c855cd13734a75315161737b3f7ea67c11

SHA512
027b2bd65da7bc334b7a60e3eded60f2abc7732cd522416e31907f7147d9b75356ca67afabafeee02decce09d96a2787aa88d95ccb3652dd841cf77230255f53

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
3c5f99d96066f9b65d7ca1bce504259f

SHA1
49c2e12d2f0b086f3ec527fd08e474302c226331

SHA256
e9abbf96ee9bd5660a43d78f686123ce3da747bdb558f3bf2473611e0dda3e06

SHA512
b633e96672445f04e3052ebffe37bc9379b973dfbd425f6f453da772aeaac4fd36a7a0fc4f3815394e9b323ec93db16b39dd0d7f9618affb483c929c9b9e79c8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
488b909566d8bf0c185bb790e8b0f4bf

SHA1
5380618cdfd527d9b746019a846fff51c7506e29

SHA256
b330a15d39a940a5fe90d6d035e9e18853c977ea2c1bf5e91e27c2e21ca2d06f

SHA512
fb134dabff66db295e09d6ca7db0e1cd8b50ff008baa1df7b165562d5653e6824de73c571f5d5ec18fdea94eba77bcac2890c2232b1a17116992c3cc369d5ca7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
927aec67f7962eacaefe3ed282ed2b93

SHA1
1ed457e5d342a62715b8f075bee8a89555313db3

SHA256
c27732bc42d0eff6ccd853e87264c76cf5c4dbca903babaf4f4381c33f6f07fc

SHA512
be4e06c7425f4ca851bffdc961e5a6ee9b27af49ab3e2e0037b68c56ddbf80d9c1d4c3f512214bbfaee284c0569f2c7fc6e06a11dcf83ea67a6d8cc143980473

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
b712a41add7fe1e2834b68eebed869c2

SHA1
098a5e962d01d1ded249963eb4fef0dd726a76d4

SHA256
7de9567bd8674716485133663475c3db1f33a7930112dbdcd41fde1f0dee375d

SHA512
af6e3a06e9d401ae1000ffbc4f5becc07f77dfb49e8984147e9dff5ad050acab53359a6ff1c7cc9f7a5bbe94db88560e679435d626b93bad0776cf0a54458add

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
cf2606699e60e6dba4a1694979978139

SHA1
1d38982f4ff7ec79bd29ead504e1016d7c96a530

SHA256
c7ab3f22ba128f6564b083fb4eb4f447754ec1b4286e4207c652aa82269f92b8

SHA512
e90d4d3b2785c82d4359cc4a7a7c47f0559418186d047de4d2bd6c310665751348962ee118231bfee36035900db45de9a367c25f5b78d08be0f4f7aed644bbb1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
c778e834f47419990304e7600b0183db

SHA1
d56b030b845af4a3eb73ecdbc6c0b0104bddb09e

SHA256
c96cc57bbc05f37e277bd46af347161c1c8824850eb6f4b23b832acd8be5af1b

SHA512
1e39a0d4cb28d2219f65e79a05dcb3df22e29251be389f9f41bd3bb95da2057ad6862a7de5476cc26aa4754476d22e8c1a7b58511276ba3e836aa98296c98577

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
8447f0ecbfc38efe2412e92336a604cc

SHA1
7e4639dbf0645a9f2551a98d4fdc46c1afd8aedc

SHA256
ff588430ea2297fb754d117731d764002d8839ef87dcbac3f73f2556a93e4edd

SHA512
7943c24612862fc8b72c8f87cad26934f5739aa7b8f5572492a705037ab75a7756c22964373dd982451b567f26a581347647282ac8ad1ab749e2cd13023b266c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
3ed37b8d6ef808206a68e79621bbd7a3

SHA1
feb20670f85ef7a17f191193bb1a04c3f61250ee

SHA256
c2c89718f895b246bf0475d482c781f5d1b6ef916eb69159855480679e7b370f

SHA512
1afd6ccfbf0ccedf2e8cfb4f244930d4f31cd55cc3691b2e830caeb07cfdd583b3023d2a8153c9b8c3e0ccc1a5e9f7009308b217c4f99a710216fa7fb46fa14d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
373f5f828dd2d4ef21a3d83fb0e29dc8

SHA1
71f78d69aabcd6399c0899dc10898b93d699fd60

SHA256
0fb0b2146da76a441341107838ce78e54dd89a545e62a441a0b273cf075b1611

SHA512
345bd927ecc130f6990411c49b75668ef504b8a9a4df2aefe1c5e0e7e1bd7c6312e0be229048deb173a78ae2f691cd779e057ddbbe1249dc1a480fd9fb737ff8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
1bd69961884b3dd447b31f5fa3e33cee

SHA1
d63d4d54347baa8c11923be7aae0837043c407ee

SHA256
1d6f19ecd01d9cfabe1fbcf62b5931f84607f1796e09c0b3a00b38970c303a87

SHA512
7a87017e7e34c55dd17691f3ed4bb62d8c755e8936890cc1f21c8d36e524a9d63e1ca6b9a2678e5999566c7753d92f0219b76547a521d8f7edc2db63e893969d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
acc8a4ad055222be2ff35881226edb59

SHA1
93cd819bf6853fbb207eec32ec6dd8820083d510

SHA256
2cb0c0fc7e426fc2e3906470e73afb6c6778bd3a7400c28db342cebba105db33

SHA512
1c14e9c2c478835cd6d086ddfc9481ccbe9c05f9f7c387314286fd6298fbfc0d476a7d61bf8250707e4c62d9d03b671412f0037a488430553e208fd425bc1ed5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
d35a34f01f37b7fd3826b19c96aec29a

SHA1
290642d65eeef5aa5af939c2a74c783599f8c109

SHA256
fcfc0c58629385d89842efeaadb1f06f88e969cff5070891f4b28f562f84db0b

SHA512
0bb964056500f0ab416b2e4bd23f44480784f60ab7d2d382a4182c03610b03c293ab68a2cc296ae811c3fae1d101ecce3d84fac3615c7b22422ae1da5784245a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
5e0359373705abcc06a7e014cd7aded4

SHA1
0f906af88fe59521c8e2a2379081c54940367bc5

SHA256
abb4768c4450497e229a003a552470b17711533f2eed1d681959c99f869136cf

SHA512
ea0872842a60a096f99ae409b2246e69873e059439aef78b8cea335157b8e1d2e32e7766727225379f44f66ab8fa723c53ed380b865b4973d2236b945175f24a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
e4042038a964d96a0853724eb55906b0

SHA1
5e040e9a2cfa3e443bec92fbce1bc2066128a72f

SHA256
9a218a6b275254de3f2352ce4489791c3160303cc76110ab22100485b683e004

SHA512
d952b78fc5db7147a1147300a4ca221ec4e0afd0b51e51b50dead3381e8734e40446f2242345356b836fca768540de7e76f389bae2a635af6b398f7e30907166

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
14631f2d7d184510f0e57139ef55cd00

SHA1
be28a34fa44e9ee24880cff504fc31301fc2398a

SHA256
df7c673fdbb8867e33d4a91c5bd855f9d73b1a8b457e993e635b1396caafb2f1

SHA512
c0087136a257b82b819c4f4c97dab7dc11f468d031423669719fe2b8004f97da93fd8ec7cfe5bdd9643a6d671639a8ed8b1128b92e46b807cf2fa0cc32630044

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
3b904d1d1e658460df2547a65aa3f761

SHA1
7ec56d07e8ca6d6170902a3405f39f0b379757cf

SHA256
4b1f8e48a07e85e52e1fd5fee4d1165476d817fedfd1986d88c3de2e235f04cf

SHA512
c24fd70332358fa1d4f12f1fa32d8becb51d46ff1c3b14faa18abd58e64df02253098026dd23a19e617649db9a0e81b755e20a860fc8cb75e22e681031272629

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
87c72372ca7dca2fd9ac548d937f90ad

SHA1
73d48ed4c05c5f8627fa7da242604792846863ad

SHA256
1c4251f127dc0fe6679ba7457fec89511946e42787a6c51a06b28bb8e04987f0

SHA512
96ae900787449d9189c388db403180f9b6ab91f1ed343b89fd5607c1fd64103fc11c24a98c5cfb2017a0d98f995f95d70b3bca47162d84c5d78aa767dad68bc6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
9f5f4321027b828c3ea46a2b3c60f1b2

SHA1
0e25119e99b9cec0c1d9ba17c1af64b4ff9f77cb

SHA256
2931ed6443a06eab7635fa1daa7b1c058c9d64941e9065da8a7ebd19675d8855

SHA512
212274b893fa02f61f1997bd211d0e461e2ccf16d3f9047f5260db12b43d1004b84d7cbdfb102be3d6c980134e11ada15d894c0283809c34c8a108adcde69f03

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
7255174925e756d3be70be625a64d9a8

SHA1
9dfad5c01fafa153b13e98a5aca74d12033f601d

SHA256
ac47f0ce7b8341792b58e202c8c800c2e71fad45d116ec2d4a5cec56e338a9e9

SHA512
5ec36254683e51f1ced906179ecdcc29d98cdc56c64b3c5ce93244e59bad5767d6a34911fadc9976e010c8b8fa627fe76bbc6f22a074d100c37be0623a0f8e03

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
6af7aaf96a63ad884469e862bfd96eac

SHA1
e70444c4791d88f7c4b921374b0070dd37ac75e5

SHA256
55b751db00e26bf9f2324cf393f619ac44165e1e3261e5ab34fc0e4afd6ede48

SHA512
af1d559279da88ed5264dd1d0929932fe591a96bdc0665c5a0799a91548758b6108d423f60071eebbf0b3f3b2406e85ebb9eefbfea04fcb91948eba4eb2202bc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
e3f00deb95f98a16389d25ed4b458fe3

SHA1
bc78937026084ee78b45873bda5cda5c8a119202

SHA256
98fcca8617b81096f1be9441f51aa3348e20dc26f7ba5f69d55fd02aa5fea8e3

SHA512
b9fe42056f79f2e049dba1e78637d106e3a5aaef3434f58c47161b73832cd858e2d228d93de4255fcdb0983ca97a2db759471e6d4af35cbacb764d806170bffa

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
0336fc0dc61fe0b3006ec30c313a4abf

SHA1
78b2bc747e454cc5edc979ef75b2ea1ce0645e6e

SHA256
4e30a08fc4f2a0572a868b6d609491b9f7b66be05129486ddbd8c0144c8e098d

SHA512
f655addddedc915b5493ae2362e3928b31fddd1c8f41b9590df8539db3d9faac431e601812b7c93ba0ca8a52b2816f236835d0ab3b65a40f8f93ddee8da6255a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
3596b7909d0cb3724a6a45680deada0e

SHA1
bc9a66bdad9eb9e1d269722224366f8cc5a2a232

SHA256
79381d79615b5aa23bf12a82981aebefe03cad4e7ff57753710f707840c6dfcb

SHA512
8ca6f4b47c441327658437e70a1fb95f5ad2f1d24ca9dbb1e210206851290105f1918a9a33646e0e4bcfb751444f12b3b6f4cadc954f9555cf26d7b372453579

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
17c4410ea82705bb5e6b264be5551b4f

SHA1
40f454b42272d073ae7d5142de7ef4e8a31f519b

SHA256
c3a9b9f5ac1f82a6a6d71de91d4fceb579d89cf1b8fb721957276d6ae68311c9

SHA512
faa6fde727b5eb28e36251b5ae2c7b1769af4f8c46a5f35499076a8f1cf206c06e908750d85d04eccf342516fd66eb4573020a2a2ad3ec08eda79b973092f0b6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
bc711ac457e2665764413c534bd248b1

SHA1
4aa7c1107711fac01366871b33e93aad0cefe7ed

SHA256
3610333f3cfbf741640039cff42d3ec194712c9d0be362c5f5cc156aec2dfbab

SHA512
391698d204d17264f1bece91edb7fa9a76dc49d7620b8e22a44375a111bc39eaa02d4c60eaecc1c0c65c719059b1c16e85f9a4cecd85cdf7bee67eea5871fe07

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
29f2ea0f62af406b52b2b6a350c5ae2a

SHA1
2ff011f71b4d16da69d27c2eca44feb2506bda6e

SHA256
261bc877b0aba5a7403d51ad0f0f2fda9ae90c5537ff25111864a076b6bb4e6a

SHA512
70b7ac42be7f5c4dbafa4785e050ad8814d98d8092e9db952d548603d96f0a7a3970a4b6bde874339ab45309b5e472fc09e1c248d0b3e84e90a4f881797ef798

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
333B

MD5
53ab1155ee17c965303843fa35bee9d8

SHA1
ffc1185054da9a8f5dc183cc997468293c708a9c

SHA256
a60da67cac3ed9bcd51dbab3db031c4136b47201af04b5f88132cbab5b39bbad

SHA512
2e80ccacd84c0febaeddc1ddea83f551a98e273818b6b24e1eba4a505382de9fea81b0ea245f95942b8c33020b5de99db02e94456afea6cf00d7c0a561cbe7e1

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
240765432c5b9a0e07f21e2ac72d5951

SHA1
caf898574ed49e896c3ad6f97ec20e5359cf71a2

SHA256
b323b5c40bfcb92cf959bedc1aa7f2d9efb633ed81904014bd6c5ac49c8886e4

SHA512
c42e4910fa7ed1071e8348da31725bf4b79ced9ea09616578f0efeea8fbc58bca5c48bd34228def452baf44d7be3ee3f7df622d4873c2dccd1bc81844b58ce6a

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
853295431681c9f18f1fa360cf99ef0d

SHA1
1d5fb2097f227ab44d840dfc9e4b884fb376347c

SHA256
effbc2d14e1da4c1b1884a15c0d96756948382a43f167320c418eba294d71f99

SHA512
83a74b9575adf604edf5afe3bc458e986029a08c63d7a69e18d3c5f6ea1383f77b02a5d6f790b69a96fd3d7a2c2fb840bc458528463b054ecd77bd81fac611bb

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
704c57c07c657414ba8cd26b68b85bd0

SHA1
97eee5e128bd1d282448cafcb44c1b3039a79a25

SHA256
09ed0b4ec06d98d5e57ca9ef66df0586896bd7cf3851e2decb4f53ee1671c301

SHA512
0df539458da870608876a1061fb13a1733894a001b80f10ec4ff4639620347a46e7fe4890402c3f08e4138099e1fbcbf8ef696118d09642f5b424d76a033ba4f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
bcb5eee973c835cfd13fb53b11ead9f2

SHA1
febb6931b7d53a3472599bf6c36805170cddb2c1

SHA256
b2cbb29cc9d7fe007e0772d652e90f781a350a68f3a47d2dbb1d9157f63ccc94

SHA512
db8e4672efc4d1b31d515a28fa9a0b52251ea761069f9d8722bd61d5774c886336a324ac2604a9874818d024f732f429e8170eb4214635641647ee2175f866ad

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
56cee25a343f48eca8cb846c654a6967

SHA1
10247664b0115022e4a7c45cf515342d5fbebac4

SHA256
fa1f70b7a7b677bf57e9de7b9c30422fa1da33c26c828f784afe3bc5bfa4bd17

SHA512
8571d85b63911dea0c1b117340d1f6263012464d7bd02c6bc03de8d237cc391b169b5ac1d2de7a15a2e4289d183549b5264653a54ff7a08d72edd59ab6b1baca

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
af6e158fa0b39efdeffe5c29cbe5475b

SHA1
4c9aed5352c36293139643c1b3742d2fc514fbec

SHA256
320122be5d658b28cd5ce1a3bf949a10fdffe55c4e5e75c07922ff1b6f9f7448

SHA512
2db9080af140bc039c54d0afda8f3f809647f950476f94e469afb975c1920509fbf14f04c66ebb1a9efb500cee5e26a1204ae8fdce8b71feaa9b7313ce739cf4

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
2aabf9446729876c9df6eb69fd3b3dcb

SHA1
c6bd453c3121e4f6d7ca1827997bf6963dfc4d7a

SHA256
33781349ba901b1bf5d37b4f3379624821dfd6d6ba72c6a60c06704b04212eb3

SHA512
941ba95e4f873a6f25071b893c1c1f12467b48c40c2a1fe556b5392918cc5a68bccfb3bb4c4e5c54e29902970a64848cbd5d4afe8128a07acc72589ab94fcbff

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
70d4c41099faa929b88efeb4b7dea8f3

SHA1
601833a8d2887c1b47631732e5908ebaaa33b012

SHA256
6f21e741ecad55db3ee1b3277b2901e70ad3c7531134434736bed51d78a93702

SHA512
856410ff0e1b1f80778eab9fa337f6e7ddfea9bd2ab7d8f321a9e69e89d21ae1e15393bf78390b0bd998417635af2378704d94c719bb9a674b77efaa36fae667

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
9480cb8130fc9e6bfbe802c783ea7c76

SHA1
7e16dc63fae1fd5b3854e9e8e887a32d2427a5a9

SHA256
3d9ab9a44aa48779c9c4f1edb2c6659a37f401ad21021052e56e994f73864f0c

SHA512
0d0891f3f4107c0640735bcb8468799255b0a97cfbd02b40fd4715208895af90c6ec20dfa4edaa4c5bb6b7d5fd34bdae6b9645c07725f0738e2beb7f372f6502

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
691d0c9d9e5613482faf49cfb51c049b

SHA1
bce4c51b3edf8936a2b3de895e9e843b8a16afd0

SHA256
1be768f97fec8002aa12c906d204c0df17ad22d7388d7f973fec17d3ee03aada

SHA512
c7eaf36674d6c92eb5aff36515fa09c0712a82ec4dabd53f3f6f546ee065fbbf66c59dc65a21805bf0991a93cf0c7cb783b69acbd76c70aed335183ca38ff24c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
e8702f4bf99bff886ddea7375fd7cd50

SHA1
4885324293c4ad384ea2f41df27af5d6c76bd938

SHA256
c9a5a7ab7243b6573cfb49277d1bb85faaab0b3f0074b899efe168f4917a334c

SHA512
41cfcd4326365b91d74e950087ae639e7932ff159bfb3384ddf1e6f0e10580173b0061eab6df852e638efb12dfc4d347ac34c92208d86ce489fa0eed8ea6fb42

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
66b94d5cefcffe838a5f7d9e9bd78c6a

SHA1
087d25c1215fe16a7295ce4fed13e791e7d33366

SHA256
2426df3ae38fb39cdc5421b2590a687e43925d3fc59d284f82b87cf17577d577

SHA512
dc9f651babb727a93b4cce2a4582216eee196ecdb54a2a4a66d6207baf4c4f296a382f9c35eb369a0311ed9f0b348413d0e9fe3623c4fcc1176d96165a93b63e

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
425724c41a58aaa53443e0173748da79

SHA1
b2c48b459ae9aa802570f1e03368d320fd474fb2

SHA256
e61e541cf3ea11113cd2f698c61adfdf1c0ce6d38b5344068b9310f8e4ca4703

SHA512
58ca8f5e52817b38325db3cc1b9dd7d04cce98641e57dba338941d27408232f57c26bf5d03231910f721581dfe36da794372066da1986d7f5302c2ef9cd56b78

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
7cd6a06323bf3416bfd40e150f3937aa

SHA1
b83f70135c3686f93948e347303d12ad3d7f3bb4

SHA256
681518dd3b25a33ae28a115634927c8e8b66cdb6e54431834d3e2e42a9ec9c79

SHA512
155ce813599579f9c61b2dda22e91bc2f90e5f4800c197b66a6c128e73d2181fffd0a6eb2ffa51199d370d5e7aa90edfa54c2d2dcd53a47dd8d5682557de7cc9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
a3bf82e614e6a89d4bf77bc2f946ca52

SHA1
6ed6aa1fca586cf7bc139309aa27ab93adf42882

SHA256
429fd3e1870da4463d6c6a95b871a2452c6e424c17ad75a30ec736540eca89bf

SHA512
f5aa7e008863aa0ec63620061de7d597083bc5bd554d764ce4b3de123f0041580f0242919eef4a64296fcb12ac0be65472bd47fea4ce5ee54b646191f0db149b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
88514d3425079589f7b06c8c6442d63d

SHA1
5edf10efd620822b7213f6736128ad3d12324ce7

SHA256
b720dc7912d1f333185c06afbfb71755c7df09f13feaadf9d1d9fc58068a1cd6

SHA512
53a608dfdb6506db840fce821e512e37085e198f37c888af187d698d1fcb3c6b4278127de8d63859ca4e6ac6e849d04c427780f5a6e98ff16af33fd9fe67cf80

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
64a85ecc3a14e55f8dd9b14450cb9b6f

SHA1
8d204da7e36f50fcadc50e383d3bd0cc132629bb

SHA256
467939a3b72a1d8511c1315b60477d482a4c434b1c1a9d03e521d12e496fd0bc

SHA512
30f6f0b13f628f8928e5208c5e66494e32de67eb7c30dc6bcfaf31e3330d3fe6ee50f1973e889216403428dde44ff96be754011955d9a5292d12994debbbee65

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
cca05d39c21ff8d7d8a440442e517c96

SHA1
b4b5346a1533e9fb4aecac2690c3b40894c5d4af

SHA256
6baf900de060b3fd8912575f2d4c9f12a21d814dd66a2e7e9ffc26bea56977b7

SHA512
da3baba896584dc243966f763618a7ecd86547ad1aab857b6922b7799a47967390f1b380769fba16c1f6973ead6f904f705a18f948225d8fc7afd65c0b449873

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
37d41202c25035c926f2fd93c4168cfa

SHA1
24ae6747ea22cdf1c9eeda9fe65bc530a635128e

SHA256
50ddea91381986ef65811e544173d51737861ff79e52e984eb2d7214874e6291

SHA512
c638324d21ae674f6a6be37d098ec5b48e6eec4c962a89a745259b009025f6b907f4010079bf89ee87798ca14a8cc2a7056cb0fdeb2e0f2d678b6a3063991d28

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
898bbc3abf5b9eea3fc7c12640e40251

SHA1
b3bde88cc9c62c210f5c02a8cb98671fa94d0dcd

SHA256
5f2a4b05448b6eddaa9c83c90601a1d554f31c14f33ad848ec2f9387a9e4d84f

SHA512
b2dfd41d6ef247adc7a9bc46b7c5dc8077e0ef7e2c2c125d680b25d6c839a916395c9a48e1be6884d2f4a089daf636326015b88fd2638964179240db80cd39fa

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
aa1b72d8efe2557c399c1c38552a850b

SHA1
0797f95bbfd44ce007e9377531ead06d13c120e4

SHA256
cec196de13e68eb6e832ed3385921e78bcc2068f34ed1ca956df1c88fb329071

SHA512
49a4d68dc9a87d7f3b6f10d1f04e7f485ed109b8478f6fdb2782989db713c6385423bf1122c130f60258cfcd2f43b6076f54a63add410de39acb80a896a62a93

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
69d46eef3becca9351966988a07ebce4

SHA1
662ec79e501794a6f5ea79d7bb9d833ce55fa75e

SHA256
987e803e810078dd7e985b1c866c916c0d55cb42bf9b461a8521fa8a8b2a3b3d

SHA512
85670faebed222e5104761f2524fa5b437e5965ae5c1decd3e1c0eb3f07c89f5609c71d84e13ee280f55f0c0915180e17a9b2a0fc7cb5f0546fa003b7059f906

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
523bcf386a94f5e0a6d98bb973332d19

SHA1
5dbd0670c3275b8e30cb8f6e5d6b41e3720736b0

SHA256
7d934754101dc92ba2fbdbfeea02b31dd4551b953e1bd46ceaed8c46b6f7a363

SHA512
c84b7f6159ee848b818777f9bedb755a20769a404924d95151d7de0d4b0cefe1bbb76fe9b39a8a541ed6cbbcbcc1a72c602f92abbda7719d234f9bc7246fd661

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
7cff4458ad4a04971fa7618f8e25f26f

SHA1
a56cf8f57af45c0bf65dd6f6d2dca70854d80f2b

SHA256
6408b5f2844ca86d410a8740bde48d56adb6d7f7886033b7b4a4d02731b932fb

SHA512
4c760bb9c18c657581bdc5156540074b1940c10962c5bbe017510c7ba8d51ead8c208cf9f00ca226672220376e45a1a9b2e28470f810d16e2d3055e1b4190ac6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
4f497e0c704d5d27bda7b339ef907dce

SHA1
3eabc015a5dcbc0cbd1f88a0e1ddd44a2538efec

SHA256
0c3f7bfe24b88be492daff478d00a8ba694a1ec3e8074e4b2a82eba40fa662d7

SHA512
206026a581b496da16a6c4d6993c24a5e9ef9b5644eb73d7662847b6121fffa9d49bfd5f9f3978e8f100a2706b1386e840b5ed958e8a200c31f88bc7359036d7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
0bce7b3bc31daff73e85ce52140bc674

SHA1
3e1d47806736c312425bac0fdcf499ef87f40a7a

SHA256
2a415a8fcf249f5c3c8808c5ee122d68c556beba6a636ca580b142042f443186

SHA512
1d542c0d2e0743f1b5df8e21e391ee6e07ad9664e60eeb5c9f6d3b62c671d228bffe48bcd8c0daa1f9af657478f4fc4a8461bfc3f1d485020065f1609f9e0255

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
f32d41bf375279ce2915cddbefd36469

SHA1
a4a51f41c6b8669a8d58c209f680c51e66ceccdd

SHA256
be88e59d97c057905729bc4a944128734c5b331952df04baa6def5bb8f4f7f53

SHA512
95091e65c712482e798ab7483233a66925fb074299460e5f7478425f3a55a96046d8b0e0c9085481eeac2ef2177231dccb97b2278b5c3ba63ff54d1c5bb5e5e1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
5289ab12d08ba5c348cf9cd6555c7db9

SHA1
c8b6ce9e7544ad3d237568632a5e6675df26f04f

SHA256
14628d51735621aba44740d6695b4fbf5822355985c0711a24b12f2d96f036d2

SHA512
4a426234048464302e51b358ad6be63c48de28731cc07cd577910c6402147fd15cab5f41f822ecc3ec6eae924e45c1f43e8ed6d179b0038da8c833b1ca93b8df

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
cd9e91b5b94a51a682dc457456848021

SHA1
31ad80bc753854ad2349764e9cb9b66f21ef80c0

SHA256
13eb15f9a95c72f4d23bb2f5ec11c6bc6cf1a69334d562cb29d549ae178945d8

SHA512
ceeb5d8b90041ece71fcc08b9664dae29c4e443ee3b292826073dc589752b957d52c0c61e24d30a3d5698bf4ee76e5a1d046128030759c4384fc2bfc470a01f1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
422a8df98635c78442813d9c05135a93

SHA1
8b03f223fcb83ca3dcc361003a96016143dc3750

SHA256
c9f3a5b4fb2004d48d02951b6997bc0b263021bb2b09f814339f9768b50e414a

SHA512
6a302f435cf434bae0209d7d947abcff9c9d928287c84dc7d802cef3c014744c5b0ebb9b361379a32865644793c3deb1d575fcdcaba0aec837143ca21e0bb634

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
fba962ad5778a7e937080b26a9502214

SHA1
f6868434cb6e6cbdaa7b95772090f25cb6a24bbc

SHA256
473afd56e17649b6b51996401b7791093ad0730e96fcbda7a16fb1047726bc93

SHA512
9e19eb5fc8cde27c780b17edb941f91e6d5ef04be8476c823e37778dd14e88df83af8362b631522032939e16892dcdd1a061f4165965dcee291cee2c95897daf

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
1ebe5c167ba1292e948e61c143208048

SHA1
96b65c87f4c13401f7a0dd95283542a2084d8e56

SHA256
0d3661ea77d786ef1976a09bfaf526b79f7ee90eb3f5d4cd9fa6d1fdef3280b7

SHA512
037a8da76b309ab50858ad3025af559937c1b681028fb0de48e781d37200656dbebffe17225a7d18f0c79099c166ad195091e079730d8766b7f04eb890e29556

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
abd8f9dddfd7a30e774b2de950604a7e

SHA1
6466466879472f4797fbbd944c49c2833b412438

SHA256
8bbe22c64d504614f9f16dbe89ee0d131205559e4ed4b113603b5ffd96eedc5c

SHA512
6e042b0165c9e535f406a4d52ca52f2a32f5be11dee9473461ea69e5c2ae10223bb9b42328b04936bc5644ff5a4979a40f87e1534209a300804958a13574b23e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
c96af7fc9ca3f97bed1d8a1f2e56ebaf

SHA1
917a1ecca1aefc28881dc74af806f29aa7a2a490

SHA256
a90e556e925a59ece6d53058f2782dc56f83cd14f1fadb297a0cd825500e13a6

SHA512
85e341e1ea6071458d69cdc95b520881d6ad22b90c2651ceab29964b481e734bd1094826cf8650f3620b6a3b96e6190a60fea651b99753a84c628d8989c18607

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
8f91ecba64c9dcb8fc36cb56862bf23c

SHA1
1c7f1b7208503e9c972db80fceea3d59ef7d8697

SHA256
165961fb169a442651c70e6e6034daf37198078569f7d5071eb4b9fe8b888329

SHA512
fa4ea44c6cef98c1ad559b0ea9b8c290f1b49ebfc29f8a7112a8f18edbac71b50469d972992a86c4fa8d26878adb046dfa12e9b088db3fc2e5436571177e40a5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
4ec77da3a40b0a1b6451da3552a7de69

SHA1
c216be94e66f47f81f6923eaf310e21d5e92174c

SHA256
9e45c1ccab5940b2a2da7d977fa67c0bbc8f3f177efed9c9bb1a8b599cedbfab

SHA512
a70a00be71f03870dc9699f5d4ff928bd56f266974e721fb959cbc0623c39e7002428e9dcf0947c6080264a6e15e583ce98a6ca54ab1b705abef484147b791e3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
7fa3079a8fa027cb3ff30fe88271e11c

SHA1
b1640cca02f7e329c661dbbd386f5d54eb188f69

SHA256
14163cc0116e05038f565de498052b7b9ec23d72a058c57ecd2a04d72e1dcc72

SHA512
9384b2d6c82ca85298c6b0098c8f989a7eb437f297ac39fb7f225daa7fb5c48f8be97fa6c2aa4aaef12f4418d7e29f9dbbf8359aabb0777df40346260015d0b5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
6a5f8ccadd84afaa039e505c7c675f93

SHA1
b0106fed63e84db5132975c0d092547f5698800e

SHA256
ff78314d7d3c7069c1c0df0a3ef11ea0b99cbfa8d30d4f615f3097c875505e83

SHA512
2640ba944c8683bac1038cc99ea35641cb77abcb5e92b5dc537396fb565a93f778f33c84d707928f20ed2fc84b6efa47cea85ad5226f081f5b5500d22b2b3c08

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
378dc432d7c71112b60ed19b07bd6635

SHA1
94f83b90fac71b754752d75e2d96805f947d4967

SHA256
df04fca23959da7c5d3a882ff2cb4de72fd3d9fa18014b0e54a56f11684286dc

SHA512
81256c0cfe54cb7344d8e4ff78afd02782bc3180dc27de806405689ae78380a30abebbe590743a11ec0c16dfa4e6119b7173969b2d31cfc2feaf81261bb6a18c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
3aa6620d407a382032e29f52dcf5345b

SHA1
d5da680cb08525187f788300e1d65d989eafdb57

SHA256
63f7f8512d695bf76fd5a370c61cdc52cea81d3a6253a5cef66db6188d2a38c7

SHA512
82139b5b9a629bdbb970b0f625d52c0294e259e36f508c691be41b88a7c65416be4a07d6027c087bfe8299af67d4efd1a26235ebdb09780980fc47dde86e5e10

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
5c17d2956f6f52e36e33cf2f8481c537

SHA1
6e8300fb24f35daf8ac3c2312161c317e790220b

SHA256
c129763cd5a4da8aa8b734fa27b45a2d0f4fc0c06ad12e95d96eec4be5d1fb8f

SHA512
59426e4d6fb92e7cd380d6ac85d8b8db1949218132c015dc73dc63d2f4ae8d3e08951803bde1befb0cde5446e272d5318b3bc959c3dde86f6e4173883c41686c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
ee787442327e9c9ffe7b594245e4bbc9

SHA1
4af09cd2ddfb91b1390e4d7adfdb2e8a949e27a5

SHA256
bab6defce738bebfdd317cfc2e8eaaebcf68cec1e70339a1aa6db5c329fb3af3

SHA512
3e7c5531606faadd04a6529d3b95bd28e658c328454fcbb21f3c5702201dee17881d0cefe83185ab3a8a5f355c4d6d1a476ceb1021a620b77a8a26990a11bb75

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
d499470a2f35d2916abd48c5dd0ecc77

SHA1
ea0552c942e454d495e27a3c29f716d78ea14481

SHA256
e0d55b0d44f3d8e974f2bc8206547bf948b1cc022416f07435d4d0f9f111a00b

SHA512
86e31daf29c61dbf2a173c03b71817bea2adbd1d9f41f4faec6ad0876238f85c60fad97d2a7e29eeb3aa09a290e779a5d63abadd3732b865756a90b0ef2b4594

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
c33d4a9c03aa8a330668a98af1e3ec5c

SHA1
db48b3977c9ad55dc8420cb6d7e7fb32be7f448f

SHA256
1d6a00edcc24f14b0628a39a76b061c3603fd8cf32b2dcf647afaceb31cba538

SHA512
c239d09ded37dfd532dbd52fcee439129f550ddff74ff1b1febc50e849731da3bb2637899907a6241b778d0b6436647d77c507275e9cd4dd8b94317c4fba7e18

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656060295712.txt

Filesize
77KB

MD5
53fcf72701de25b472df996cf0403057

SHA1
ba598afe5df4e88fa30f571e1056a72bc33e4d62

SHA256
2b45ccd15b6a822ce80b41f771b7cfd099c759b02f3fa506fd99e818b43bb7b1

SHA512
adf9947003ef7a549884cdf82d973860b03c928daa0ac73bbf0c1027029aafd80db43d8741bdb442564ee7c9dd7e041c617f634dca43700fb1d7473ed103140d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656525478361.txt

Filesize
47KB

MD5
d3329303c0f563ab18fcc46600492fb5

SHA1
2e271f837771601762514f78481e7fce98890ea1

SHA256
0820740eb186c8531179e3aa2b422848739a1ffad3449a85f3b4b93fa75b94d1

SHA512
56d3da2a6396c2805628488ad32342e4a842ee864141109a0b88d7f33d84b1a64520ae98b428510dfc63749d026c8fc370a0e97c6b0323fc59b3dcce062804e0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663169040966.txt

Filesize
63KB

MD5
30223b85bcc75586854657d99493ae57

SHA1
e30c65e20fe922fe3c5247ec0b4b40c6213ad0e8

SHA256
e4451337962f54f40e1a652fdd5eaa4275f866d856e20905a841bd32eb16f53a

SHA512
a4606179e80b6e1979b059e72fca19ab2be4907a556817d79eb22c6497699fe39c4de46c11c7d517c2cc0f83f199046fa255b24933fa69c5ff2362656ef240bf

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665885684530.txt

Filesize
74KB

MD5
623aef86de0f21465103df988f3a3754

SHA1
c3e37126ab5d9ce3218ca4448def2f80f4098fa8

SHA256
658709f372f0a594f14149c11f5f428ddd3d97e10c9a356d438315c515c70d3f

SHA512
c1480fe6fac8af265d00f0df55c82ad302969b6d72f858622d83e4101a9488798204dbb9134a5ae60ef2c8bc1e5fac21518bed3b0e560058205f8015458d4fe3

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
19a956b53d34c78b4ce55955bf8bf47d

SHA1
894da60f4d8b031bb2f8dce303bf166055483f08

SHA256
46167eb92cd9c0035e5f3747db1f0c76996e624bd46e3d225edc977ff58782ac

SHA512
5405bb8ff49a7b9c2a162aeab1971194c8a5b2722fdddcced479567a320c83dbb776cd4a77b5e97ac982c652b3023c3d993a43a9511f3df58768dcebf8abcd9e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml

Filesize
317B

MD5
c317253e598b0d005f3d6d7307595a13

SHA1
a748fb5a5acf48afa6836d4662f9c02a93f685e4

SHA256
76df7a91617600c264e397ab60b52653b3aae5a64a8b9b75680763a6e1a4508b

SHA512
885d1991cab787580d2365d7e3b60f809c45d73ec7c81d44c2fc4ddaf2347c05c5dbb87f8ae8fcfc77ae464d07bbd8ad2c9a62121ce4c3a45f8a937116aafc94

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
f47c80b48d5ef45c065fdfe70d0487bd

SHA1
193dbaf7acd34d4ea8db3e7bd0978b804ca1722e

SHA256
2eab292e2027ecc9d18f1493372869a8c026851f90198d370edee0ff5f6c0623

SHA512
8c71bdcdd1b70f641481be245bc837ac4b4be05009419a37ae4edaa4b2c85fddb3f6e31e4fab9eabcec6c8bf70446b44a9f4bdad54be34eb496ff54ab44196ef

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
a18785561bee3caf370ca64dea61f96e

SHA1
c523b132829b5bbe3e96200470ceae0ec6d5df83

SHA256
6c48df508cab7383fef0ba50565cb695260b7d6a155c8c3c7c108c8b52948e97

SHA512
98452f25607bb82817b1d0f53736542c0e4e270133a468c81d5eec27e760a3b86290fb4ff5fa291006bf995b5c5d1339702ef4b4375d84873aeef49945013e01

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
11b97dfad37306d95aee989fdf243548

SHA1
f3e48c9e5be0d5b9b337f7291a8ec8d17bac5f79

SHA256
24520e44d40f02391d2981b0eeb22c8dd60694ade4673e2101c4487e6d121eb0

SHA512
711a8014c3553b73970441090002b23a3599dba82677e6b8f64df758f265ba5b44098f40a1799bc7d17c8812823edb8776355057c968210d9416b79543c03b0a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
b75ad7199cef26cd9d4035b2453906a4

SHA1
04940cbd0d42f97f474c42126bad5609a80bf249

SHA256
59666773ec412ed5afeee2445de7b7a39b4955bb74956e3fc0c0bbcda3f2adc1

SHA512
38e7886f67e513a1ec9325da6c0b112e01050350c6d80ca59a33b232f71e333412cb018c929f0ff8873fa81de2ab858e1517ff4532c5b55c821f8b066e920201

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
3011bf83c022ef7bdec057c79ea4fa28

SHA1
56ddedd60f5278029ec2b26c1e29c6e46e1a145c

SHA256
7506a4b1dd6ada353b08452e6c0d97663b92284445951ae78c8ee94b9518b882

SHA512
4c8e347e1fa8ca4ecc66b4b16a0dd8671e7a31bd98301a4f15e8c27811143ab888b1a0dcf3618ead03402ccb1792fe4953e6f4c8a55be3db038a9f788a4a4acd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
1c5042e1773fe7bd4ec514ce284ba233

SHA1
756ec3ae195d482e97f3d202b68720c36a6dc37a

SHA256
6f5fae34c294224533cbb0dabd5757762b848e69954c82c5508535f3f51c137d

SHA512
712d263404d8d2ef41238c85a292e50308cc2e8574a32df47ec0949eb22dc341c7d68106f4ff1afe9f32e752435588c302e63084429e30ec46983630d1bb5946

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
cecb5fbbdd6bd0db6fb0a6474a900187

SHA1
ac98efcf73344edcd6cc22107e1706887c5ccd97

SHA256
95ff9e0d6f8966425e258733a63ad73d04a2d45fa319778a2008dd2a0f2526c5

SHA512
8ece25d5eebf37d0f2bab7d40c923f08f38cd740ac74e1031c24ed74558d63a36e8f2dad84ec1179cea1f3597ebc23bea3d7e8c8e1d8e02660d06670f1dff39a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
6d2069946bf97817f2afe8c90814e081

SHA1
2057abe4f6c234cf91e24d95ccbf1fa9eae9d1cb

SHA256
3825e7c18dd29bd0a52c04d275f4a01cfe1228f1283881416b6479de1d4d4574

SHA512
c4e2ad21dd55437fc36d40075ca05519f40f273903b032db9cbf447baece92535bf10a2ebc555522e1ece8fe0e869619a373549aa9113f84cfb33ba737483bf2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
5bb464148f82eaefeda7a623954128fa

SHA1
8ac09f49de51584b152af75535996b36690d9891

SHA256
8fac12e4148a811e00126acb97229bf452f6ac5715ecc81e82c28bfeb3587d75

SHA512
4fecc255197b858c2ee706ff9a241f4af19ce6cfdf2da0c6dffeb2d57c2268e9c3213e9f81bf54c5e22d98a2eee8f5cc4241ffa1c5f17c2dab8ab0adcfcf32b2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
cd4f12df71ee3570f778bfc1f320181b

SHA1
50249fc7e6fb23a3c3088fa26e3d67866e0077ea

SHA256
0bd998bdb9c16b972da4b5a0b20df44927664439be0964402f59fbfbbcc7c03c

SHA512
1b2656e46ab4f6d29c0a956acc77dc6c113e76be049c33f8e9ae66a4d66d484264be692c9fe2158c6b1c9af5feab21894de533b9120d68dad5d108ea3d547a88

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
f3c988673e2e01ba4866e8a6f490546f

SHA1
ccef2a287d15ee3d28e892dbbd31c23203aeb8b6

SHA256
ed5411587aff2f07b374724bd1ea81895f00ff97c73d5dede312edcf8b8b4a38

SHA512
b902b7d4389a70b7b32b063b0625be44709178721035f851a8d3624b460b30809d77cbb15606b235ff8a401331bec41af9e6376fba659659b743864b2b4fa6b2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
d9fe536cef37e5f8cd8e58b144acbb75

SHA1
ad473607b087118ad77cfb6996b6e80d97df5502

SHA256
e45c200653856f6f33f9757293a36a4d775257c813fd3728e9d6add1c5c57f51

SHA512
c30d993288428e4702f55f14ac18f8d106f59f6de2ee1feef325665c9ccd70d0fde4c23687e67d0d77d824087b4885d7eb0444265c60feb4686692c18f8750b0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
80e556f8d887620958b700a2ac05db6c

SHA1
eab7a48736894a7df8a56d8cf107fa7978fbfc6a

SHA256
94ee1d07e9e956d309e3d3c03af58d1748e92e907caf792d30b8e977128944ee

SHA512
5c3e5b98cf77b666b30b58df26c7fc609f84030015fb5ac68fc701d7c6fece8831950d6aac1d781e6a0e20761e2cbafc990cb2512a56f8b5b23736c074854117

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
15973775275364a7cf28172aa1eae7aa

SHA1
f3e14fef3b1e9a86b9cf10fa59a2b71020941c55

SHA256
046d73f9a6dadfa6cac1ebf1b2aa7568e3dde5911463618a5a8c2cd5178bb390

SHA512
f5525a35226703d3f3b1c6c62cb10c0bb8e11985ab9541493a8485a98e2a359e783af2ea846df2409472c5d1d6c73d9e26167163e9dd2f889f269eee0b38039c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml

Filesize
62KB

MD5
c34fca4ff26e3d83471ec205d9420d72

SHA1
6047b09588f9b927ce618fec63ee19fed55ea633

SHA256
086456aab757b07e28005dd1d12edfd3f9a695f6248b1c1875b8ebd3d952049e

SHA512
ef5cc514e13a1708dacb06fa5832ce367310d8fe9326021418cbea14eb5bd01559edb5f006f6f15a8d346ba0738f0bdc1820de2592dd6264287f22a10c9bd4ee

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
ff39a3684ba3eb5d98b19609361eeb7b

SHA1
e266729962d8ea4002d94391f16d096526c1be1a

SHA256
f55af1fc741d8c0d22db2d2dae6483ac3ba0aea87532db40dc2592e98894608b

SHA512
bd3984d3398322bdb43a36f931a05f3661cd40df364e3c1f1367219eace22c4b9ffd1273127dd54b3761720e2000424899d3519536c3ca10c7734f734c57751e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
5aa858501950ee9219e3c9b02efb2882

SHA1
1a7c80f9a19ecc9286d6b0fd69b2baaa9c244af2

SHA256
e193d4f248c4a0d1368765a50165ba1747a2a5bcda9c69e17622ac540e4c24f7

SHA512
bbd3619da9c69fd3b13719d35d340ef9adc824d9e7fd0f8a222b52fc3410457b93bdce6b8fea7070e32533621f4d3e5b114d9d3be00054d27c8a8ec6f1cdf4fc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
36e08bd66faa4394c9a7dfea38d7bbf7

SHA1
a772517e0e09b80408ce9f4edfcecfb7d798db7c

SHA256
d8f554d19d73f9e115379858fe52e291a506d3493d1d251272d46b50ba529603

SHA512
738a063dcd550b889abe50d47389a876b68594efab535af6b6b9378fcdbbe2c3e401cf031602df90784ac4826113266020b07c5e2f4e1e55e4d09fa460fdcd35

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
f73963083ca331250adb88891980a931

SHA1
dd4d2d018bc154115411cb7a11196c86434accc6

SHA256
c2fd8b517ff31e176666083e0fe3afbda47e66d663d8104f11c3e06c419e2118

SHA512
2e67325b0fe0a4034da1b3ef0fed673149a14c7a50b7432b9faa7a96f0576e598a439ff391cae8433bca22854f15649de8ba5dfbf15123f9c01258740b4928cf

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
0b46a62873b7debea0538bc65197892c

SHA1
2ee1d7aa081de7125680d92a25649eff28be80cd

SHA256
c485a8f42c4cfb5cd260482edb3c7f3530ba84fb5de6833938620f6eefc48c9d

SHA512
d2d314802e9b3d5200d5f44cf32687b3f12830c70f8e1fbad3fa23ca504f1b4956a3453319b0dde6173f5d7178ec2930b15a373df02c27f593a772f2a3cbb7f4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
eaa8564f25da3eeca62b78ff2ec64a9d

SHA1
ef5aabb8de08a1ccc7135fa98b04b983dcadeeee

SHA256
37ffed6ec90817cdd9aa70cc738ef3e0daa7dc01e11076346994fe4774d6f6f9

SHA512
c8f57956b4376c24bde1585bff1bf3c1bac1ea8810ad3ac329f26a13eb797e7af9f772b88c32f7bf238ddd6297c6f3884598c3a2ab2d93515f7e2c8b8ade431d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
125eb2cc4a11dd742a8df6b87eebc4c1

SHA1
71940457aa7a562419f6e68affbfe992c3149979

SHA256
1c1d5c0ddd9537cc802057af63c1bba7725765b4f1a604a2c4e64b4258e5c166

SHA512
93bd2721218da1c2bbe6a58821d2d66ecdc405dee11cb995c6f6112b7852b2b71276fe3941d0d9be79a2904d67a31d00082112ed3151567b8a7c3fb7d82d3b76

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
5e6313a341d4422107152a24dd2dfc08

SHA1
50d7a8aafc17fafc73b4fbb2ad0246430bb9a9ff

SHA256
dd7759f5f5fbfa3ec36adb9d4938393624f31b37fe127a7b01c2701515bc4fca

SHA512
3ba5c8fc20a822bf5c47285658d0dd8563bbbc7f7c3fc618145b2a8a6c1c308fc46de5bc93c368013bcd0274949cff9b2ac1140d549712c18f1c195a5eb43c0d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
834c4fb85c513e5bb7f182c36e302db8

SHA1
8d181c27aa21c212cfebdab9c7c1a0e43904117c

SHA256
c85f012a64550252780db838c75308de4e488cefe38d8d8a177489288bebeea6

SHA512
cf042ec81879259e5350d737bd183f0bdb1aa184702a7309baf3b01d7940f5194821ec2f95e6983bf5c177db4855b40420adf5ca526ef620325f99c857c7a330

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
ee52da2c2e7f3e87ebc9224df6d8c1c6

SHA1
acf481c9640546dd09857bd06bdeaf4aae5c8f6a

SHA256
1d6d1fd771283c9e4280dc1edc7d33801a8bb9983c61ee0e0aeef881d471414e

SHA512
a04a389b99e87e2730305a69957d9b4682d8650c0ef21e25dc652f331137a4ece1288cd3f1f8add35f9e124143c82a2c8844daa4e48feed58886ae320721d500

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
8e7b4280390a5f1c5a208488f09de2fb

SHA1
8beb1e95294fa8df0a46d653181fb46f302f74ee

SHA256
51a55796ad3493431f3df49f630263df6e9c50e7f3e58e13ed80941c5ae77044

SHA512
0a607a9d736e7aaeaeddeb8a9c85df161f9b54a2ea5fea47dcc2472193efbe78ca556974ad45cc354c5270db67958e3ddcbe7a0f9c77b1307791b5cb65a6bf4e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
de34dc40958daa7f498610e76243c1c0

SHA1
6f8364aac6634e54696835235d189ca57261dd33

SHA256
d9e9ee32fae3b18a69b4d094a0988c9a817dcddaf119326fa43422adfc5a9ef8

SHA512
2cdcec81a855eb89004e72d69b4bd1692f2306bac9a68341a6525857db2d79309d6d01f3d9287a74e55c7c15e79e0f0ec45a29e0173ca6823e0ff0d1465848ae

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
4a7b533d928637e0c71c36ade1fdebea

SHA1
9f88a7e3aad096c48f8237c9c406b27b3cedc3e1

SHA256
999b80fe7d76c9c8a6af46eaf7d31de1810dbaa2d56e3f9e4541ccc0e661a59e

SHA512
c833a56e30d8c7ac8b47e1f85018aafb31112d02776d1933bdcb543d7f5cbe2dd43125668cbc23990b359cc30dae7f212eebaa33f7f648a5c43d891b888ec224

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
9e2622517b6f10d7407008dc0dd9a837

SHA1
e9cdf3f0485536104b28b8dbe0a33808aad0c73e

SHA256
5c96d378f9322c47fcf260882824b3b9411257b10aa98031549cf7b2ca123668

SHA512
8554c3a34e3868a0de3c4270ef87dc63ed8592b67ce3618499e3ae45edd84d69a3ae4e2a7077a6c89dd18735421314a1905a61e1b38b60931828c9c0ddbf364c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
d26b07dd25df45dd4e84a8b98f5150d2

SHA1
e7202055a6c0d1f0d2b60e6fbe201c8b0f21d888

SHA256
884a294b77b22c755847b362bc4abf2856187642282f6633af2acb532095fc16

SHA512
e5ceff2772add232908767ade073d3c52993fe597338911bf4146c5b29b448710de651ccd34b163f7da59fc385435cc3a43beb85860e4774e528bcafbadc66d2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
4e3605ee2d57137dde8c2168fc89df53

SHA1
b91ff25ee7e927cc9ee5db5d9b1863ed26e228d2

SHA256
b8c71de412c40d922f15b05dddabd039fdf87d55f3212c84e548c13a6ebec2ce

SHA512
b128aa0b2ffe106bf827c2626374e2a7ff1ae61e1d7ff8a2ca9289d87ace985921256bdf529f97307b57d5da5e722d83616efd31a9cabc3afa78d1c9be1d45e3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
e2f818e81033528e1f39a97752092d00

SHA1
b44492b122455cf0dff51af17e2325f0b3b541a7

SHA256
a0bbdb6ab8f4645935791f8dee03732fc0a5313b8fa18452dc43a5d3a31f3d08

SHA512
3bf11005778f562d7e9b7e52b0ad3d7da18429351f390568b2f6e545bce2b7c70c3884f34d4666a6e53e8b46bb000c6821280844ed0d4404e07286076dcf2219

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
8d8b02c11ad7e1a3b7c03e58d7a8de45

SHA1
065c75e00acacfd280e577b126b5b4b775f72d15

SHA256
711eab43c2ae11751a5d42e3a2d5c3fedb9d9ef48dfe9c60e5a07deb5db62c74

SHA512
229c4e9aa18d3af8879211e1564ced58bdf4a3e469c85143e26af44dd695c7a3ba88e717ed8308f4d486ef419d7aafa4547bb60694c0e0156aa7e4d58cf3d7d0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
e6cf6ac3f64716991773460c999b9592

SHA1
3e175764a7cbe64e8a43e05ffc0d772828471137

SHA256
0c6d8ffca9fe1fc9f34c85b78ecca4a722002379b66e1806245aeae8aac79b0e

SHA512
6c9bcb60c22b87fde167ab211a980937d77f19b2d562a42cf21be0e6f173c3947d0e9d2252806429315c4d5809af44e0a176aab6362d798d523951f9cce7b23b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
2b5073d6314db39458d1ce4095746a5c

SHA1
e2365fe89f5cae4de99a00981ebfa6751631456e

SHA256
b4614a03c5abb88a667c223465437b5797b368947ff1cec8e1ccfcf7f5322aea

SHA512
0744b5e6a819645c5a0eb3a9d40eb2dc5dd216bb541b59609c80e0d6b38d8a9ea3b49b102859df0e4282f85566ae0a00bfdfb8f25e6eb5a0894866d2a3361d9c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
55289c1db7ef8218a932f5c27a8d94dd

SHA1
129e33195ffe4e70c8adff22311eae0327d784a0

SHA256
07e99ea3a74d61a4d352fd9da70813520424b6cbe5b37aa96851313d6659f802

SHA512
f044f1db6ed7b8e32f0d12966a740fb4b215662059b796dfd3f893e9d21eda7948f8d28841095c369c9882e2cddf79145a473ad4af5e4059a7e4a6d3aa7fd17b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
e84a5d53167e5c6fec6137a90867902e

SHA1
d0677fe86db41d49eb5c3975f42bf848fbc1f14d

SHA256
c633f2a42eef8a89237c80bf033043cebfe974eab6e9985a5ef635cad03550aa

SHA512
91ad76654dafd38e87e5a06d86afa82ebeaa87fd2728f1377c5fa793f2a87314a78594dfdf040bf40860fd7295fba4921bd264dc40ff80170f660cdcb24313f1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
6580e6fa72cc381b673c622ee252c972

SHA1
c2c7b9cd95f08bc9b1b7ca506f00124518fcb37f

SHA256
5ca032a0ff2546c193ce49566c1a3b1c110b6430ca7550a25405d5b8a56dced9

SHA512
a8106fdbe52711b47dd59e05424cb16ab243df78c0da202f0805f0a71bf3ef1f1847e66323aea975d26b255502eca298083e4930669a6e15fb12ab02b4525ba0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
2e79ac3e57e8a9651f6a382aac1fb569

SHA1
38d9036e380bb3ed76ecc69b857098ee4b23dac1

SHA256
4d1eba3dc2dc2568f90cee8a057603dce7b80b30b64648d0949d51b0b3b55b7c

SHA512
ac47b52e42239f90f91f9d5700ff1da99d254a7ce5975208767b293b82fe6106a9fb05338e3e04fd44186c5d5e79e7bf820afc02fdfb133d95785827b74641e2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
6e9883faa116ed217e25fac8f8535e93

SHA1
20aaa73d6c6c4fe3d3f1faca00663a46bc3f421a

SHA256
844972073a52f20d5ce924dc39886259dafa04932b8e258784e1d7d7f0abef7c

SHA512
3e21d0c509f35495371a69689ce23bdbeefe2fb7a7672c1eadcbbc2589d3ef6350d6a053110839c842f1f53a0eb730a20d210bdb0b987c9ce093fcc3a74d776b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
d68136343a4209b1bedf1a70ef5c266a

SHA1
9226d868330410d13eccecbaf278e96cd556fcfe

SHA256
eec13a7c44b46d485e7d9ad731c9c1b06b1c21011ce682ec5b718e699d48de4f

SHA512
42910325dd808886dd9862e648355698523afb8a1244c6223525f97a9b0f21e0ed8d992f12d6c7370794f1d9bba9635466a1fd3ac2e9d3656c88df87218a4416

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
b4826c82c683b0487f91a920cfbd1a13

SHA1
5a4b0b5e2639fd9634d9a75d7c0da5e043fb5553

SHA256
c97cf3d48a427402a3339c3532fc4805e736dd26c774c8923ade1ced9bf3e0ac

SHA512
14f41aede4e6f729ee81c329bafc85af3bdca2e85ead7ad995f7c3ef6f58dd98ca731d0c13fdbe995ba8c4f0bcb0daf8eb56a82290818805ade65ad82f3ed602

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
40e2149915af99a3d73679e6f845f090

SHA1
c3cebbea92649204c8177559541816108f97ef0b

SHA256
08edeeb241f313634dad703abfd9b309546ef8f1a7932830df9eb4eab887994e

SHA512
944cf2bb88308a953b5a372334b109518fea475a351f54f9b73e3da30a2372796d9ad16d841dbc9b7e16e534a1984a3f63bbb0572b7f4850d6b3513d1dfade3f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
23e28d2e4a7411b1713b37d2113ac6cd

SHA1
2b375a75a7f06d21913f34ad0c2d74d5e62d47cb

SHA256
74876e3b22caa9dbcdf56127c2b363697bcb74e0e74bc05dfc4a398f92ae9781

SHA512
5d4cc9aa1e024638140f9937da1c823b2344c17f1d64e7c238330701f89e676ef5657c13ac86bbaf75e73ae48ce94e9fddfdb83cd7a523b436b330aeb4fcc2c7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
65118e4ab89648e3bc46e3024b64b718

SHA1
f5d93111fdc1db85e3b67c9e9a28709dd25891e6

SHA256
d2c56ceb3278c2ae9a264f5167d881b6e6a362dcbc7a419dce80c61d638d0e13

SHA512
8e7cc0ace043de1966eba2cd962a03f863500f1685fe09fb21cfd2cd0c77f6671a7149d441782d76f29d2d6ea4b1e88924f75b90891317173484aa65e5aa29c0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
090b8d45cb5cb609950602c0dae3f6fc

SHA1
adc83e37f07566300d4650da51e8b08fe8b85581

SHA256
18a267e2784b2a9fe86f2754cfd676bd2a87c2a37e9a4726e1ef90064c43700c

SHA512
72f2b38d8e45d1fbe3f66afa513346f087de9013b2687c1a2e20cb6bc1cd12973bfae79c8f904afe9742f654d6dd030125a435e639bc61710840346f060b33df

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
9b33d195f511f2017e5a9c0aee29a804

SHA1
a8ea92a36f2deff2d50f275efee315f564fcf34f

SHA256
f7dc0574eae5726cfd1f74853187df43dbc9407278364386bd4592c3a863eb85

SHA512
36dfef17339e09bfbf19177a2a83582d70d6727d17647922e0db263e19c9229fb4ddc24e3e1af9c4579c992f27c4f462b0fdbaa7b85a1705717dcf813dfd21bd

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
6fdc18449f9dad98ce34f594db409a2d

SHA1
8bef5855d91faa0688e53ca605778138b6857351

SHA256
0a2944220b4f831189b78021e235c33dc5163cd0c54aba73d2eefa6394e063a8

SHA512
1e914a916cd11c4e5f0b949dde9be779ac50aaf278be5c2f3d774d25e974596820d1c657b2118bdf1ab84dc76976be670d19e510ded212c0510a5c05feb7201c

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
fd55aba7289c4a5c1a5e09ead721344a

SHA1
1ad5038fa5ee1ba4f3541d3b5f3ee9c839ea74ef

SHA256
712b53a70c9bf5c09acf92fd4cd70e52c356676237b39db93d39e976b1cf8e50

SHA512
0f3f3e2364ea1092606370ed95d19c9ab568504ed868c35c1667700b8caa3af15cef71bb528194f95713ae3ecef564085410274af4484512ddfd8ebd78971a6e

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
2be8b86cf9ba914346b8a39006c5b7de

SHA1
2feebfe3108c98af7be9cba4aa5b7047bfbba279

SHA256
d3ddb8dc4cadac1139fd4767b7babbbb03761bb6a60dd517c6191e1ead978bd4

SHA512
3b84fa696847288e092045cdb72b1abc60d592cf6a4e98ab02482c888aa856fa20b4df02c597d7583aec7a47122c0d1482cf74fb65c48505506e39f63c065384

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
b791c79cebef3569ac201e28d5b677a4

SHA1
e0d7705d217b10942bc520604e0b9c377b8fac20

SHA256
08e73d1cb00ef0e73d89bccb7a03f9e340527d5378527927fa723ec591e576e0

SHA512
1cfef4c61769a728b30058cf3992bd8119c8591feff9e1cae7db090237b54dd752b6c271cf96864d774c56b66e76eee60f9c1680d8056ed184dd10562b9bfcf6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads