aeccddc1c218b341c0e861af48b6cb19798ea9747e04a306e9383304dba035bc

Analysis

max time kernel
144s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
Size

175KB
MD5

5c163ae67a1ca838fed2a2b66048db06
SHA1

312b2a1e7c0e2633018b88b0f400e37517b91c15
SHA256

aeccddc1c218b341c0e861af48b6cb19798ea9747e04a306e9383304dba035bc
SHA512

ec4452d42bd7df850426dd7dd1290e37cb867de7140010e2b2d673ab170964df8ee965fb28c1b81ca194be9dfaf6d80d43dbd2214f71438469d91826ab36d537
SSDEEP

1536:eODQD3wWg8bBJda0+563xKBB2YoQ+K+eeNEGDYAu0u9KpuJcyJdJnlOtw0J:lQbt+5+Y5+teIEGDYATu9XPnlmw0J

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2263) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YF6kL11GD7aVr16.exe"	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winrm\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisvirtualbus.inf_amd64_e8d548ad6f0a613a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\I386\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\040c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsinfrastructure.inf_amd64_1ef682cfd6fc7d1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis1u.inf_amd64_64035dd8a7571ba7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DriverStore\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_memory.inf_amd64_6fa9664593233d6e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_8bc1bda6cf47380c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\iSCSI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sdfrd.inf_amd64_25779da6eca4810a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vca.inf_amd64_6bbc643de0df118d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbsb.inf_amd64_0e44beb9cebe5a1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmomrn3.inf_amd64_c2314613ba3f3585\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_2176cc45624119a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0007\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sv-SE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdm5674a.inf_amd64_ec8de8952888a618\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmke.inf_amd64_b83f029888180def\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic_heartbeat.inf_amd64_ad33c2d1c7a3023e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\F12\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmwhql0.inf_amd64_db80a6e1be3a2d08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic_shutdown.inf_amd64_bce6891915e70bbf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\LogFiles\Scm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgatew.inf_amd64_7e6c377859cfcb7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrgl.inf_amd64_19bd1d6c2b642b6f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_f83138380f5fb6ab\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0019\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\audioendpoint.inf_amd64_4fc4a632c1490033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wmiacpi.inf_amd64_4ab67656039b026b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl004.inf_amd64_189d0189716edeb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcardreader.inf_amd64_33a0db63c0afb351\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmot64.inf_amd64_2afbe7d3ad20f42a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmti.inf_amd64_bcde2913bb6ccf3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_a7412a554c9bc1fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Licenses\neutral\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\uk-UA\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcxhv6.inf_amd64_f1a7a2fbd6554d60\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcodex.inf_amd64_f5594a2af66d11ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fiiknaacfiiknncf.bmp"	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-125.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-250.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-64_altform-unplated_contrast-black.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2.gif	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\PREVIEW.GIF	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare150x150Logo.scale-125_contrast-black.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\FaceReco_Illustration_SM.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FR_Back_Landscape_Med_1920x1080.jpg	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-400.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\LargeTile.scale-100.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteLargeTile.scale-150.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-80_altform-lightunplated.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil_2x.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-colorize.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-30.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-125_contrast-white.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\SmallTile.scale-125.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_gameDVR.targetsize-48.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSmallTile.scale-200.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-125_contrast-black.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\1px.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageLargeTile.scale-150.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-200_contrast-white.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailLargeTile.scale-100.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\xbox_live_logo_black.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\91.jpg	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MediumTile.scale-125_contrast-white.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-24_altform-lightunplated.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_contrast-high.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-200.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ja-jp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-200_contrast-white.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Dark\IsoRight.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-40_altform-lightunplated.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in-2x.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-150.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.scale-100.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-400.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\share_icons.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Preview.scale-200_layoutdir-LTR.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteWideTile.scale-150.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_contrast-white.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001043b_31bf3856ad364e35_10.0.19041.1_none_560c114de82e87f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ity-netlogon-netapi_31bf3856ad364e35_10.0.19041.1_none_8926f863f55772dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-p..g-printticket-win32_31bf3856ad364e35_10.0.19041.746_none_fba89dce325efce1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..roxy-main.resources_31bf3856ad364e35_10.0.19041.1_it-it_c4be5e977f92da93\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_f12_context_chartzoom_in_disabled.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..clientext.resources_31bf3856ad364e35_10.0.19041.1_es-es_1bffa0298d6181d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..component.resources_31bf3856ad364e35_10.0.19041.1_en-us_376c64b4590469ef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars37.scale-200.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\logo.contrast-black_scale-100.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-lmprofile_31bf3856ad364e35_10.0.19041.1_none_08a5e5282a943190\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..oundtransfer-common_31bf3856ad364e35_10.0.19041.746_none_81ab93cbe6fbb519\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..terdriver.resources_31bf3856ad364e35_10.0.19041.1_en-us_80342690e638a891\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-media-mp3acm_31bf3856ad364e35_10.0.19041.1_none_2c1ae297fc64ec84\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-simcfg_31bf3856ad364e35_10.0.19041.1_none_74d0cf760b6b1863\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_storfwupdate.inf_31bf3856ad364e35_10.0.19041.1_none_f9ee98fddb5b4229\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b...appxmain.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_aeeb306313eb7ca7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\INF\PERFLIB\0407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\view\common-footer-template.html	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..ents-main.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_26a69ad6e5baef02\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-securestartup-core_31bf3856ad364e35_10.0.19041.1237_none_b3f20c1adbb3de92\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-shell32.resources_31bf3856ad364e35_10.0.19041.1_it-it_9c459d47426417f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..-comm-dll.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_acc5ea73b30f776e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_windows-staterepository_31bf3856ad364e35_10.0.19041.264_none_e4e6a1265c59e73b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.928_none_31fd477afc7b8278\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rascmdial_31bf3856ad364e35_10.0.19041.1266_none_486ceed20a8a6c19\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sfc_31bf3856ad364e35_10.0.19041.546_none_852f0a4cbb00efef\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-syncsettings.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5358e27702980c8d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-eapttlsext_31bf3856ad364e35_10.0.19041.746_none_909b44288e02cd38\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mapcontrol-core_31bf3856ad364e35_10.0.19041.746_none_1cbe718dfde96ac7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..iners-ccg.resources_31bf3856ad364e35_10.0.19041.844_en-us_17b389761535971d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_b30156e32b833fb0\IndirectMask.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-netevent_31bf3856ad364e35_10.0.19041.1_none_1037660509ec56ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ctivescan.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_fa948ed1f85cd772\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..atecontract-desktop_31bf3856ad364e35_10.0.19041.746_none_737b1140e20a0556\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_wcf-system.runtime.serialization_b03f5f7f11d50a3a_10.0.19041.1_none_c8294510b1b4c5d7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-attrib.resources_31bf3856ad364e35_10.0.19041.1_it-it_23739767500eb661\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-autoplay.resources_31bf3856ad364e35_10.0.19041.1_en-us_4c8a94eecbd82c53\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-ie-diagnosticshubis_31bf3856ad364e35_11.0.19041.1_none_9db2fd18131e032c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-ie-memoryanalyzer_31bf3856ad364e35_11.0.19041.746_none_8889db5dc377e286\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\repost.htm	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_c_camera.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_4bfe2564e031b4e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..n-comrepl.resources_31bf3856ad364e35_10.0.19041.1_de-de_876dbab28acc30b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-directx-direct3d9on12_31bf3856ad364e35_10.0.19041.1081_none_529944ee4cfb59bd\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_datasvcutil.resources_b77a5c561934e089_4.0.15805.0_de-de_fe7b77622c08a1e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars34.scale-200.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz_31bf3856ad364e35_10.0.19041.610_none_296d158b14423048\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..ellcore-cellularapi_31bf3856ad364e35_10.0.19041.1_none_a80387c78a374ec6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-radar-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_0572b8dd1e3702c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..trolpoint.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_3d2338b025cbef70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..onmanager.resources_31bf3856ad364e35_10.0.19041.1_it-it_1f2da483a65f077c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.powershel..hicalhost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_44906b64662b4121\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1_hu-hu_a68f88f6543bf18e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_cht4sx64.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_b80e21aea730bb15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobeoutro-main.html	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4eeff3a16fc24f47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-refs.resources_31bf3856ad364e35_10.0.19041.1_en-us_68c01a3fbb588324\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.19041.1202_none_33e8c5dac6801a49\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wlanpref.resources_31bf3856ad364e35_10.0.19041.1_de-de_01cc256f97efbe04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\StoreLogo.scale-100.png	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GYSRCXWMFRFSUPU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YF6kL11GD7aVr16.exe"	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GYSRCXWMFRFSUPU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YF6kL11GD7aVr16.exe,0"	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GYSRCXWMFRFSUPU\shell\open\command	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GYSRCXWMFRFSUPU\shell\open	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GYSRCXWMFRFSUPU\shell	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "GYSRCXWMFRFSUPU"	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GYSRCXWMFRFSUPU	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GYSRCXWMFRFSUPU\ = "CRYPTED!"	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GYSRCXWMFRFSUPU\DefaultIcon	5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c163ae67a1ca838fed2a2b66048db06_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
34b19119d3f299c07cb08107d09fcf5f

SHA1
4649c97665388803e1537f4fce164d6c081e2b30

SHA256
03f4f7adb543d551003cb080a9872955653687fb8e6b251fd97af8f4bca6faed

SHA512
df0d1fca038c3146a5d7f9b4e1f07788be3964da6864a71e5562c15db22a39f250fbc4ce01a185f812168f4b3dc83867a2e0f5cf2ced0ce16fb3ce1c35ced1c1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
1d5dec5a1e3bbadb0ca5b2bbe4e7f860

SHA1
f68e98e8d32deff0d6ff2bf516a8cdd8543893e8

SHA256
b7e74c4c5b4ca431ab5ea876d2b925e8ba73a2a39753217d0821531daad5f56a

SHA512
e6d7588efbc239f1f9a700078e0a79845a41c449c49ac805ec53c984b21d623d959be2a79565515334ec70038c20400fdebeb2c5223ad9f448154c12e3becd2e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
8158b5cbacedcc9f5e15da4b4d168c35

SHA1
39f27757b5a0adc1847249f55c85fedbb84e1bd2

SHA256
b61b25281da0aa9e43a9f18f86d05594490300181ec45672c481005aef12b81c

SHA512
3444ea6c992126e56bd41b5b2f6b6a6c431e282282c530775d608372f86e94e6e7072b677ea452421af9c56c05316d0945abd038fd1b3f0954fe821388fe7987

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
bc4859b5a9ca0ba4940102073e33d4c9

SHA1
9b1148bc8e76692f7f1c127ba8cd0468aac58906

SHA256
3b77fca63eba23e85f8d60562b4f18eb2eaff53b7c8fa33b1c4ce4988a4cc358

SHA512
764d8f1e72dbda70a41b820b7941a5a271eed0f587d7c552862618264f7165d0e390a4112817d3fc93c8150c6eb5ad62eae81af385182e753894dbee9941e80d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
0be0e64c5aef31ca76d71592cd0faf1f

SHA1
3a4cd0d1e98bf3d0f9d4d97c344b68a0cc3d482a

SHA256
d9d2bcf07226cb99c01a95169fbe3e439b837e9dae99c82e3a71b1b3f8bbbde3

SHA512
343644eac4aa58bfc3c192eb112b9e4f1548e1f4874574e4b3358f6bcfb2479a5a11f08a58da31864bac6d6c0ed7b99277cc33d8510d1ae23a56919fb9062b88

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
c9fc481f62fff02dabf3684f89c67dd2

SHA1
1a64b362ef05282568477f37357acf3b6ecb82da

SHA256
e39170a3f54145d1aed32e643d159bcbf087c8fe8d16ff003f61301860ea5d8b

SHA512
0c2c664e341585da3a7a50df5ffc08c22aa3c27027135eba8da778600cfeeafbdac69bd54c4a382ff9118674958599169a95f55a0d298fb8c983d6e2f6f1ef94

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
ef500d934de9dbcfdb1211c4eeca508b

SHA1
ad490bf563e9889d8706b81657a89e2be43bf072

SHA256
0b475e25303ac052134fe5c4938b88f9d0b698f86c42b1a4284baaf361a2fc67

SHA512
ea37d547e6038e454d524a587b754c43dbed9ed385cd1287c43de8819b20580ae41d7f45279f3e062a51c779d2bdf39193af61d86874304f723180a0fc9886bd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
da493e39d37768fe8e3efa925ee3da66

SHA1
4134379a186ec53f7cd8008973edb79248b807c4

SHA256
c7772458a12875c4ce250019e1978a3dc6bbd7c9514967189bf17f688ce62619

SHA512
3853f635f860257aa3451cc4056b0a27e10a5dc5ff8b358b280b501d2088e3253cf063a6f3e28f84880075d4a4ba4db7890eb1b2e57c3fee356259f1fafbbd05

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
5f9e805bea84775aec06ceebc880fe5d

SHA1
e68d7a1ae5b860bbc7b65ba8b3dfb873de7ec038

SHA256
d30fe93d7f0d30675e81237815b7e465da3097c3b5881db0b60643ef8a56c7f2

SHA512
a283c27db39af1c760ce389d920180990478bac09837e71d65e6faa9c1c0e0611a7f7dd0af6085e501645904d3afdb05dd44a31506dc4383c37afb3e80055b10

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
4c29358d05d631143b5819ab055ccb63

SHA1
0e66d683a6e8af230d3284c26779cea339670073

SHA256
279556fe6e258a30389a5145a6a4dbf92c3e66239dd0af0fea28dac64a172fd8

SHA512
8a5bb102cf4373a68d41c1e7c88aea50db6b041cb0688ff7ee7d8a8e88f786a5f0a6f49ffeac9bd18217b99ab3d7c2dc4e2d5b9e1f59d739407c361d882bb174

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
35fa5e6ffe9c7df8334a27cf9474a279

SHA1
536a9a1ff22d1aea78be412483863421019ad060

SHA256
d5709c081532f63adaf35a92460701231f97f1ea680de866d5c1586ade8aeca4

SHA512
ade433d738cefaabf19609b2b496586cf23644a1d84c697d5daea73368459fc681d8c94297b7d4dddca03ea85e39e876891ef310e19af0b171247433589609de

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
5daec3d3592b8ce19ddfefdd2635eb5e

SHA1
b51278fa0073ca89b4f554d113ddd08c81224629

SHA256
0297cfdc53eb4bd86fa6b009cf697d5bdf12b9dbcccb2999f89aca561dacb685

SHA512
5e8883002a62c4dd2f8924cdb6054ccda68b7033f6bc2e94c8b13ccc424e8f63c79785a05675eecb74594aeb5e9ad64f65c8068980a69687f11763444b2805f1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
30f672f81938389f9f7b9643760e0213

SHA1
e559bfe998c73fd22e8bc11706cec02945856a17

SHA256
20c6ed4d4cf544f6e2575a2395b9b34428d3ddf32e82a6e2b69aa1739d6d039c

SHA512
5aa58542f664afff44548ba3fbb8923dd670f6c495110d15c1bc7460605642fafa769e47ae74ccfa61a52586a5cd9b3875d29b66459b6ffe7ff0a5ef55e09595

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
a8dcc9676eac56a2b110fe8baa97ebdd

SHA1
303b5a36581ce763e39336bf7b091ada7e855f99

SHA256
2704ab4bc0f0c7a3bedaa199a1c66c4b8faf745171f92e7216c5a1c296bcd77d

SHA512
8cb3161931b5d8667d6b98c7475869707b65d612d554d394c32ab73e0da7621ce85bb6d9d0199908721b6516cdf39bd509002652caec6bf7995a143917b7f603

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
dca85f78d0cda465d4f3c40ee2965082

SHA1
74337f17c77c4f3d3f54f74df0c2c60e97e6716b

SHA256
9e6faf7929af287ad4172b7586a1b50ad26ca956ea4b0ee6e2ed6b90c9e8a4c9

SHA512
f223ac119c41285e65be344de901e4293512dd526f342442ecef922e8953281be8bd9206f73785d71b1cd9638878cce5d7ad20439e5a7fd3031e952ae6736900

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
c029d961dac2e1bfa40d85d100032a63

SHA1
2c512a18075ca8b895487cc667ea80540f01b95c

SHA256
ec86bd307e52d8dbec3724e81316ce1126032c41b54b6ad08bb70631fddb6c9d

SHA512
508f69901322783ed1ceed92aeeccb22f7ce103be5fd101ec939b5e7d9a45a1c27d12ae7cb322fb6a7fef331a9508977de616af9b0d35c302cfb84012c1bd97e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
2b6d9e27e84001b4265147bf69962d83

SHA1
5aa5cdd78441df33839dbfd3bc4d98a25f110b86

SHA256
e5ea6710a0f0e85de6210e9a5bc1d9b3989672cd7ea902af2fe9d78b4f4d18e1

SHA512
df05712f2c0d3e22e8c454619be4d0b3a40aa8580629fcb1eeb82038581c6bea5995d9c8eee10a49a5807717cf5e85cf356afc31d5c14e575de39dd5326c82d4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
9551f047a8bca628f57325833f9a9e86

SHA1
6918a56425fc62629a92ca019c5a92055bd1616f

SHA256
8666ecec7d8efd7624de9c2d099a39ac8475ba16806da13579bee04960744a29

SHA512
263aecaabd232a33d874de9e0c03ab04e75a2a4eb89d42d0d76b23d5752d4f38ac280d88ea58768533005defe17aaef0746364115748f63a19a77e653d505d7d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
6389d388a99d36f5425286885f88cf0c

SHA1
19cb2d98c2e63d49905643afbc0c541ae7a91930

SHA256
a29a89e4b65b17f43bacfeb9601eaeab7880c211152581f9d2369f89055a60b6

SHA512
7f0b099acf608d708326c819126a0987dd2be327c3050520ae29a9873af271c00d058462dfbc2f7dcd1fe18071b61c51e410a5293ee2c06567486cc796309b25

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
548e6fc46e84932b55fe470bbf9c085e

SHA1
26eccfd108fbe9a6112cf2a1887e3f8b4b5686d8

SHA256
d5c390b6763c3139efb2cea10325694d4af51b3f038118b1f7b8656aadded48a

SHA512
136cfe073bb4c6e0a2e44f673c4d6d085d4dac1caf16ec68fedc7acfa22823443d843bce5f469b9d467dc819218403fdb980f3db5ac70ec021a61ed4465b9b56

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
db1aa8ed8968a9ca92ec55b07bd2f58f

SHA1
11f70e4aedc753f0f9a6e15d025b39aa036ececf

SHA256
4129a3bcb8ce6bea4d8523a4ca55a729f757a1f2d841431275c68d19c855679c

SHA512
a5f6fc91d2750e88119d9ea1e4b32a8d8f909731a43f5e247f7c208c4638ec2634c5bd992e691ead77693f764f6428b2f0a25fde96dac100c1df0ad2358ef612

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
eefdf8c517907e756737f3c881fc7266

SHA1
703ba812a35f1dd5a6212d400762fb986f2e006e

SHA256
6d742c99a2906bfc112c00e1039818dd3f5d5a29187b2b5aef8e3fca7525fa80

SHA512
d75740140b18f1422782bab6d8980ff26024bcf252f1d9f8350e29ea0925a8d0c8ad9305223c16e0d4af500eb3e1dcc57752480c4fde10d68cb0825fe0400bdd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
bed6625a1664547b976b29954896a528

SHA1
27f14fac3f3f37da227c74527d99088e2f123ac9

SHA256
81607e26fe1899028eab54e91dc408df71824fca7b7838467ebc0dadc8a71750

SHA512
24052d157b9897f0e92313fb009b194316963c9f7dd386291bceb111d3b536c00cd2baea365557a53320df8f87503ceb16065e38beea8ae3d92345c3f741f489

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
ad58d4d0b27bdcebc4c004cde6a7df05

SHA1
2fea2f4859b6df87c9ca73aa42ab4cfe2de2c394

SHA256
40f63d8b3f611fd10c9b16a7e64814cd953328ad655c7f9c7d071367fad8c20f

SHA512
456426fdc5a71d611348267fa5686d344b37e8e22af013b5ecce668459b37d7b7e33fe5fa4cf306f2d124087e3727e90743c4a944c7a44176dfd9ba7c0a5d86c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
444afa4b6a55e61ea9e75e38885339e4

SHA1
b003c9981d77d46cec6252735fead22509467780

SHA256
301b9991f269d84303cbf1c77eb89044bd9c6330eabbfa405faae95a81350a4f

SHA512
d653971c09cabd9c406ace15795cc305aedf0a1efde36271f2817a7920df61860971395324ebc47510b5dc44ada4df4786334989e1d5b632ecd9c97f6cb677ba

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
6b8b74dd9fe7457223b047a4728ee9e4

SHA1
0c71ea05f5248cdd0580b370c6b4211a24c6f40c

SHA256
26ce86059177ae9bf8cad994546e07d720c533f0b47c6f2cf9f05561699e3581

SHA512
a0fa1a2c6071b045844bca696fa2aef260c3c984b3f3baaa7b597915ae8bf508c67379fa4979f2ad29166814c6a1423d425c23408ac361feed567c898ced7e13

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
2e0834b0de9cfcd6bf2de1029fa2da2e

SHA1
11dd3a2e054335a4f288e6cb273bba0b84b9aecb

SHA256
a4efa71b057274b2eae416573a5e64740628c0792c7cae5d1e03b4daca542367

SHA512
7f9f53621dadc45c93d2684f878ee935573c02ed6e0eeab471261390b80e0fff5198743296b6bccb541fa57f56c461bf9a4008714c0ccc0cb9b209f3bbf16de5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
a6c47df1870521ed612407fc9bd00a04

SHA1
343c459506c1f95b652d34b8b228f8f0ea922ccf

SHA256
7c4c671e6baf83dcac2d2ec97a4be93e963ebd6c170ad4741feda33179ee3d41

SHA512
850d604715af85d8bc3f0e652754a33d62e94c985a5a31100bdba8d72bdfa5d5e407995ce39d622b9c31d31d0b4af780dc8ec9423c8da8b5cb4ceae0f62d85b2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
05941ddcb133a9f6df4549178f890c3a

SHA1
c24232f930feee58ca66ee4bcfde116c8c2b3838

SHA256
e7b4f12bae2c4c16c951d409d09706ba03fa56fe327725a8573ef750484d162a

SHA512
de58b897803984dbe14843073bb742b724af33de5db70e5ef4abef179d69070fa6a6fd811e57e68d307b4dc31112756182b01ce7294e2cd2124fb2c93c4490eb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
beb3ffb1744791d4a4d6e47f185477ec

SHA1
eda7aaf3ce957cd0fceb91702c5ad41e75622d95

SHA256
2f6e65889c1769515fc560da3b364f62474ecb65c9aaa90f14d55a88087a4557

SHA512
e790c524d5c0c94a002d4103b2bb08f27edb8034e458b6cb9865a9d2877e00e10dabad04f542e1cbf9ab121aaa65cc4ca342ad4d36cda27de95e8841af4df78f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
fb17b704f6137116bbd627c8fe3a9484

SHA1
6d98d8279f829cc3bdaca2f42bc4b753946c4b00

SHA256
ed47ef9a4e4bd672f3f7f125da6905a0995120dea377ce024de3a1224920c957

SHA512
209aa9e73e9254b41d0a23ab4851dca47a1114a42f40aa0310dae03013670ba34650d07bd90831e352cc896b23003aaa582909de0bbffcaa5ebc540c8fe08caf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
8d241cb5bc10895f1d4234bdd53f2970

SHA1
b60208eb2a5b472ab46fbbe2e89938e8cc9fc5cc

SHA256
85eb61dfcb2fb6044236453b33342ef7b8675210a51547f635c475e9467744e5

SHA512
c37c7313da7dc30348f8667becd39c7e197242a6b551d7a6a67fa5f1a3a574f315692714c4e4e186d98813eb351fde4c071614685420b564334da75cf636535f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
1745f8009e168f09aa9536c800622112

SHA1
03785d0e8240046fba8f48f85592a96d93fc679a

SHA256
affcfa6c4d2a8c4f96bc0879a18fea0d8bcfa3e6f7d62666ec6fc57388924336

SHA512
614cf20a187e801c0635a79e533c5d5d42406f60e77cab090c8d11136c642663f3efd99c42f3995bb3f7e1032c5ba62d1190223645586976ca4c2e912da1eb55

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
1bca2d4c2042f8459b1113e21b2992fd

SHA1
8c40c29d0e9b0b49715f4c45482716ca6f36234a

SHA256
cec797ee311e29a17fe9767608dfe0da180d2eaeb0a7b961e8a82dfa76b9a6aa

SHA512
e88b64b014e30fd1e4fb6be23cfbd1a4cff266957ae2e2f33aa927f350f97c17bafb7840dae14868c1bc641f62e71b66ccbb944e2eebdee76c62581d7bce20b5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
7ecb35897e14b639b20d6e736b4f8bde

SHA1
c3d45ad91094720be88650d886fa885c28494a0a

SHA256
cd5d1ab67f401b291e8e7e61191d6a6107afe5e3dec51ac206146094ce80f7cc

SHA512
de28ae2811421c2f1ceb24f284fb496e05e80acc7a563b16ec663de4314a8ec23e034fb311e9acea6bb1c4f6250b10a07d700cab027389a4da66924ef1c73b36

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
df8168f6862e6af9eb5d19e111239f2f

SHA1
e01071234151cc719e8b71c43d6010e32d469d3a

SHA256
92ccc954101d91456ae0f62f8cbf207d34608c03bbebf065d48448d90a8ae1f2

SHA512
a6c37c9bc2d84cb928747aa3a328c871d2fe81c673ea755fe4f157369be0b7be2d83b5f3c3fca71399b8f3cf7f809a9b18465502110adc2d169687c4faabd644

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
44090f38f824b76920482f60d0e098a7

SHA1
e32c351ae8ac388de67a1f35b45aaa0e135fbb56

SHA256
f0db15e082f4204069b74be8e25661799cc2a7c1aa1e18cc443d4cb8c7c65476

SHA512
ee52206fd54b37e8a64990560a3633f98515885ba2a53a58a95bdcd14ede37fa5379100244ae21659867f267fed97826541fcc9c71a3fe5108e2b2860eb00c08

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
149b00ef7fb252b77eb927c243011022

SHA1
742b4074232761caf8978a6952dce23714fdc4af

SHA256
87066941af01161da5de75a5cc0e1e19c04ca1ffe88e9252df277d1668e3a77c

SHA512
35d94915410fc022091f8c2fe81cca91fe25f423b372065d30fe83316e578477e0ec0285e77d730162c2aa269f0fba9fc7c805fab6735c2409199d68ee062a06

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
553B

MD5
61503d650ceea0789ac070f9f74d7d14

SHA1
743fe84eda55e3000fa28d8ea496288299aad57d

SHA256
aceb3adebe48b13b6dd075e56651e041e75e15bb657b16e37768e5f151c83519

SHA512
65b6e279616e051709f9cd244fb8172ac31ec955246c7b3da8459ef050ea7f9ef6329405853476ad85ae8b8456edcee9d6aca0032b55860eba393c36660843d5

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
5a445d93723c2062b61510a1474ca064

SHA1
d134ff5d0d353e9848e089fb07d2dc5c6bbbae31

SHA256
0baf1d5bbbc7b62b2a5d5ea1d5441ad747b20ce08997208f298f1bb2bd0fceab

SHA512
71ffc6d88b2e56d6981bbdd9fe8aa6af7242d08523907e34784c682e31d0447f232dc56d091390e549bfe13c3b0a108b83bad283c33d89b80f6176bdb42fef1b

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
0ca2a4a0d75f6895b170e63b3301278c

SHA1
b0e079f5fc7ec8cef70cbd1820469c63865bdeca

SHA256
6eadf7903ed26cdf59a387e484691130e2e05849be2e3326b3b34b2e7a622bd0

SHA512
8aac0e891314c2ea4df4ea7e4188d8c4d6dd1ced9b98cc7400b2ff60404dfc610cc7e871d55edafa214b4e34e7ff8619ff783224f38ab2bd2bfc6df9c5ba1d7d

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
b44df28991f5564424f7b68639030a2d

SHA1
0f2a20c531b486d0d092b3e2913585a614816042

SHA256
f70ade4a02dc52009a231d1856d92a5971b91e3e062d7b1380600182e83189af

SHA512
a6bbb0e701dd2f32f957a37f3dc2157eb3bc47281acce775d6b1ed259419b9841c61c63cbfed5e772961d807aa26514c29e9aa3a9de86229fa1328188bed2cf0

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
035ee2d82a94c0ef61aab20b170a6aff

SHA1
e0de2078fcdc5d2c41839b4468864f7cc367fd45

SHA256
ed8dcbf01de6f4857daafd8b2dab7899b8f98b7b1db18ef972f69dbe93f94fbb

SHA512
f883f7e2bfcf8ca7383083706e576134ccd53255cdcbbda6186d334a1d17187202f01f71aa7bf2311ccf981f353a3061891c5fab3d0bbc0ba84149b32b4772d6

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
a0936b4a9504876c2d593e49d87e01ea

SHA1
2880b7042d2afd02455bf8ca7ba70f13f96a82eb

SHA256
960fef517ccfb92c820fa35006fb8bef3e8dc552aeb9ac370d8438a96d719c94

SHA512
44db019201149050e14d995cf063a2c9741339359acd3dc835c889d154cc47c3b699fd56eb3c047517d6510ea449763870e60c77b91901133c43148d6c4f7d61

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
a5a768e37e6c2ba8caff116a0d6f7bef

SHA1
a68c4ef1cfc7cca18fee1652c02de65ef740e6b2

SHA256
7b9127b093f0ee4309db9eb269d789f2e7ebc04544612ea12ec9c13c065474ad

SHA512
219fe303547354b94c50fde0ae3233e56005184246dba2486decb54eec9acbfcff02f95bd78645b38b001e480bfbe931d20623a45276665e2ad3d0e7a755d6a4

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
5147813f8a1ebf881105f5976f84c4e8

SHA1
f8b8d3609a9cdf0876f64d5e7252d80c5101896a

SHA256
bc4ac69e18a8e4fcefdfa26705de0c5f5fb72fa49bf0e37722937157d547bc95

SHA512
86a34a4332e00213bab71b663094b5ac18b55c88a0da268c7c79c8e1a3a7276bf0c89e4ba909e6f86d386bf656e891c383a4732156d42787b5e706d5c0b71650

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
956b8f59f86de0a8f9a52c8267ce130f

SHA1
6436c250c2c5ba053fe9d8cd962cd3e704a524ed

SHA256
ab2e4d9c65afe532edd1e14b90f07d5e4749a63d19a876d1bde9ae8898446d55

SHA512
1d02534bdbff00140e7d0fa43095dff7decd3c195c5bb09b692749dd1b623e90722beda537dde3783ff0e0543d6b0ad525db80bd0cc00b8b482ea0b525e8f0ae

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
3976affaa63d861f13cdb4dc4f03c9cd

SHA1
232407eebec37815affa561d749c2dc9334643f2

SHA256
156468d6614ccb333a0a7932363999a8fcf924158442b626c7f14f1d4967eb4b

SHA512
d37c473bfa143f1ffe56f19c3b35d32fda1958b0e5ea10cdb259db5fe9ef114d0292e194f759aab533c768cd0bd06f12963fe5df5f824ba3311056d686852072

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
b1dfffef45c1d9a4849d6b99a1a2d2b0

SHA1
a2c782373f685f40322639bced5e89091ef7758c

SHA256
184c9849b7299f488376e2cc9249696ab792e14604b56d5951785467f0a9d60f

SHA512
17fd5be162178da597edd5d9c43bbf7be33c99cdb0afd557e6f27c484fd5da8e20937c241e876d1cb1d62eb94f7a13be786f5d007de1331dd62a9777c76e89de

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
56417c84924b83e2061f758eff48938e

SHA1
bab0ff3f86a4694883480f63f5bdf6e506722644

SHA256
9747cdd764cc964b8821a390da7b8540b88f96c86e8044beec56ee35124873a7

SHA512
acbc55daa67fb356af77e1c60c908013e9e56d9e4c8171b599267a64516a9707934f14048c137a3f0e0e50330b7b4789245f6946773e301c8da207579b877df1

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
a20b75d3e63651d773c4ca4d56aac708

SHA1
f2dff07c56880d966e192d0c76eda71e3cca9632

SHA256
35e505f5fbde498108d3d5b5179598988555951f7a71372dc98f5b23789fe130

SHA512
5ae578611490be846e181e9972222a3846f37a2d661aae44f581ca88174e7b5e02b1d983fcc4be38c46280430d12a9eb8b2ec7f50e8b3db2efe123fd8db1e335

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
206fb0c815f4bd1b1a87b12868e7afb6

SHA1
4398922cd4045c8bacbcd12d02e83f456e650a61

SHA256
35b2f9eaeef41b6f02acb90be11b57cbe1647eac4247bc39c578f1353a9d231a

SHA512
7482740fec9380451214fa7d857c9f3f1e63f146b59cb943bd97430a79c9aa41f146de49e9b415dd0f58a4d2a9edb059f0b3bf5392fc655b2d39a94242d3b898

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
90af81e7f7c9f01d29c5e0e628d3c6d9

SHA1
fff5fea9d44d54d04fdc6be991af8f8196b16dd2

SHA256
13f0acc6c05e2a9c9dd834038f570a9e7896becfda03a96255a37b9d21e31547

SHA512
62be115ed2532b8fc53653e755f180b0d7971737a1a1698ad4b5db5a4f5ec2b6ade706a06376f84397c05a7ecc37a70556ff8d199c0c5e67e0d58dfe5a3bbd97

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
122d66855f4e1e06382f04461d6913bd

SHA1
47765f7f93c78155b973eef3eea15f7e0ed9b10f

SHA256
602eaf9f9747aa3659e8d2586bd2ce9e69d465434e364b6af28ea36b134ab24f

SHA512
8179257225a17b1846eb44b63044f7196f325a7ae4e25a165d8f62f0d7a811499d9816cf6868c20f4c42d20cf6081632f918b72e260154def096ad130bb0fb05

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
cbaa25660df347763970b4e181cbe67c

SHA1
0bab9cd02d8dab34e8895ed6f0b6328160c1b49c

SHA256
2df6db52ae6ae512b89d61c8868b7a5c3bee6b6e8be35ebb2703521eead1c8a1

SHA512
0a218206bdb5085e81a7ebdb804c72bab42a50f5208266091d66728992238b63b87db4bf80c401a53603f6e6396c676d87ef275f4c8224800cf309fc58983461

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
c9e61fcc1af7074e222d9ac6aafc881b

SHA1
1681a352f4768e9405401ab0f7b8d63103bf02f6

SHA256
1d6db041205e47ba2388490426af3fb1ea0ba73941a475a5d16b762a856990b9

SHA512
ee5d3e6e082a13616b4380c596fd011f2c9a70d3540de2fd7037fc63cbd293484c5823c68b9d2ae98b7819df9baf136f35f08c9249235b52172806f901eccf76

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
002578be732842564ff9d07fad9dcb87

SHA1
bcd5ca5666fe89e418ef1030aa8c13fc9aa2d704

SHA256
708fa57772eb174d0186a7fd6369bec29eb6b0ef7a00728cfd2a1f5019621867

SHA512
9e86f8359ddabba9a3d44ea7d4fa6494b205dc01ace3f1f5d2dca1e31b9428b025cd7e716144c6dd63f3d681338a3fbdc3f5fd4d24012d5b19cee31d6d99d0d0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
3c985c8f81f19505a2bcb7b1fadae3ad

SHA1
e61827798f36e9b65d09b92e63ffc299cacd37ec

SHA256
4457566f4e579d95d641360ba32828b12c28f19752928466827bd1ef9d0c8c68

SHA512
ac3a04c37ff6dd12a56a6e1bea00af02205293ce898beb7d62fb86effbb44ad8e33ba54c8db87b0af10752b88091d4304faffd0b203b19399b8fcb073f85eba9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
5f8901d913626b8df4bb6cf784566d88

SHA1
7e542bc9c505d45aedc6cf517ef9803c1684ffb3

SHA256
61e38593cef9f4d6b1d4891a0c5b87c5f8655267f2e4477a2fbfb21016e6eefc

SHA512
029ce7295bf51f0b4d285e44b7730021a4ec1ca3ee170fb7086529216ec7dcc9b2eb7a2540baf579c4fb3d89fcffdd38acfc9041daaa6ff4b167d3988ad0365e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
31b27fc56818ac5857947beccb10a7b0

SHA1
39342cac541b4e2702c126c1cbeec0202a5214fb

SHA256
f240022178a6970239c79defa0e3683afe9f1af0d0484a0887e48532cb53b27b

SHA512
4fde41959c1581c304134a678941f28e3f0730242c45f8cbfbd18a3a1e29df5afba5e5e96078c14457bfaf00ef2f985ca4513d24562f4ede341ce5260a16d9d5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
27a7036a61c2de72f12b82d1a79ddc2b

SHA1
7280c2cf5bea4611c8627410c3d112fa4d2f206c

SHA256
dd361e237e55ef473d2c10032e3c8cb19eb6c92289c96cffadaf5c799ad5c07f

SHA512
d9fbd808628bcd932599cc8c5c9e4a3f3f95e89a6549304e13d123fb5898bcd93c3cac22e75f2c3b9d99650c3d69d03145c4a19773e7e5e6272dc1fc5a803241

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
5c5851556740f04ea09315774b35adfc

SHA1
a42a91328f272d58669f36a37ece175d6661e0ca

SHA256
7ae0d9558e4eb66356a866da173fdcd77eb92f5f83c520596812def8785cb934

SHA512
b71e38433c870bc441190ddb41d4dbab0f6e1485e526922122fd651d19ee9a5aa1de1d0958631ea58cbcb9726efba6e4927cbed053959964eed2da9e16da2a65

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
076d4a2d66d5671cff94b85a0c0e2f36

SHA1
70c55e372a6870ccb512c87e6372a8400231ede0

SHA256
3565eb79e401f32766af00ff13378004cc354aa7e53ba61d7a1c792d2512e759

SHA512
6ec6f4ee711168821510f91b58865cd7b4282b066352f23133e9de142c1e07705001ae54212d3fae58a058fed6ce346a652ed2177a1370387892db058ba14ae5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
28ca6964110e917d722587121bb3a23a

SHA1
bc949087ca95d59fe8e8c60620dbc089e46a18f0

SHA256
2048aae3291f2b034e21e7da74306d194b8188958fa02cbb4d219893c89837de

SHA512
9735feee6176af9d92900b998b34197b00031cb3269f979621803a81d892bcac02ef47cff821eb613c692f9788e67e6c223baf8625fbe5d9db9842fe58dd7b27

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
13877aae455d8f79aab17f1443dab115

SHA1
2ef321ade720cd8c489fab5a34bedfe796b48395

SHA256
96bddbc64e694d192c38b7cad41f447f17aa488564b1e1331334af14438e144b

SHA512
70e6579ae9f4aa62c66555191794fcc1bb84100f50c817ea4e2354bc30d2584dd6acf9e0eff75a35aab085f6126a426c037a699522791bb1e258329049e4919d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
948e90152839021b170878da093ec4fe

SHA1
7bd23de8552d4d5f16d0771920dd218402b1a085

SHA256
42a1fc2e66a2afec6d16cbe6240436e92d96d518ca22d29baf11693560d304cb

SHA512
747791b6ed6698376c6a91c6bd5d2dafa0432791a5d6491e7ff47991377329987f20a19767f962c96e96aeb755c37903114d5b4e122c286c2b222d01e9219d28

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
0291dd4f145bd93b8f9c4dccf76efb88

SHA1
21d72e382fc948689f32cbe0120b417605695703

SHA256
fe7783fb5431f7ac43c80e878c11558f9b4502e1d63c7b86197e5db7c177515e

SHA512
dd5fe939972c1c4ac034999e48aaa111f8dab9b22503f7fa1ab428ff11942171d4f7bed5d39e4854fb5bb13c41ee262ff16a499761b815112800a774a6456657

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
16ac2acb725102adc98110aed151cbbe

SHA1
32455fc50006ddc95c03840f93e1c660e714b31a

SHA256
fe99f849ff3ee79a9fafc28069b37d26aee4653e6b70af6f1aee8505990cdc5f

SHA512
42ba01a89c9040a05f621797db2562f81b9fd400b1b0f2bdfcf7ad239d50b736024caa11fc1ce782edfa8007bb9adf6af60ff2773b98b4a52b7e552591630c16

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.EnCiPhErEd

Filesize
2KB

MD5
c81632b28e2e6c8ce6efffe3c9086b36

SHA1
86fc00b47f992dd5293b6bade6e01cac2dd38281

SHA256
9f206fb170296ea2983f075713d229191d964f1adf27b963163ff71825a8fc6c

SHA512
13da8c6f8f34576858efaffc8306348fe4cffde1ac0b93c65f0c843b17c6171063d3562fd6f8309ef2baf464df81740d629f240f0ef15e8f641d6d4a1bce5b75

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
a6686c81fcf8dd0dcb6cef36880a5083

SHA1
733865ad340509fb2e747c82a6829ce3d779229d

SHA256
aa0f32f798b2b50715218e3f4d2f1398e218ce2cfed468a8b63fc1851c259c77

SHA512
e5d83e69070187be122d8795a3a6258318bbd6ce627e4340736544c0f410db2fe9f5b9817c339c0ac95c63ca454f5aed88d83c2411054f404d6fd5ae22ac0ed9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
f129dd49a1dffbe1b2bd166f06ad433f

SHA1
77958130b7fb9e276eaba44acc431a44ea19cb67

SHA256
f795a062b38bcc7eac92d6b5bf950c85c3f69670879c7559d78fa019a26e8861

SHA512
971beb94b18701f65ec153f2912e4b988671321d85fe04909ee7bd6a744df85fdc76d4ac5289043cb84bd0eb1e812a9c8aacbae03c3d242f8d095c3f0fd7ddd5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
1181acdd61430a0d5c11f31765a20aad

SHA1
39f620773ab489d4d3b8e350816e0481b18aa19f

SHA256
efaad852dfde4fc4ec7cec64182ed932b00d0b9a094a4b958c8c03fb889200fc

SHA512
85192d5487c39ffce3e909deed15cca2e6e87b625f9fbda0573cf5edd808a29c6f83e4f791bb73670a1a3f4a6583ad9480b5a38810d3b51c1ca6d72a4b5b5347

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
075269d6ee1b972ed7d1eef2d42fcd73

SHA1
c289b2104cd21ab413092fa9c954c5c95d8a0ebd

SHA256
88e42d72ac08c9d2082158498b4e74c96326562d9403c8f3477d0e95cc7788f7

SHA512
68ab0c6d44ae780d65746e6e03dd61a02fc372b021c4c4ec9cda787b143b19069ef6d8a46b89ac071ee39540f5d39608555bec544ad40334283f25c191412417

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
967ba9f65fcfcb29843c06a3cb317020

SHA1
a49e914f2ed33a60b88dcdaaad7b1c71a01e2768

SHA256
22b3c29fa78639ca96e94d0f53603a01dc8fb5eb7e70ff3e0298d43456325fb1

SHA512
324b5c64195929f3f57214bc370936f61191d7f425ae23f6162801f2776c86a8a192ba3cdd94052887ae32a44371005b9337e0ef68c07b4954621b205c1b5c37

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
9fb620bd0830b2b8a78e5d7d16f2bdf7

SHA1
b9d0617a9f651c27f90df8c16703f5bcc375a47b

SHA256
235ec47cd97249f165148ceee1b2f5c5f53541e8796dbc8c12d0702b7f7462db

SHA512
8ad047cbd640eb43f82878ab74b4b3aafe6f6142993ef0ad1bb7a9fbaa160b49d8ec35f38ff0bc19a9e4523047f27d4180b9e6fb8e3ea601547186028c1d1e65

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.EnCiPhErEd

Filesize
1KB

MD5
cab9bb8688757edff3dc5ee0bda7901c

SHA1
edccfc205d7ef529e88552b44a91cad365c4eb4e

SHA256
e363a9feda15daad2707c527ca47c8d4fea4ab9372cb698c71de1e23ad41fa19

SHA512
695cc253699e81120030477c3898ffd251ed875d2a4982ef8aae2ca1fe83dd53d6251803916f428dbe41690462e1986fedac9cf950e49e4ca16281b3b7694ed9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
0ae03866d1f199ddbc0a403de0a779c6

SHA1
80135e91c8bf0dfb83833ef09e19dc835f613f2d

SHA256
e9aa947ceff84a322ef0db50e31a1a8e4272c076ba44f7824fe711ece0f957b7

SHA512
b3762a3e741e5a17a7e38aedb4f41c158cedd6d1197c1754942c6387d922ff5e47a2729505ea28a2572382fc43b3e389b264650b72bd7957b5621b7e974dd792

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
b9afd074e398334deed724fcc7f8810f

SHA1
6e7c13ae5a4e4cf30e9f434172abd9581fe54051

SHA256
45036958d486cfe2705a511d80c8f152ba6d8be03675e15bc6cb26c53687447f

SHA512
6a045bc83f76f507f423d2ee34fd435ede8b3bf59b5adb33edbe57af02c45f99be6bffb679514bee596717c6b507b5e8f5245c5e35c7d7178c697bb2b660ada1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
51617922e4b2a71e8d2a08633082b38f

SHA1
f6e087bc0ff212e05fa8affec102a1a7a3382488

SHA256
93bf0a9ce3d79575264eb3a9f367be1a67b60370f341d109c1f8b6f26c6c875f

SHA512
16fbeb6b8a947280adcf5a19d7ee1ab789b1d5664a7e25ac1ccbd8a8246a04589040f7be57be5e3500cc670233c73c5b88ef772b74982af2161398f4c9cd56aa

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
d575006be6e48b2b0dd4833fa49ec98e

SHA1
b6c6ffae9c376d41b977236759ea85c62501f58c

SHA256
9fd66f68c672ca0e5a98d2fd39138a49bc1a00bf2853e0683a6058ccaa53d8ea

SHA512
08ebfcc438c067db170e0ae52b44fb4bd24968faf0d3e27df09c6f5357e5dac2a4458f737c5ff4dd38f564f412f719ddfce2f92a2927103e3c88dea76a26b5eb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
e706b22f9c9876f80bfb064be963233c

SHA1
6208d8eeba42133bf662045a6385647c007238e2

SHA256
8770a006d1d983db8e10fd80ead842664fd4ecdfcbb95cc4c5a49cb7d651d90e

SHA512
3725ef0ceec47f0529bbec09c9267eca4718e002958b8889aa06aaf910f86b93b15b41f8b74b5da7269e65d5e9746105cd10e0ff9d16d04cfde2bec58213d9b1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
1025849301d6fc7db932ff66eab60677

SHA1
0913c58bedb7fff6ed6333acb8530070155fdd5b

SHA256
a638f8d9a44b67486026685abfd1965838dea61a66581bc58726e64c7d85f64b

SHA512
dafefbcfbb54b5a98f662c099b7eb4611659f616361dfa367a26c8269b9d7f963ae57df1323e0271354244c05e60282ffde7084b77f11e5f582e463210aafa51

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
ba0c8603c92f60b8946bb69cd0a85985

SHA1
73c9427509c0fd98cfa94bc67565cb9950c0ae23

SHA256
56cc5dfcd57dcfe8a802a51440bf8b70c4763c3d756121d3b4c7ae8cd0a9d82e

SHA512
64d345173c0e2d6cd7baaf88f5de2e319d0bfd484f05b153ce763368fc002d43a0de363482d804af6ca9bafb2d43ab72b180a394ab718d9806faf4ce390b859c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662498327333.txt

Filesize
77KB

MD5
f2f97fd518c1577896f5d14b48c406cc

SHA1
3734c9f73f882102bfa848ebb10fb7b2c8cef0d4

SHA256
1a795e2d7e9b5ebbc0bed7cd36b3e533e17245a7833fbf08ee509b9b885b0db8

SHA512
7e97f5ddf8c7396a77452c26f158c5208b31584dccb338b45f1d9ff0b596f6a208bae227d82032ed331c18581836806feaa3cf33f43570b5919e8f167641157d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663013511623.txt

Filesize
47KB

MD5
642b4f67497d152e540ca576e28d385d

SHA1
a2d36195333ffe90a00f6de1527165bb7ef849fb

SHA256
2c0d0e2943222b03f3f044d48709ef3b05a69f31d0b6ac25e99c49664f367cc8

SHA512
01d1a4ed319e277b01d0f798ba3d3559a51dc0f151d74b91c1cc74b711321dffdc83136472823b59b3b72aca0a1423c58eb1db9afe4b29704d168a6c7fe9513a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727668912544901.txt

Filesize
63KB

MD5
855c100a79cbe04fa3669b553e0c7caf

SHA1
4660eeeefe761090acf1260fbf82e72f2114102a

SHA256
7f1744f16dd0f9d1924be337d49d40c7c57440bb2457fba427d4bb7e7939edb3

SHA512
b89defba2c9074cf7dae9710b41dbb6d2d0c1ee949d5a41d354d382ff4d638adfe95baf4792accfe622d8a00eac252790c2a7d192b017a1ad0c7d5976c476dbe

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671578469739.txt

Filesize
74KB

MD5
2e3353cd91348cffaf1233c511351f44

SHA1
bcca37758cd5d8792ecb7b5a69aa94b7f0ebea9c

SHA256
e37b861fa6feda21e541b21039531ef59ce4831bf62f59f7947414232e2fea69

SHA512
e538a672b45500e8f09719631ed9b7bebf74a7dafe330f3d7bbfe3d8d729c5ed3d77a2cee12f744083cad44dd9faca068a065c3ed15ee1652142099fff84015b

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
76095f7b2ffb13526aebff1597e09145

SHA1
31563078898e71cb8f4415eafd59a06c4451f48f

SHA256
a91eacbae5b5b3f7ebb4956ed8bfd065124be68503641ebc8e9efd37f171bc71

SHA512
2acdb45c2560ead4e8164b0aecda9b54d770b446f8acca25b60f4ddb9b309753ababe821add148eeb4963c9f062d2909574a5da2235407255ef5405705c0cab5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
5fc14da5a5c6d76dd3ae315e5e688e48

SHA1
2f15d7b89ed999970cbf1786f88dd253b444fa4a

SHA256
8466f39f0097cdc297fb839fd435cadf9e19c06357297fc91c640124e2b23425

SHA512
1d9399421687c67073829649a4a2ab18aa382e7ad69703b032bbb827dcb5801e4c4c21ad40623808d6e0941fddfbdbd47a7f2751902c8feeef0953d21107b92c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
d54ac570f9eaf6080798ae52bf070823

SHA1
ed7383eac1fb3f409d8867786d20769209e4984d

SHA256
c6314a1bff18c536efbbd66fd9ada9763406a8dc949f62b63e9314f878c99bf7

SHA512
6bd98b5c18580218d8a4d426ccc6680950ed528b1492fcb489f1e4a0a8c2261f54c7eed8cdb0c12848b64b43745e9b8ad8f383f95368983b1d3c0d551f84d0e9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
4a37b48e07a0b19a0d8c0102676d4e11

SHA1
94cb9f35abe749f80be22c2c3cf1db12940691b3

SHA256
5254b19cf363b6169b130c0f96cb3fd4de291968e19dd244afc8f41963a7c1ca

SHA512
75c531ade5cdb9878ade00c3aaacfe9f11968ad9380e6c41f79301db505e08bc868893ed50f7a2b1fbae82763ae0b1097e1338fc97b5d18213c955eb0cbd30dd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
ba24dd0c1a733bb0aa7e7c9fd04fae4c

SHA1
a07cf38fc498ae0ae3ca8411312b9d7e57eb7df5

SHA256
2fb4c5cfbf3a498e843517ea01cc66504f74cb5f4571db1b1b5c6f53bb56b982

SHA512
325218bb52ba626197c18b7f03dfce555f7fbd5a994d67acdb5e58468b4a22e5428e0ae3fd29ecae4238358d8dcd98cb8f8c12b5ad2af7ed9bc8f48d9ae8fbc3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
5ccceb8a67a049732b15812a27340ba1

SHA1
95fe68577762d46ba6df1238ee980aa3af24e76b

SHA256
04f396e7156e24ddb668ff44ee2695db28d32efdf2091516c6d8245fd19b6cb7

SHA512
4d3eb8f6ca0d9f73632c6a6bd6a21d631c37f3ba01089c80fca27b38fccfc1ab3e2071cb29bf8215c741a6e00affa07717838cec3a26cb482cac62969c1be3e9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
3d3b69219e8a085f8582c4fb190e074c

SHA1
9f3a0e1aab06d7b819d6bd506d27fefd0e3cefb5

SHA256
5ef3e67ab16d2ea8246f228eb480613a6d50c0def533dd1b32d57bd01f546762

SHA512
b39f66798c3d4bd90a2829e42bd8df382034e9891a56d87573c1a30954f16c8bfe5ee4c644a3cad90390d829742669ea1a58822adf4048f58076945a86a1ba29

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
d5c587915db02c3838c1877f09580783

SHA1
7ffd83ab9bd9268ba7752432eef74646ed955023

SHA256
6b1d867fa8ea9d7bb5cc2122b6269a51e02b15ca8e08b9dfafc172d7c57b26aa

SHA512
dccedae8e0a2894ff254271201dd62ffd96b76aa3ff73d10ed56b1485227f12565d1a31d3f0c62b02e0dcee8a660e7d9cfd822ff7161b70c80630851869a9b9c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
435a7d0a8ffb995138b68ae1b83b0103

SHA1
6d58d94d2588688f35c0eb74c4f5ba7efc50c091

SHA256
eb363739f1a3552750c219cce7c3412ab5f437ae1ed6cac3b53adf5b0620a232

SHA512
1921f0b80bbcc5019cfc4993072bc7878d9399e84cb20614f807e18f45221c7d44d21fdbee1e30df8cceb0d0f68f0091e49bf1865eebb575ed757d820326757d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
a4858bdfc6a8c2f77c7666b9cba76f0c

SHA1
3d6bc50e18d155c41261435546c028e9bfac5d9d

SHA256
524d28a45b8635deaef0e96cbeb656e30e3c2a3089519d3c0b87ebfe1960c4de

SHA512
92d56756f47453801b0645769a4590fcf2e03847f054f65d875c2c6e891c34b7b379719e8096a804a41bb5e9697fa19dd7e2af79ec1430430db5ae9214140b66

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
02c33dcfa66f026850cdee037c2ce46a

SHA1
13f019215944f0cf09dd5123abe3758b474a9826

SHA256
1073e901636fb68959182cab5bf4d54bf80e93d2e44211507a6d738c8346515d

SHA512
da623ae1836190119cd636d12a0d58024017111ab57cc73d374307475dbdb0d26d0d0d1a8fa14aec22bee77f58b982f303834529c4fc2452fb79e651cfa910ef

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
cfc584c5781a6f6659ce73352975e2a8

SHA1
0c1e3247bb2f591b929d3bc16ee34de4bdfea86e

SHA256
da6e55865b247ee0082a9bfe1a799370b597b1fcc687fa7e0f3577c54207fadd

SHA512
9e14bf00c25888b8d7f9f675d45d099c809bb6fab531a373771e66e76c2c10a3b27dda2198a01926dbfcbcfd927cdc6e9f5f2a4a3739ddea304b775b64aae0ed

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
78e8d2e5b43715c2220d2a100b03d02c

SHA1
536bf6b91a2b7e949576f7c073e7d7a36bbd6479

SHA256
491aca081b6205424e986b247460a3f737cd18ba3cef875d4db8bfd122914265

SHA512
c9b3e51d72c78413c72d974b7432b6192ad57af72fdc15c173fe206a8cc75605fb8af332dd65e883b11845e86d822a2a11c9d0d61090ae14c01a5bb4e49c5031

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
f22d0d5c89fd09839e2a56b269a24eb3

SHA1
cae3c74bb7656495b5b3edf6d2530e4e63535d09

SHA256
bf4023b6623b723b1edd4d2cb252032b5342929af9dd7e90543a1f1ce6b4bb81

SHA512
f3ab8fb48f36c726a06a86085e6f8ca043ddbf127ea3dfdd35ce918caeee8f9686bfede981f9add87eacae1f6eaf2f2d890e706b0c4435bbe416795f3b0256c8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
f0cccd936de4627465892797e30f61b2

SHA1
0475dd11b82b2dc0f097641f2597e780cef7b9ba

SHA256
a729804bbe80ebc82f045f4e737a19376034eefe4a0e2cf3baa2a20c963bb8cf

SHA512
153d4433b94f1836252ddb47d95a723766e456a8b47faadf9e4b94910d0955754eae7ce562a939f36122202f59cf48491690ed7af2c4d0ad6fe66bfa6ecaad66

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
22e389969634215351a4a9de71174a8d

SHA1
b55609822a4ed8dc50dcdb6aab7c55e3bb3e8d51

SHA256
0b8910b69565efca5b3b7e3b0aedba54495497b57100dda19d2da62601152612

SHA512
3d7a64aa2e2ef6476fa71f72e03bc119dffc3f28f882b5c333aef6928abb1d7388d61f84ac773f3a81e928b4b02922485f8a66411a8f6312149ca3a4220986d2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
8225610e5c1ec254c37b02abefddf497

SHA1
c2f9a2c5a6b5d14999208d1b389104afb2851873

SHA256
9d6210f89b9186406ec657d4287befffb7baf088902416f49d44c0ffb58a6030

SHA512
7fd1d6460649556512dbaaadf8e7e0bfa023c687e8dfbb812a6025d05ec61c384fc274ed5edb7a0de6dfebdfa58033dd077bf1b0490413e89237d4540633df5e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
5595d50f7b858ddca13df0b0f3a667bd

SHA1
aea65e475468d179b483fa5c87da385757554b02

SHA256
9665a090078abb40015e7dd429803ec421529bd9ddae031e8769106bea03795a

SHA512
09b71ccf3a898239a0033fb9f528d88cd94be0f07383f9d9d910d1513404075011f247c430851e969313b8b998032133346f852efdb35db1e9379755d34735a5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk.EnCiPhErEd

Filesize
1KB

MD5
8ad268ba0adf76ec880b1f71ebdf938b

SHA1
fe629ed283d62603a636993c9a24f17b09255c8f

SHA256
b9a34ab04fb2b750800ac9680fc4a36c1e42643ab4ea88c2e91eb32fd0c19b56

SHA512
6ebb0d6e12f9f142c118e1f249ece1209611e1ae8e04e0255f37540ba9c513a483ca7ffc10c71d462b877e05dffd0cb0ba985b4fffd9ddbffd5d6b56c6db78a9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
a8f2e176c21df8979079f4cc9f1f0b33

SHA1
088ae3399f1f38f5db5c7887020b95547167ae56

SHA256
183bc108bf2f63d0e5d3d0b782976a3d822bb3a62349b64898182422fcba507f

SHA512
3bb5b0aaea4146f54a3420766891f452fc442c73fcab2e409ce5455879b8cece9151d283cf32b1a3eb9e8e876cfecb268846d8773fec7b4ffa717ea8393649b9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
a11d496bd1e45ae6742431cc0179fca6

SHA1
edfde7a073a457c5b6e7fd73995b8efdb8597df8

SHA256
23d731595e614277b2a78924748e351fd95c5237ef071b3d21c0de8f8a2a67bf

SHA512
7ce36a82c35b2138223a483a2aee2af4a2a438759f4a232fd74ad3979da52e66d5760243010fa7504af0220be0c320100d8d077c8d68478bd009eca5060ead80

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk.EnCiPhErEd

Filesize
1KB

MD5
f60f0376143c19f7355ab836a0c86e6f

SHA1
9702ce038ba0ed8eaf0c480123dad20c489f02dd

SHA256
025eaac2be401cad904235bcaf3f299963bcdbd074be7edb67edd07a29caf5fa

SHA512
d730a2831d65cf7b316e8c301b78718f75a16743f00ef73d7d3fc35abbf7234e9c85cfd6cd024aaab85f2a19cd3e029e5a5399384e285cc4b3ca4428a573eb80

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
bba08b15329d57b413d645a65fcffe14

SHA1
102018dde04dd5686a992b1055b367f7a78e9fb7

SHA256
73a255b0d3284fb54ebdf979b4d5c8deb22437deebf2eeb367141dbd6810ef61

SHA512
2d45b14bb526f74cd7e098735e5b8d39ddbff1185ee662a735098c53b5a55f7e82eab5c23a37fbeb8d067c6390782ec0ad6ef3cdb6060c2b6d9dc7e1b36bdd07

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
ccd9fd79111d973cac95409747cc4cbe

SHA1
efd96a053e2d7a5e46b63b0d6ad9e4c06745d94a

SHA256
adc5c116382c21be335103c7290f12efdcc1600e430af22a82908d3b4fd5e62b

SHA512
6635e5ca1ac209c12eb08e8373c1bbd1fb993c521ed7b1c1058953709888027e1fa41d32aa03312263bbdd3a7e43b5575ebd660934fd7c7d8ac89ce933d1999a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
170eb19a31657895ec3a8317dbb4b2f6

SHA1
055d6a0a530aafd846b3eaad927f91f7f6cc8518

SHA256
343e6b32745930778d8fd9ac26597616147d9816ffb7eaeeb08da15a6e64800c

SHA512
963ab7cc803e302be58259ac2b554fe0b7dec56c2c26b953621484fd959dfccd6a9fcbc963ca8354b9832d3d7743273addd9ce4a416671f07ddafa139860f7b4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
5a0d49caaa059301a029f2f3b3b38826

SHA1
89c753411f41ddc75279d5dd2f159952770c0beb

SHA256
573311b035202108705b70acc1a4c5934a1046b36c81e78e5c88a7bf7e768c09

SHA512
9b2a0e867893a560b0e6c7cd8ae3c3f2e995adfbc7d54e5d83293073ba408fd3cdd21e7e28d832f10bf610e2cc40beefb15ed6c0c5a24838a75544a2721da00b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
0b1e108f75a6fabdf5109ab8dea981aa

SHA1
fc4dc1d321156c259da6792cca77957103e1b0dd

SHA256
048f792498cd615557da819a4cad5ec7f57c4c3395a5b54e1b37194132687942

SHA512
19f7e27bac83e2093f8ed34c2cee44d184af600d58243c33d62f07e7482cd3c515caaf0a56e3c3ab9889597ec6e354bc7a4968844eca586a99e07de31d65f5fb

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
270964f7729f2d352714a869d3919fec

SHA1
baa5dece79f66ea524de102c851d4fb2779a96a5

SHA256
6b3ff23d10ee1a32b1b73b8f283a3ee9db3209b2423ba9a54d32a5730d023c5a

SHA512
68c5fdc79ce2380de6fe17fb3c71903e2e6d1f0bc2037ecb4da70f7faadc17a9063fba9790740c9e8dd055597e861809cd3cbc3af616133f527cbcfc20281146

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk.EnCiPhErEd

Filesize
1015B

MD5
650cf63a62f00efd94b1b2793800ba83

SHA1
c76daa381bb3400d842401c7125e61425fbd5c18

SHA256
f065d2f40d2952809d28e93170b5a790ea98c18412f71e7fcb260be909a5c9c8

SHA512
486854c1033a415ff1a4bce968caf4ca02fc2854b825615eed0b976c7272f8749e210d3ebee411341e13bfd6681c64df053e89b6e1e510ccc94e1160b46543e6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
0050a9942035748f5e81d612c842487e

SHA1
fbced74cc3e5f94896bcf14d6311687c31772bb2

SHA256
5f3310005dc9bd99a8735ec0c65cea8215ae86b8ef0a3d6216452d254a46de0d

SHA512
c4bc7595d930d9d6de50d4f6b02f8af3e741c138f33ebd67803bcb242cce3f64e7ab67976a4e6fc880fd6793f8f1fab9cce507898e1c179ec163ee8cab8b9891

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
f1a0f233273b3aaf4b2ed5499a372524

SHA1
707364bd9eb719b55695b6b9783ad4be184b623d

SHA256
fc718e0728ab8d58bf1fb63776bf492807076625ba4c12d991f67fbfbb37efe9

SHA512
930f9514f84ade517c3b379ba5caa0a667a9a33df1240d7268ea7e40ba58898b4932c43ff353ef7082f37c0396d0b66fe213ef050fa33d3a1897bd82cc230779

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
b5543a10dd1d643cfc8d6abd23ff913b

SHA1
5b12c4d062943566023004d4558c51677275651a

SHA256
98f75956176f7560e108f871293fcd3bc80f386ec2a3144464ac9552e8f481c7

SHA512
ca80ba4f95ce3661508f2095ad8ac62f7cec3378f5d59c7520faeee5fa6b979cfc59a7727da046b255e1171cf783bba08df915af5217425e746c24f2ceb42523

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
ec1401d729dab9684281c24ecee7e15f

SHA1
aef2ef93276b4d89e201de5c4909cb7b70c0ba8b

SHA256
b22dc88897cac8961fb139b3d37f6c0282fe4dabd94b4f6bbf5721456b883c73

SHA512
eb866692932e7689aaf2e2f2d1c63de4f06710bc4d837e38c9d82facb42758a9e8c5008a693fceafc4ab83682d47d334500f5ed18ea143e38a52c8414caf7408

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
094a8de2e821056457f3af7f4e17bf79

SHA1
0a43dce6a10e3919744cc40b1117fd6924c87d2f

SHA256
140f8ec8e1cb687dad48cd9f4d80429e53761daebdae72bc5a6444911aa1a9fe

SHA512
335e4580f63fceb24c8aa47ae67305f0ab91183a5e885e01991edc397d9cafa655141a30d6ab5571adeac04afbd646fd084a6cf49597a9e8737c1ecd137a38ad

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
1c4a038e7735297cdf08315d1568b88c

SHA1
b353cbb7d5ddaa102f2c71c714ae644a4703e0e6

SHA256
2124f77c71ff6b8e44997f2eccf45fae98104a59d920d97b58d72d2a50489df8

SHA512
d991805132bafc251c78f98bf9cb818f3b4bdb16e45186cbc70716fae92e477c4dafc96e51c3c96a92619d8ec70dfe3dafe7f9dffae7481328bbb05c64435ae0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
d83e026151ac8fddbf8e46a4d6f4fd8a

SHA1
79bfded8cef81ef07a4da6121894b1c4eb211734

SHA256
be216bb5f599c878a243783422fb4594d0434bc9de8a326c046f271406ff4bd0

SHA512
dca3e6cbf2425819a721ccd8f39281c3c84024f07c8f7f4ad4b78f01015c2780293bc93e511c9037c1f03d851f60529e0b732fe959b7877a94741c1bbe071902

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
a90c449dfbf5e3e29696bc29fa45b891

SHA1
2b5cd3bc7df845c1d911743a3f21e0b0874133e6

SHA256
3f963a33bac93cd87b83c1dfae3dc81f23ee32ce4a03f470729e4534f2a55dc0

SHA512
3a71b1efd38e43a3a06a0180661851200346655852f13142593859829fe8cdc0644d1365dfb45ed0ac5b5eba2af8c026b90daf41b85e120099cd6e288122d807

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
4510a02f546baa462e604ebb37bb7a01

SHA1
763ed9d05dadec847abb67b80ebd2dfea50b12b7

SHA256
4495ac0bb1e4ed2993e2d92fb039304ca118326f96fe1a372e7a5b8e7e125a4e

SHA512
07316552a38f74bc528071e3ff27a0d982baaa4e4c97ec50a2a3fe18311d141a10d981d3d6e4b8eeff38dcaf26e8abb3b073108e3cd45d95c33dd46d9b50ab19

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
807145a3bbd535f307758ea8750e4c75

SHA1
cd566db6cc03fea3d07185b9b7da047c33b5ef9e

SHA256
860b013991f12bdb3cb140a87850762bac0e697db3fa400122fe50d1fd57dfc3

SHA512
ffc708c8786298dc1b01a17c84e1b46014df513b15f23afb9ee524940cda0f89fa9766ce46988976b3b945c85eea4b6d3ec66776643dc3edd607e69291cc27dd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
d64c16cfd484fa7e088fc346e50b1996

SHA1
f748243b57dbecc416beefee3d94e849a158d674

SHA256
e10833b9d3914c3d338c79c1eb07f58cccd2881c9ef34f9e7c0d60fa39ccd02d

SHA512
c39776ed687e7c9848b1168cde4ae7e56fcfa82dfc8af920f3afd26a9b71190e277bd7cf1e8f59a8a9a8311058c06db5a63077d6db8a00d339251c502a2a18d2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
caa049a13925e3af4e47687b31c93428

SHA1
5e0015bf71ec0a11204474a923a642b2e361d34b

SHA256
6bf02f0ad6597ffc98f2411998c00ffdcd6926e00482684a308f5fc3aab7c060

SHA512
68948709d98b98276f2a6c41eab47ea64996d6a6d0c83b4a8358edfc0d0d57460a0a821063f3d0b6d0c7ac6610a34ad0a94637f536a0d32541cc34ad85922a22

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
608058ac74d0458b4b82dd720b4dae65

SHA1
f2291d2f5d2fd6ab59b95177c86810cb857c57c0

SHA256
e7d9ea1c3a8927bce3f833d9522692e2845afe8065764585218cf3df7ac10a21

SHA512
d78fe806454b07ab461ec3636660d7e6becbc5a05ac988408081b8bcc2f33ddd07011968c262c9db2d41c61ba784cadff24240bfb85dab80682288b8fcfc7bee

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
ab2473f91d521fb72bbdd01d213f749f

SHA1
fefd87b0b0ee33ce958cedc664a6b387dd8d9371

SHA256
edbaecbc1cbcfaeb0c2dfe5c6e0c99e1d2e5057067527f83aa1ea0c9322d4c49

SHA512
8cf002e36271df85e8bc032b519c3f5bc972781024340ba3ae3c3be9fc6839a7ef9cb493ee8484b2c357a4260e927d42a05cad83d81fd73e7a1d404543320a9e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
733a0f4e053b08e980c84c3333d648ca

SHA1
b0378c109602461e86d6c0537f4f333784a36c63

SHA256
7e1a6e86ff3ff901cdfd09073744cae7ee15bd6208910806e4e8d268378af119

SHA512
158a780a7079d722ca77b0f62a1a6aaa0a9cb7a09359f959746daec57379cc743cb6d1ff521659586cac45b383b4e7c7e01d78abcb8bdab8b75c1aa75c15d6f2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
d8f8c9b3924d399e315d95e13ea73766

SHA1
ff683e3a526e29dfd03f6ef81e93d72a65088aba

SHA256
6df4dbc2c3aa2a2db2e65d463060174f4c37a41818c571cf2b9a7d842ba8b3f3

SHA512
e068334c6e09285e946cef4b1881082f0738962bd81c59bf8454108cb74b323977496b33e0dc23959c9342d53a85802188f15f341c31c807265a4152fedcac61

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
32f57ec34b0de83b0c440ece6dfdc567

SHA1
21cff730a63858886c7e57f519d171992be13bb0

SHA256
f2ad747fb5549e7eb01c21d19a69981155229259ee1ef0f6b4c6183c2c3abcdb

SHA512
62e0914bbcd117af1be5de37f8a985b6301c3a417b3c877c1ca96d6f0f3cebe3c6b8631f4ede5f46319445f0e59e282ce4f96a2aa055bebd4160d20a2b15ce5b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
428f45d9503a723a984cfbbc320ab96a

SHA1
c063ecec20caeeb29dcd3a426384b61cf23dbc8e

SHA256
e66be0c2d379c90904f3e3452327ca2fb7c12eddd689a62dfc369e5f7dcc5469

SHA512
6f250f8a0f73c3d4d2c6e842e1824732333f4db07139dd83991ba6007f654e209c58a23f66ae7c4eb72fc84c6398d63690195506f2889f238c45809ab37994d0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
ad5800956ac14cbf6ca002a31d22f49c

SHA1
ce431f18664c7d36396e7da84f6fb838bf52e399

SHA256
c5dab371cde40a3f7593b46c86e6e466d902c3b8320169d0e1ce2ff47dad76fa

SHA512
b247cbba77a3a489f2ce1d246be1b61901543ff5e377ae64e5b66c83a7dd90e20c547a0241959a1bddc4ebee6b2e8b8f54b5fe28d0680b9370d70431ea3b6061

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
25c683655115d8c5252aefac6c94b25c

SHA1
a68827a50e14824383c79f3cadfca534dab049d1

SHA256
462f015482c46fc69989485a029cea543902bdbf9c3ffafe9e764fb134488dae

SHA512
86d8ca893eb34ea3524e1cb6a11e0bbdf991ebf8607e41fe032aeed6ba5140fac288fe79f3d2c3e5bca9e8c064a44297aa7fa1bef8ee5da6bedaf9bdfcf5673c

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
cdbd92343879fd8807cba92ca0678852

SHA1
8e095f5bdd95b2ec78d895eab908b3a03848846d

SHA256
166b37738ac4208afcd9af8e5becaa498297f450a6c385b601cd635731016561

SHA512
f4f6512d198c0af58ba50c1e43013ab84d9f3f5af7cb3aa0c036b82b198903a102ffd763004bda99711f95de11ca971bac5a4de533cdfe10d4440a689104d9fd

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
edad4007da16c7218cda8e736d0ab788

SHA1
3cf4779fefa0208d257263172ce7def91534088c

SHA256
769c6a794f48af740cb930503049144ac9fb6d728b6c18c9cfdcb0005a75a7d4

SHA512
7d9bd2dddd3c65ab5ffbc1b309f6daf2307e35cd89da7f5b98a2b8394884c069c238012cc89bec5bb06fce89599a2d6c9d7ffd4d4f568b33409ff4a04baa3925

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
7686d5f8861e8dab5a34e6d844329548

SHA1
9cec574bf54b2adee2980f8d7d303d783b0134be

SHA256
b6c66b7f4c63ee2eb8fc46474cfcbdaf1846c6a315861f1c27ca1a78e5c23602

SHA512
d2dc65fa5daa784f4a23a4238b94c2066eabded788b0c0efcb22f655c6149b71561d8eef056e058c569b73ea88953b7d46163020a41764f6bd4bf3ee01da211f

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
07f96478709dd2b9b762a6b12c989355

SHA1
4fda570454a36fdc888df8d36b9f948efd26cf03

SHA256
0a63df9c60907fb1c4f576e8aea5d7ac4120fbeda2419d05319942810ea8fef5

SHA512
b768bbdca957b74706e9447a38cfd7dc07ce467d939761e1dcd1c2cf1eef9181683eba8e23f3324fdd4fcf7cccae4ffbcd56f7d21db932da1323fd81e5700d11

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads