566942bc7ff74cca2b066a30883d51f68b7e66502f011fe93ab17aa4fe032918

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2024 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Size

12KB
MD5

60a43781da5d83dff9f52d7efec1ea22
SHA1

e0d6f116f75991d848335767d6ba14b01d7ceef1
SHA256

566942bc7ff74cca2b066a30883d51f68b7e66502f011fe93ab17aa4fe032918
SHA512

f81b2d8383826fe53cff8781329ac146e631ee692b3db961447cc357438be41de20c25fee0b5b6b97c3e1cb68e75523753fd996c21e0e7cbd2b353532b8ecb5c
SSDEEP

192:Yj7RW0nlABG/3Nfv8tiTV3HGc7EkpAqjEnTPu2q9C/YpXnAITZfPtRM1o:EWwB/3N38titKkpAqonTo2Ypdm1o

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2177) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xB1g65Vp299yQj6.exe"	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthprint.inf_amd64_d3a88fe647d71206\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmadc.inf_amd64_7b6fc0e15997ce81\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmntt1.inf_amd64_263b3076d78209be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_hdc.inf_amd64_6e00e835fbceac58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\F12\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidscanner.inf_amd64_b4d877fbd7faf471\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmisdn.inf_amd64_ded39545dc6c301b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisvirtualbus.inf_amd64_e8d548ad6f0a613a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\qd3x64.inf_amd64_fd7b06296b7ac679\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\SHARED\res\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Appx\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtexas.inf_amd64_ed0ab85128ed7a01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_sensor.inf_amd64_b8789b63cc1d26b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0011\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\xml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdv.inf_amd64_5c153f7ff7d0d00a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_f83138380f5fb6ab\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ws3cap.inf_amd64_6cf8ea2249844b50\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\hu-HU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MSDRM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_battery.inf_amd64_5637e58e54fb24bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmvv.inf_amd64_26dc960cc4c84207\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_firmware.inf_amd64_36e4e17f210128ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl007.inf_amd64_41e31b5786c6884d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wdmaudio.inf_amd64_cb639d1f182bc449\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_bxt_p.inf_amd64_8be317e01b44bf5a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_sas.inf_amd64_74bb5e3e01cfd526\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_5e0fbd01da4f7c7b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl006.inf_amd64_130cd40b355024c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdk.inf_amd64_9e49da794995b361\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\et-EE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\amdsbs.inf_amd64_e2a1e49127fb17ef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcardfilter.inf_amd64_3573afe136371e51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgatew.inf_amd64_7e6c377859cfcb7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ucmucsiacpiclient.inf_amd64_a233292790c69f03\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wnetvsc_vfpp.inf_amd64_9ce6f68c11eede58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wpdfs.inf_amd64_1183fd0f13045f2e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\slmgr\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mbtr8897w81x64.inf_amd64_0d8225e7d2696ece\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\LargeTile.scale-100.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-80.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-400_contrast-white.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Hedge.jpg	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-300.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-16.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-96_altform-unplated.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\MedTile.scale-125.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\virtualAgentSmall.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-150.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-20_altform-unplated.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\27.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Default.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left.gif	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\YellowAbstractNote.scale-200.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-400.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-60_altform-lightunplated.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\logo.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeLargeTile.scale-400.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_contrast-black.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-100_contrast-white.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\AppPowerPoint32x32.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-48_altform-lightunplated.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\Logo.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-unplated.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-125_contrast-black.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-40_altform-unplated.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-200_contrast-white.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchLargeTile.contrast-black_scale-200.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe805.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\SmallTile.scale-200.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-100_contrast-white.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1850_40x40x32.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreMedTile.scale-200.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-48_altform-unplated.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-125.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-400_contrast-white.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail.scale-100.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-200.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Logo.scale-100_contrast-black.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_dual_wvpcivsp.inf_31bf3856ad364e35_10.0.19041.207_none_e90623c3f0674d4b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-fax-common.resources_31bf3856ad364e35_10.0.19041.906_en-us_27d34ff7955eca1b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ndisuio.resources_31bf3856ad364e35_10.0.19041.1_es-es_520f58a4def7b764\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wlansvc.resources_31bf3856ad364e35_10.0.19041.1202_en-us_b285b6e44b513a4c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-g..cy-script.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_28e1cda41916772e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.EnterpriseServices.Resources\2.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-directx-direct3d9_31bf3856ad364e35_10.0.19041.1_none_783e7a290023bc74\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rasdlg.resources_31bf3856ad364e35_10.0.19041.1_de-de_c30e69a8f8824874\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-u..dem-voice.resources_31bf3856ad364e35_10.0.19041.1_en-us_ae3e597b886e49b0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-s..gstack-boot-onecore_31bf3856ad364e35_10.0.19041.262_none_d788289c1700bc0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_keyboard.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_871cb1effeb4c32a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\ReadingListEPUBImage360x270.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..tenanceservice-core_31bf3856ad364e35_10.0.19041.1202_none_44c81ab3ca6defc8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..riseresourcemanager_31bf3856ad364e35_10.0.19041.423_none_1836bdb9226aa8ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netax88179_178a.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d78003a92786cd57\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\Boot\EFI\lt-LT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_unknown.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_159c97d8393b6d04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..factory-handler-dll_31bf3856ad364e35_10.0.19041.746_none_495490621a6eb2e6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..up-unlock.resources_31bf3856ad364e35_10.0.19041.1_it-it_74d1147fa5da11d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\INF\MSDTC\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\http_406.htm	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-h..lient-wmi.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d5554ba26393e7e7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\hueColorBar.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.19041.1_en-us_8a4c3af519008c0f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-volsnap_31bf3856ad364e35_10.0.19041.1_none_151b030c40cdc642\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.xml.serialization_b77a5c561934e089_4.0.15805.0_none_f00a062c051b96a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wcf-system.runtime.serialization.ref_b03f5f7f11d50a3a_10.0.19200.110_none_a3033a85284637a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..g-adminui.resources_31bf3856ad364e35_10.0.19041.1_es-es_6e1289330468160e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..s-clientactivexcore_31bf3856ad364e35_10.0.19041.1266_none_a4b3db427ad98ca6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wmiv2-miutils-dll_31bf3856ad364e35_10.0.19041.546_none_5392c362b0eebdea\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-photoacquire_31bf3856ad364e35_10.0.19041.746_none_b61113dfb33429a3\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\15.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobe-light-contentview-template.html	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\http_403.htm	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..laboration-rdpencom_31bf3856ad364e35_10.0.19041.84_none_8701febb8765691b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-updatepolicy.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_501f7a1318196640\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_ndisvirtualbus.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_35010f433bb61c2e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netwtw02.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_000db18e2ce51394\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..ucsi-classextension_31bf3856ad364e35_10.0.19041.488_none_79eaf732e32e4cb0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rtworkq_31bf3856ad364e35_10.0.19041.1288_none_62b61bbede3bcf33\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_usbcciddriver.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_fe9031f03eff8d0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-simauth.resources_31bf3856ad364e35_10.0.19041.1_de-de_2e2dc8a45f953c27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..atform-input-ninput_31bf3856ad364e35_10.0.19041.1_none_74ab4b3f5126f808\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.844_none_c0d0cb934c1c1f17\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..lineid-wamextension_31bf3856ad364e35_10.0.19041.1151_none_7f3073a2e8d33842\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-pshed.resources_31bf3856ad364e35_10.0.19041.1_en-us_53d9fc724ce2a907\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cngcredui.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fbb568e94029e039\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_product-onecore__mi..fp_hf.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_b5cc08102003da13\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\DisableAboutFlag.htm	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..ehandlers.resources_31bf3856ad364e35_10.0.19041.1266_en-us_de7145e968c0ef4f\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_ndisuio.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_240c3d68014f7274\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wmi-management-snapins_31bf3856ad364e35_10.0.19041.1_none_5c2b958e8eb10476\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-white.searchapp_31bf3856ad364e35_10.0.19041.1_none_2f147508fcb33106\AppListIcon.targetsize-24_altform-unplated.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.264_none_a61d15efb6291d40\TextReply.scale-125.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9a45b49543424403\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ndis-minwin_31bf3856ad364e35_10.0.19041.1151_none_ce259344dd35ac79\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_systemresource-wind..-ui-accountscontrol_31bf3856ad364e35_10.0.19041.1_none_8805ef3af31f4b8c\Exchange.Theme-Light_Scale-250.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\INF\.NET Data Provider for SqlServer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\AccountSmallLogo.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-extrac32.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_63c7e07983742e5d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..in-gpedit.resources_31bf3856ad364e35_10.0.19041.1_es-es_baeae70ea9dc933a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_11.0.19041.1237_none_77b29200e9d368fc\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_ntprint.inf_31bf3856ad364e35_10.0.19041.906_none_c3423ff2a842a4c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.web.mobile.resources_b03f5f7f11d50a3a_10.0.19041.1_es-es_81745c5446cea1b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\shell	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xB1g65Vp299yQj6.exe"	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\DefaultIcon	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\shell\open\command	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\shell\open	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "XGPOOBFPYVCVCCV"	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\ = "CRYPTED!"	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xB1g65Vp299yQj6.exe,0"	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
e1f4dc6fa2fac418cf4e2eb15a452e1a

SHA1
c623f0cf5716c2fb5a9a9cd576b32f37fc985f7f

SHA256
62ffaec5c75bd311dc21a29b00bbb17f860e281ac1f6358a65efde7c5411b159

SHA512
7004cfb34216dea35bd6bdb97c00babaf6a66a607b34ff2866f2a6ddd1e50fb8564a3b1be10ca0d0793d8823f78e8d08718c3d8ddb3c9e4239f090b842b9744d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
90356284bc35dfc24922015a619cb3a7

SHA1
400ebb102cd90fba32abcf3e4ea92d9db46ea8e6

SHA256
4f8c35f19613f18c557cac1ef4c0305d011877d7cab91cf14de0a6bc45b113dc

SHA512
f67e8aca4975b92da519495df8117ef0c22ad4041371474f2a89ea87ff1b0e640de9a955ef272b066a7cfb892c345d14c63394568e24d812b44cedd0de05a17b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
8d8ec0993a090e3420cd8c05a4fa3dc8

SHA1
bfb7a671ec2e14639225f20c34937dae345e983f

SHA256
ac6c84f5b71c868c7e75821c21d6c1d3b81681ac6cccc05b483a7a0afbefd0d8

SHA512
9d1fc90a68d82972d31a00300a2b8d194cfb584c9840cdb57e2f485fe1256ffd990ea391890087c1ec8e9629067566fafa4b9a80f4a1f1424c0532ea0459fa2c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
e290f82921a6a63d15b569ce732bf4c3

SHA1
37e872725aac98d6e951f305c28ba7936baa9554

SHA256
0c256cf93fb55acda14a5502190949f3f12930157ad717c8fcc2eb2575dec489

SHA512
055e0b718bb3825bc60c7b557d63a2a24886e1d7da4b3e2e9b4daadf06094191b72326fbece9028bfe8960cc563074d62cbc4946b14c81d50419b173710fec55

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
7793d46e5684df6252f86e3fa5fb77d6

SHA1
55cd18143b7643e2147b826fc1b5767ea2ddfa18

SHA256
dc45d6216b27db33160e9feb75a6b10a0ef63f65f22707c828f1676fac6cec1e

SHA512
5c0788482f40d13dbd21f65a6a551b029362ae05c8fb7d03f1fcf5b1f613d8bbe156543b669e6f3961c51ab7d382feab441e6615aaab211eb86282801551575b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
70187aafeca7a4ee8a672cdddb98e26f

SHA1
23d98726b389d968f549a0c39594c4221fc5fdbe

SHA256
1e90a5a886d27ba82d5fe9a46ed628f4367617c4a997d113eeae490644fcd00e

SHA512
bf9ef021457e3b3e70a1a8379ca52f8ec06a9e38a0ca01469f771c990cc3d81cfcece58adef65245bff620cc699a65a68df67229ac76ab02c12eb11beed75163

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
302d4abeb9b7ed42b7b64dcd4dd0fe55

SHA1
7e5f11675a524fc4e2797bb13b7175ac2f1921ba

SHA256
2f0ae2dca0bbbefebff60f8527cd75264835e65f60fc98c1d74d4ec6eb561e89

SHA512
e81a027ea347d77ccd51cc6e393224c049873faeacfb2bc8372d99fb354bfb5fae039d1256fea475dabf609c6967868e6c0b597cf19b4aa2fed25c4016902bf1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
88dd1f1dd07f9cee81e06a230a6d09e0

SHA1
910e4f0e1da6f73f427fd4f518924ffb1ad49281

SHA256
49c88347dfdbf0791447d039e4a61822757d7d3f7e2fb88a0b2e52c50c202b48

SHA512
8997cbf4248109af88db243cde64ec264d830852dfe5040cd8e722e5290f9984b391b0ec1babd0d6cdd8dcd2ee31675c91fcc338e1b0f21de13139ac3e2ed87a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
5accce5c0534de1f58608182a5ab2c3c

SHA1
1f5ba18496ae3d0ee8bd2dde075bda944a79d79d

SHA256
44ea7f2b6e5e37f010c164ce3e0082d9e28816ec17b0467280e3f9606ac11cf5

SHA512
fc64faf4dc28366589fd8fda39be40df485ff0b0ca6042d19a65ba6c1d533827270ff5d95c47ae0106f4cd832955b52860404f129cf01e766c959dbaeaf68c4d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
7f790a98bafd4f0a1fd8c407b1787e4b

SHA1
c8faac96c41eb6dbd4c5233e728ef8fe4a2e36ef

SHA256
be997d57fafa620196130ddb1baff2bd81339e76862c02f40a0e11b6459ee97d

SHA512
f8c128e4fd839f14ff275570d5ba710055bf402441b181ab50f1e090d5f960765845ca837801a9c009f13a7915881e11ea191de5de888efc84a083d55ea408b5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
3371fb0c64a4d0219f788f1f4e2734db

SHA1
283d69032c1b22f5f3fbfc945c96d836a93d445f

SHA256
0e8e9fe7b63707b6fbe51bdb371dfce9fc002b3a9a635c8a7401eab13dba46f8

SHA512
86d8fc883bc32207105f3114a98644ac168056517f258c8749e7c526d939c97b6ee84ed2463d217adace78b979fc1967c902d75714cc056b39ed4ce892bb2bad

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
3533845513f6be0545221ecee6281378

SHA1
32ed07972c4f4b4e6190e2e631e8f91b777fb30c

SHA256
ef3d460d5ccde3080a7e9ee45f1626a83912fb7d50d8bc6c7a7fc339b2d58bf7

SHA512
3a61c63fbfb2d10d8ecce8abc9075db699d553e91c49ca09d1165f2f25f537784964db3bc015e5f3802587b8786b777be37aad61aa5a25bf3eb3bf40d8f1d240

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
81c78ea323ae508202949c7549e024fc

SHA1
a114fb129e2537f01feddf86281a817002924015

SHA256
88ccb0d39f22de44bba5ba12551569700f8f0ebd15325fe75d836659b23ed3db

SHA512
9a9b0d12695f9eb6961f62c4e85dacd627fc705a24aa5096d6cb9fcb9583a9d32f3d3df829ae08884d96123ccd79b191bafbb3d98045ceec227f845fb49b6ccf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
9d803ce7353205920962d6ab32e93cae

SHA1
29a7486f1b817a41a3cf6fc0d2a2b7b13e419c1e

SHA256
9e71a9e89aa93381dd01d0c5ff36774e7432c93408695fa23d4736b57a841fef

SHA512
41a80ec78df0d1d0894ffb1b2d5a71f37a7c2f03c80b7e1e9030a123c9a66864f438d9f68005974f79459ddba4e98d0c398d09575333e4f6a96ef30aa9b32b5e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
e27bccfd4cd0710012bfb485ca7f66ce

SHA1
8c8cd44cade655dc2db461f3e89d48224cb564b9

SHA256
88c8f104ecca87fddaa9ed87e19861032de98011f9dd1b5329bd2ba0ce2c7f17

SHA512
5ac6c8234f6d992d6bc16cc64bad5888bcd7d97ac2ea9e929d9d2b75aeefb553675a27d94f8abb6b960ae78187ba5d13d3dc41eaa211f2847d060d58c10d7ebe

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
43b5f487cea47329815031aa7c92726f

SHA1
9e7b94a1e74118991d1a32c233f058af4b1eb4f4

SHA256
b03bed728d6d3acb14404ac594e9f6a61b4e890d92f53d518d6790fdcec10c48

SHA512
7701ca24e47dcbfaec5fab94ba8b44ddc11c84abc88205f5df84ff57801b3798bc596368f5a46dba4c18372b9fbf80adae63415c012bdeebd9fee8ee64a69af4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
81d60070f99e9507e3a11c9bf51b9a14

SHA1
dc398e765a58b0103cb8f2dd7f7677c2927c8f51

SHA256
79ae6015504a490efade38b548a4c4dbe2ada7b6e0baabb5752a1536e50bfd00

SHA512
4dbbb8368feaa4ba4062ba889994832b7abd30226fda25b4abc7348ef06e5d671ee0ee1e9fdb16ee9a075d6affaa01a54d646648e1e78705a25dfaf1eaade745

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
791a38d15ab43299a27d947d544d31d3

SHA1
769553f43dbd51c8eccfc5f0adbb1d635d351034

SHA256
f4a4e64d9afb342ea42597fb1e6715386db4af55d2b18f1ff523524a9bc5c508

SHA512
6003953769fe282a1cb97f0448215deac8d5df82a67bb2db4b9e62172b1c8a2ec9047e35c5b27d9923a17a7be50e578ad3c1438756dc42839a29b533595179e2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
c15a6fb30dba3b491e2e1ed0b6e8cf48

SHA1
29d6664b867b3c2f0331f997827a06470148d21b

SHA256
7eb0b374a355f46812a6852c39ff86159d5fc9c70dbf54831eb1150f68d10385

SHA512
977da545613f626bdf6b43232133bdb66ebd65909abd6f2c018eb7e81f34423e1356b3a9d2a01837c8731e7e3b1fa355aac964f194d6ae83e89fb85334656863

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
3c9ba8869c95a2e3515593019213d8d0

SHA1
7183ae62d4e2284f1b6cdea7500f515f79f97db1

SHA256
093e79e39d54cb5761f51a3fddb92579a17643c1294ba84d1a900ebd3c4a54db

SHA512
961501249e706865c0783df16e55ba31902a2b4302de00f818f2bc0dc5720396f817cf3695744aa491b0bed0c46522d93cd1daa1bcad92e4b8e954f5cc3f52f0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
8b5aec82f5dc9838456f0f0371029c19

SHA1
403ce6cdbe5ac9b4e6c1e6f225672e13f1b01ba2

SHA256
b817119bfd2dd25624dcd4806a2802bde87063f33ffc5f870780260b2ea0ee1a

SHA512
e73149a5d59695d89f10c30f38ff3d7a8b5b06c4fefc604ae5eeb7b2c3d664d59b182090f699450692a8bbcd709b36a1458649bfe19565201e7477a6017a69a8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
dcc439ee0b99f43101a35fb9c188db64

SHA1
483d81d162beb92b265842382de65136fced5105

SHA256
36a71080afc03a2b8bde0afc9cf61338d76829483c5f20143825574a6468ad36

SHA512
926e1f0af3150b0f49d8ee8354fe5c7b29cbb446edc278bf0bff324aa180ababe9e3885d469f135e896449329e83ae738fed9e0a8fe09ed8eac825fbf87ba04a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
b1ef08bc6cbba8710d58fa17076b7231

SHA1
7ad1bfe7fe1bb329ce877c53b175d8e8cec78b43

SHA256
971e7cbf1461a8bb448057823ae62613a8168b4532d058d7a7549c61a39ecd5b

SHA512
250fbed50193a50e02f7d889e183366e5f387371bb3a6f7aa64cd2035dd5deb0aac7e588312b68c111b8020b69898830c1cde25f370cdbf3c66deb0a3fe25383

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
402bac86e8e40ee34f8f7c610ce92736

SHA1
967972ef0e098d1bb3240c64d7229ece0197b244

SHA256
a73fd48ccef249478f6f73a0fb61a5a550d6b1e07479641f754ce3ee8389bd5a

SHA512
a280e110bd6ec9504d20be8b1a4a2b71ada3b5236ee73090b26e75c985eb072015dda7de340d2a60e26a80b550c44cbe25d373a3f91c5708c844fa9830fcbe95

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
d86402cfa3a7006b92ed3595a6de776a

SHA1
267915638000d2160b9e41d1912945813fcdc459

SHA256
345f99cf477f1424697004de87a0c87baa2d80540588243e01976f8991d20b52

SHA512
bc47ee3c32f40d94b9fa6ee0f334baf269bf527e603849cacf71dd8f94001daf82b5d64c7b3991e43afae6209ffe3d5a6af7692a37c64c8c9fd9ca8da1e0228b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
0c57df59185efb47823134c42cd3bd24

SHA1
813e6b0a0152048d7ea17297928e1e5b3d6c9ab1

SHA256
a3cd5b39c2a281996d3ac00d27b85cf55beadea2cc07ec0c136e481c016b44ca

SHA512
bc97b93467e61ca2f3e40ae66b080a4d671df166cba440e56e1cb6bfd84de40abbacf02a5a7043dfe34019dd1f8d88daf4788ca615130b052e9295c42e5fdb52

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
c3c17f262e047058cc98f65134b3f11e

SHA1
07360aaa4856cd3127e4ffc0f57fa7357c84f81e

SHA256
6452363f802200cd98d2428a3e18df50b3632473dd7fb52a4052b093fa3b40e9

SHA512
025c585cf73e4a66e089bcd1142d8e5cda56e27004d640def4a7071bb93bb1a70269a745bd9182fcd034f6e9b1b7f0e4fa066e298a2a4e9661289eaa508ba2a8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
1bd1d7e466c4b1f0df7a1ec546ea3603

SHA1
f224c804daa0b994b464a7d697110513250f6509

SHA256
189e34b2110ff98706695f1a02a3df3adb8108bd4a75ff1d407f0a75003513a2

SHA512
c9cd0345e25bb83574b4132de28bc3b6608b337b5a8c4727f3a9d4dbd843341b2b62405f3ed5d370d36a9cb9d3f3c4bd94997bb3a20e90b06345447676df23dd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
088d1a7ba66548036943a06d44a96149

SHA1
da4e71353692a58c661a1b3bbdc78d2c451ba045

SHA256
34c5ed4d9a449d76b907c581e400d3f7639b7f2cdce1dae4efc5e04f9c320ade

SHA512
6783698a0ffe590afd9293b2843633f579b3296170058931b416b37afcc5da2db28cd261f52c95fbf079f84fde2107344ae6520653752a81a572529f2be91536

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
e7354860273b70a53d7a236a631c4f40

SHA1
f856fa18a123f8097d7b87581d683dbe193375cd

SHA256
4e1e758dc5bccf49873c1b0883691dbc4a73336c801959d3327a74e8374e8d06

SHA512
2ea6fd4ecc49b48b0fceaab5be916c3e740be898063943ce2579c96b49aafc2d18fa1645813a8d8b7ec18ea066b468b71ca5050f664331e45249a162712c6d4c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
5fc60a87ecff335611318f10be6c4a70

SHA1
47578a93fd966f336b924ac43304c07d2d8708fb

SHA256
20130505f9732c97b798cb382e45f6ddaa4115e478d356fa8d31fbd29ac10642

SHA512
472202b853921ffb45416d3608f63c5a12b367a80e74360ec2b51c03ae326bace2c305581ea95573bf5194595a4561bff6fba8b3ebb3c6aec95d17de2c94256c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
3137013cc06d9ee4795ee7f77c709238

SHA1
0cb92516393426b9fc8a3f45ad7035d8191beea8

SHA256
6b180bcda7fccacc8ef52367d551096d2ed80df33e30c1e1d5c349b68892eedc

SHA512
7b0b943907472b5786199bc9574851ebce5644b954ca0f94d0c915582eb14b43f2b6829d945af8be62cdccf9b1db5392173260fbc884b9674217c662778d0654

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
66fe0c732baab56fe0e2fadce832710a

SHA1
81c892c7de8b521c9402ef421ea2e7f1bdbc1d15

SHA256
b889fc65cae5cd9a64e384f5186002fb7a41988d910b736e459a988b2b96a7ff

SHA512
0f76667c13f1a5573dac1735a0e5fbcdf75cf6e1d1390f605ad2f2d888761f48c3ddfd5c97b6a8216678f10b2a8c8a1a047b83d3a257aa0af996355cebb0d173

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
44777c4a1d94f2a4f31f8dd96cb0c3ce

SHA1
8c6c3aad1cc2e4aaceb10bfa341d20eda3f4047b

SHA256
3466e8421282f99c870b50b57dd0da22499ec63c673a000fe36e9bf68ec4f249

SHA512
1684c66c8b18807320e92052a445317c58eaad84dbaf14644981f7c4663691b373c22e50672380b5403f2bb758b80eb5d31a0e4f1c894170a650acda81b0d5a0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
b065b7c6728655f43658f1c4c5c20eb6

SHA1
e9f809b1111c512bc2231be60775de7124a87121

SHA256
7654e3c13887fd6ee23368de77d0cfe8dc47a2901f677f54f4221be11549dfd8

SHA512
fb2410475177b0167d661653ab357541ac5160d0228a778395a1c7dc3fcca6263a6cf4e01186a9c42cd3f6e9e07f259e7af680000d0ecb51f441e9faae22c8bc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
bca9cba43754748cdc18614a55b72501

SHA1
3584d5f7441a16d9b527eb270ff1c8bec4f11512

SHA256
4b87732631be702c0ad8e0a393898c50aee98e68b8fcdddda0e22249a18c8635

SHA512
779f3d07624a6ac04e62055eaca4c936c4a08a82491feda2a215f7d1a9e46ff2e6dde2184a3fea8ecc1fa6a82ea39fb3d0ab2f824711cd75879a14b0e06d8392

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
e36442ccac9ee2d31db2495d32db9320

SHA1
3d997f93136ef214bb24ab3bb4df4b21132875c0

SHA256
88d7ad288c14f9a729ff02496c34f219fe6677bab4c3e1de166846e49c627a10

SHA512
24f7581a507610e1edfd00edf4896dd4ceb6929de1fa101d691f2e57c06a109c9b0d2bb84e7635c938d08e92a2008acd25cefc43b880f96bb29867326d53cfa6

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
74972f951a7d9d2874cb32f99a873307

SHA1
cd6c3fafe701474879af1d62781dd16bde4c310c

SHA256
82b8f5d7c7d876cda12ecf2d24fd64066cfec80e1621dc7f8f260ae042af213b

SHA512
5b6634fd39cc6fd7c40d1c96e4698a586c91b51f4ca7e2a22e51e8c3b27e108d4a42dba6f2d99e7e5b49aba64ecb7657e593c64a5e196c7b1c0696292b6896b7

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
283B

MD5
0798f82786161ca795dcd6a0999baf47

SHA1
d304ddfc3bee87e23a2a2ad8d4f08b8ee557234c

SHA256
a8e24865a0861f8281156eec1b3acb9e4a2e5b705923d39f07c860286510969b

SHA512
80b9d7fd8ce4b66494bd27eb0783c8acf832dd6c493a280e5e64cd2e8a9e0411c93015896fe965a01fad8c974fd2bbfa0d187e9fa1beddf4089d9046615edf26

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
20da76efef9c2d389b9b6f53eb76b460

SHA1
31c590ae4ec88fae1a5aa34d32d8f0ee718d49ca

SHA256
70ee333efab07206c599b903ebe166af2a252c54ecd47826b7973e2ecb4daeda

SHA512
821b9218c895219454f35d581f92c0734a95fdccf68fe4a210231ac50b5644c2efef079f4f6aaaad19b1b867120ae4565f9e7afbe0c65e15234297a1cf87f87a

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
345b82aba051938d1afdad92fb1bced8

SHA1
f475f481e1f44012f4d30894f379ebc26ffcdf03

SHA256
ab095e8c37e91125004bbac102f9ff87d9549c28027ad2fa4eb0a5d78eecc01d

SHA512
c668f23b6d9604d62902b91c2b3e301b00c3ab7258d7307d670599b3cc43e03d35c1d73cd5619698056aa144e4573d1ec983c4a008ca2ad995abaa28095287e4

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
3da6c184965805b0d4b21a9bd6886a81

SHA1
0b95ce907405b3103bbc8fc25cce2be80ce56370

SHA256
ed69af761f5053c6292ffc5795e36199c346a0ecc43c6cf1a7646cf11ce37da1

SHA512
21691e27e5bed35e4f901d6e5000d1a5a6f8a73fd234931f5a956a3ca50d21f6f28423653b90a48e2a893acc890a73626d68d992fd49225db24ed24e572fcd65

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
7c8476a7121f9c1a83e442bada49096b

SHA1
df9d55aaebf27558daea8f2b07d8f2d170784026

SHA256
a5a42e95d61cb9b254d741c355fcc02d523ce68556accb00d548215f422afb83

SHA512
2d3d98115ce1f9077189e89daec1b908b9b2574e37a40c3d1182c4b0000185b7c6584be8efd171dfe6fe128ffa9f169c36f8a71986610511bfdb0f7bac6bf4a1

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
7a0deeba7fc34b171f7e155a68d88671

SHA1
a7c93228e9b31403c46cc151d0fc1bcca08c665d

SHA256
f4e35a7391ba376c51c3260e7c5541a63d6b4c062830b12a9154f13f4f42d5fc

SHA512
1ac86908366dde8e2431c881bd807265534208c2d2752e6fbd6513f51e5ca0b99ae239cc99da50120c3e98950c675a39591d2e7df879a6a892263f14b23e651e

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
58b3aa9a1b3304da9e47c6b041fac3cf

SHA1
1b697214268dbb78fe5e9e4fa5e429c0b916fbb9

SHA256
1fba5442d0650573c53d8d7acd4ba99e13ff0a4225abbd271f86f9f5e0db551f

SHA512
2ac947e8a31f5f577b2edb340227dfe4acc5acc67a94339f5673ed672973fa33be77a9cec817a91755056d827edbd02f0425d1d04859a6fc939ca6856345d829

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
e09b8ebc193b353794fd989d5b28efb5

SHA1
0a2dcc5fc03b9eb1ea4eea3fc57a5b6f9e99d58a

SHA256
46f15c1069b72499b03041f96362a24e175dd65bdde14e9a9939e185297cf048

SHA512
540fa84fd1b95e8245f030ac22db62275b02ce4cc26ba78ca207536e4e4b0e47fc1aab839d2141af536bb510f4ba4c09c68c609139066287a1656bd4d49a9731

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
07966d0f1c3be1cd6b2cb70068a41cc1

SHA1
cc333bd8550ce35c0fb0242ca5866063a5b6d305

SHA256
fa7379a59962be0ba0f5881879134500af21047a8cf41bb4d9e8187864c246c8

SHA512
2fd164a3ece7077137f694db814cdd755781c386bf84d98cf5e63f32ef9c07a1648ee9dda294e6f5a4fe30ae6804b25373b9c28522051c0ca4690b5e0c185beb

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
4136de602004956963036ea045433f64

SHA1
446c650df107c44446adb9eb4fc94cef355ce5cb

SHA256
080adb58d6f82324d4c3951560a601f7cea810ff2d702d3e8eb6c2cabfc65560

SHA512
70b7fbb15e7700e98883b919707c3a3a68d57cdfc5a77020c5daff4c6c93f79c4a8627fed1043f5925cba8bc0fd724543709eccc181f2b1e3068b8a523e7876e

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
116daf7b503dcf1a72debab072af2c82

SHA1
f314fd2b02f1fe9b84a1380ca9e19e0dd29a0c8b

SHA256
ad9b82f656340d82f9a17834d0e7db2d22084537c2bfac5f52864136cbc4e4a3

SHA512
6a3397da65c642ca5ee274d66945e5b951bcd9c91fe8e154ccc550ddf94f17a239b91238b7bac99e94bac2023301f422d803a76addda3210791a6b9afc11fbbf

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
e94ff0002f647d551eadc4a159c2774e

SHA1
f451993bd44f47b83a263a1cf8443319edc71890

SHA256
e631d411b87071961bb55fd4c0aa07d26f3483153ad1c3efb0860f1997f6390e

SHA512
3a36ecf197334121618658eed10fcce9f1a7bff4e38cc4497fbaedf1bdfb1e4a00c34b1d12da332d3d4d60ecf09572bb02ded5c984a53c40ab59ad8599b1eb47

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
38e9aa213659c92b58ae7c150169f9e3

SHA1
2cf69eb9ec8cebdf31744e0407b88c37b58ecc08

SHA256
a1a349d582deb90f5a025ddc346e9d1b7be6673dd8290ed54893f54bc1e544b2

SHA512
9b6d38d6c9f4677a2c4468877bd790404237586ba6e943c51b2ac4bff4e254ef4ae4b1df26b2ba43cec48cdd1cb16648524a46ea9cb1e3150bee31051e819320

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
1facbf1d4c0e9c9bc57b5e5969b4f58d

SHA1
a1578d2a674e922399c37480f8343520656b2c06

SHA256
57dbd5cd55700b7551516132a49dcaa0995e1ee39062189c4d21ff9746c938e3

SHA512
2bcc4cac62bd88b0b22468587d40cf3be310ecd9d0d4856171c038753324ad43f9c9989ec6077cf0a4c0c5b887a564c92e77e6af3ecdbcf26d7a26d6d83b904d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
cedf0408cc74cf8aca3e9a4ee4fdf211

SHA1
6bf06a974d98ae3456a4afb6029b423623986806

SHA256
04d325e5a81fcad02a280221ef4d06ea8244932f2bd01c9c52e3e957f43e2abe

SHA512
e1b50b5242ed20c375b02e6bfee2b83c0a4d66caef8f6bd0ce6981d6426d05d3b0d963f93885310af6902f29cd593748469ace1e13553523e698daf3cac0d6d9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
d26db18cce1091b41bf244200964f7ea

SHA1
7756a8b2344f06ed0482cf25487cff0fa8aeea13

SHA256
b13a5d0a4c73fd335ba8c375f1cf790a7f917208b390a719a98f049e80812002

SHA512
8dc74421e24246a0aa9b7cc65640e0aee5387bdafd77acac961154a792d7e574ec6434f022fceb59551cd4f6f800e72bb19d0b0df66a471263bbc03d93948966

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
a8a9ddc50a0a75193e934afefb20eb3e

SHA1
713cb0b063ef436c61bbc21213dac494ca3f3945

SHA256
90ef89e9d4aeed9ba4565d54efae56d7fdfaca9e93a5ba4161207f15c6eaa503

SHA512
c2a7fe97ebe2e84d58ed8726d46f42a5a9565d293eb16e0b443f332a87a5cd2e723e859898fe50e9e7c8b60e3c96f34f0ff480db3a7e5a5e7acbb0a96d314189

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
978b15f5011997211e7a90475b781ce9

SHA1
144bc260d46d58d30664b8551a175b1f745c2785

SHA256
931f13be3c4c9d38ae3cfce1bcc7f0664b7d8f32e58e4a602274448fb8064ca5

SHA512
2dc9858444637ec1848ed769b306669aba2de333639fb0aa2d67703f61759fb827722422f9bb53c10c4e309f702c85f3aa245aea6759166eb9a7b095fd418aa9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
69b4de8224944fde991ae6db7351fc17

SHA1
e8cbe834c0c21fadbefc09e28763687932cc350e

SHA256
37dda592983d02cdf2370a8f4d8cc7e4d463212c53c0facf5b0c16a539a8332d

SHA512
e699a6dc170dbfb5cfd2dc8a1934156a260558dbf17ae53d2ab5fa2825370325d8a8baa34ccde921cf85380886d5564401fbb1a07fe46148f38248e8cd092000

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
36e04d470c096e8c1fbc70b5ebd02ac9

SHA1
4de74e587304ca7faa136902053e48435e282b41

SHA256
2403d750497b1e0751b5c5087545537eb4e55cbaa2d1d9923b7accaf31a34915

SHA512
9619082edac1dc2c0c9cb92854112d73572b7af8dce2d2e7f9f41335b39e997267d946bffd1fe8dc760f8146d3643802e10fe1c177d077ff2b4117348e32b09b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
fb4b75fdabbc42a326dc9581b9a1cf8c

SHA1
d18f60ab0f51fdb99d10ac414582edf292578bef

SHA256
d04dc656be18ca584c91b8b82881656eb1c9859f48df1324f6158c3000bbd18c

SHA512
a3a1f02ef038cde0c927c40f43d105f6d8034a70420ae4b69d2d825be8892c88eacbfc862395311f636671d4e2475da4029a591047698ddd5f94aea77112452b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
a7340cf332d91988147f213871f23bf3

SHA1
d860cf0730137d22711cf1b6d8fd6dc0f898139f

SHA256
da4710792a55d211a6c8d3b26ad855f4a710797305ce3dbc8dd33a504b0b096a

SHA512
af52f759a75efcbdeebb183a5581bdfa9ddcfdd6058b6738e8242a7a0232eb1dc953f827f610d0ba0df6ecb573af65fcfbb2d4f759838a9964fa0876a8b7eecb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
5de4c3f900460b15ab53bd3977d5f1da

SHA1
de8dce8214096e7b27079e49e8b00728c0daa05a

SHA256
9ffd52671262ce9f06daf79aac06451e448968a8b1ec9d4f5324a1b310e1dc19

SHA512
518a4e26795d5355b4001754eea5694c427665935e5201c5dd4647355173ad75cd9f4a7fcf5c7e35e966534f67aff43d3885dfe0fbb1d2bbf8c2217a7f49449e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
61a405ef9858adfae89504e87b5c850f

SHA1
4c6e7349fc5e8e5c1ac6110cd7f559dcefb08b42

SHA256
80d0cbf3ce939b0f0953706950b2087b7a5b7a99e6f58f0a2d92c8fc94df8986

SHA512
f9f74cd27cf41d0e01ebef4c514c43cbc10a8756caf8fa9438f5a186d0b2beff47aa443022570db7a38d7adc0e006a955aa3ca0c11e554aff55fe6f5c13aee57

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
40548d82f29040e686fe8f90fa0f73a4

SHA1
20a109e0418dc0b13011122499bb6029b8e849e0

SHA256
520d8c8794d6a2b8d9886ff20746036ba07e4225a61b2d462ea3246024d99916

SHA512
a890eb65957d21d9d8b308c72bd064b9a5b8d4188db82a1ba6fd5749462500fc0bd38dfba5cd1843f4ee8c159bf16ed9706072710968649f9d4049ba2ae9456f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
5cbbf97e00df26ad580b7e306c2a57af

SHA1
cb28456a7d8668bc1291731856b1db62c3a9f797

SHA256
34041d1dc0d87315a66d7f3531d03ae53dacd6364b2b04abe8ed72fe13fa227a

SHA512
a96465c5b67c35942921ee5ef7e72eb643a9a461541618597c115a748aad838509d72ef8255fee1d0c7680be0cf8b55de2b73230d23f8d98911e64328ee3d736

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
fa3f19c7537bbbb41e39a4495ffb6daa

SHA1
92c6eeefc8435da79cb1cdb09ee88bec55b2741f

SHA256
9694dbee4d870e1cccebe32ba65105539a7022a83832db1cb3d522a9030e3ea0

SHA512
48122e538a0981a74f9ccf2ad918ce14339770da1d6adc0c8b8b6235831c5aeb2ecfb535ecc9fcb55ac06d06d927f640ce85e8d9f0ec6812bea31a0eb8afc3f9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
0b54e604f381a1e637b76363ac576524

SHA1
2756a92076af1dee612c6ee6b9024a9f02d86e1c

SHA256
a717d586949252ae34777bdeddd418a6852088da51efb207c2ba7e771bf91fe5

SHA512
831b326b7eefeec777daf4fc62049389d5b73f620f00bcd4a2ce0018440057f7bacb234caa279ea9875a2e52e04eda95ccd174ecc3340eb0671d9143c6c103ad

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
3340e2438aa58d4a01ac7074e622bb1a

SHA1
3c92a6c0c0fcfff1306387cc587f00f9f1140df2

SHA256
643042f69602416ca584426829e076fa73c88653118ba6b2da086a7f560e3405

SHA512
23ac18ab665797a3eba3a28c05252d016359b4a9c32dac6f62325d1cd56fc8630a20d15f0ebc49bab8c05039f4f994370a661798a71e16fe54abe0963e06520f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
deb090898c132bb4904beec1ad5be387

SHA1
b69068eee24ff0ced26661217b803c17d9fbfed4

SHA256
52b906aeb0e83b4a896b14656f3444b7151cc764e1f651b1dec655c96b287aca

SHA512
c7ecbe32b84b5797635a6ecde80eeb3a871ca059fcb01e17e80dfa66a463a4a42e585d0ee247c711939d027eac8100a2949fb006f1abec289090a49260f8cc16

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
aff2fbe7be96053d205cbb2d2f188a34

SHA1
344030a0bd8d8c3af447a6e90e67c0d55611f405

SHA256
4d2da59ce1f113ef00c9965c44cc3230ca160ca1577933ff790e608d98bc9adb

SHA512
de004f5f8fc604996b604862f53dc3e779026ef0a569aa6458314bae969a9e12a938930fe233d1ec4c841d46bcc995880d4c0fbd268121e5ce733f2960e8282c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
0d653c247428a1f71cd78cc9939b87f5

SHA1
a5e7c5af32581469eef3f1cc177c816ea2889e6e

SHA256
d9f2869b1b05c7b25d47f8bc29db271b8104b5570785ea3c125ccd00bb63b01f

SHA512
36dff9a3687cf0af79347cb2aa5102e3b0113dfa06303f609e4f82f5ee43540f8a89afa4e3a9710b9d0c1ba330166f4392c7c477c69154dc2773a248b7ab5088

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
0057e0c86635d98346064447af0e0981

SHA1
dd0972d395d82e16ce7c42d5409092c09a10a92c

SHA256
3fb922b57198ef63358c0086856791ad98f24c4c00c95de48b3c1230e2c76d4e

SHA512
e7deccb979d52244d40c243ca18ee823b66626b202b2545d5e6b5ee8b3ed4a8d7043ad2a1fbbbd387a991c829f743013f81ba554c4f41fa9daa83f7867719d7e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
9becf8b3127cac7c0b07bf9137804e3b

SHA1
b7f3732fd864eaca4ed37dbfa06aa488ddc3b037

SHA256
31ec1f3e45631fcf1a02d96343cd48c62aa40d838327dede3a211f1a78c7e60f

SHA512
4fa08c4cc2261d91a3b3d00402261ff449b97e5bf34bc4139ff36e2002a7ea533906e86fd2ee5e095454dd7b2fe68b32aa88434b2c4d208d5073454b89dcfe0c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
ab5b25b728423fd926b6051d24ed1630

SHA1
f7ce4cc004d2024cc25edd147ef4d766ec0b593e

SHA256
bd849b898f2ce100fc98d6faf19d65c4ea3eb9e24054e89aebe370ff0fc67a43

SHA512
e92e921ca293a383b13ab13735836cef60fc510897a2d40aef6b56ae73f5222bdaf102ef7349e86bf50f988757ecb8e8227ed4e2ed516aeeff5a920d4df10843

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
fb3eb340d4d9fe162e18e86f8696e944

SHA1
0aefeb10c11c79231d2609af31d4d7dbed87e138

SHA256
710cb3f91a5a32ed015cf05abc093d93fb43a98c8919e592c275eb2f65ad2f98

SHA512
827bd284061f64cdb812d2aba65bd580c511fe3b7e235e099004b710d19b154bc6a54e05669350a0677c9a5eebbaa2f5a769a2641cf18281a3bb552c663105ce

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
e6e759a4937cb5925e41d8e91edadcde

SHA1
d5ea3a9d4db7af58263fb82c6b517e8d315edadf

SHA256
730514ebb35497ffd36b9114785040d23da5f1c394937af4edf46603ee80a9a5

SHA512
c7bffa5f22db49b0bc041bf8e7f49cb247b92f9c80b4ffaef1e7b33d17e5f7b200103f5622bca048af94538524819f34c6c2ed7eb26362ea8003deaaf4e5d7b2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
8cf0023d543edb41181c491803f8b386

SHA1
2d9250de357aa2920bf7a1a24b3f96b1a2263cf3

SHA256
8f2f77500816f06cbab4b48eba3d351ae8937b538e03c35c3b5f081bd2396ef9

SHA512
2c8ee0d64b8b2ce9db2e409cfeee2713e74e1ae5f53985a8bec5bea773d90eecc40578daab5f81da07eb04aea7d24e1d20ae0ca3dde44cd2a9bd59d301423dcb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
108d5b11e9267209b97f27b3ce673b14

SHA1
88f2f4b085461fb91fd059a8b66f3bf6e8713c3e

SHA256
bd578e3bb92ca4c4044be10f6e7cdb8ef7e6b135f2a858105eb3024a55514b5c

SHA512
0c04e160db40eaa4a8bf28c362d67ec33af2c7142b8230e5d5412fece8ae58376721afa6cf87bf988c6916c41a68cdd68e59cdde60d47f5a9b4e47481a01b36a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
0454445946e1b992c31d26fd4fdc3c6e

SHA1
6fa09a4e6ee87e0d090ad87f1b7608a0455da1df

SHA256
28f7b877a8b8151e60993b173e1a2551c3ccb6c444234064df9b9be5969ac5ec

SHA512
a4ae1a40c0b2ff674f0991547e75878d7ad3bf2fc894ab8bc9e7631c6dc32a0dc741a4cfd0aceb90645a56700f4cc47b8233a6b03d9b89145b8462085c335c74

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
bbaca7c55e40d57f2cbbaedf775548ef

SHA1
94baaed23b79f2c189fe1ede04c4918d2d2e8ee1

SHA256
3cb5e43aa0e1723280bb15f50ba1b03ce27612c5c691b6d72414dde66c07dac4

SHA512
ae7d9fb80d5a3ffa525413dddc254779bbe4d582ffa9c9596b0ddefb27ce168f11f9aa454b7ae862df837066fab3e28554e0da0e5e66afb4402eb5ce2d61be8e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
dd4bddf64b78f5052482e2a0be19acf8

SHA1
7680fe3b7260d2694af22233de25e6a8b165b46f

SHA256
7379b9a987926236be461d17e3aa05c1edf0f9183a0a94ce026f6a468cae4d74

SHA512
88a5a5d7b8155c6aff0197da392ea08cba38799c59a5c3207da0d010f268d710fef3e9da4e8b392190df97b0cd450db6b78074c943fb1fbe78b2617c3cf73b0b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
0617341d1011c76d4fd55b381f6a46bd

SHA1
5dbc5963b1fd3dde464689758808ec58cf3e306d

SHA256
5393aa91c947be7228dab478a0184740fd7878474ad4a5c7a53246dcd7f32fd5

SHA512
8fca3d7359073fcb3e76bcf087a7568f328e45f0780e88af8675b5a56460c346d5ac3650503d97f2e19ed9c5d7b577b04cc20abfe2a73f5e75f7761b549f6184

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
376287802456ef322d4961d94ebdbe91

SHA1
796c447139e865a23ae7af8aaabeeaf975aebc79

SHA256
c1c9e0f029d6bc8deda8d6070da27f7070f07b87782f45a164e11fe190356e65

SHA512
fd4181196041f97b828b3131497919d37119fbc822e3c56aab4440a985d1324eeec6d666a37dbed8b1ebf11480d4c64f06b747a84f4166dd919d499bf7823759

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
e3f258b7d3e3ed501fcebc40de94c4d2

SHA1
1dd0cfc9a746825df2ce6f7e1a75b952bd8e24bd

SHA256
d46f6d88c6f6e72e838229061ec3d34c44e5148481301f95fdc7e6f540dac32f

SHA512
18f54eabb7150eef61ad4d2f2199d8b45721fc8b749f13be699ca0e664f208a412faae473c7fc61ca302f80cd0c80b6199788e751705036050b77cbada6279aa

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
42B

MD5
ac154d8a3b1315e61e5905fc6fcf547d

SHA1
a50f49738881b22bf11638420bba2b73b2c2368c

SHA256
07fb57b9dd876615fed4efcd8a0f138e69c935e952b87ff2f4115125e06a88ad

SHA512
8a31afa3dc49ff3979c1c2b5b46aa56e4dd2edea918d520c4f414839e6d9bb852430de0c18962480e17b3748bcf7f2c7b0d2f593d70e33be11366fc099acfe0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662191305923.txt

Filesize
77KB

MD5
a3cd6e89840377e311be880bc6df6d19

SHA1
5c0543bb851c6d3e54ea1c0f1411a9947eef69fe

SHA256
93762c05a59afa55856c9bf2f5dde068be796ea44ea55187c99c229ae21e9494

SHA512
c2f546ad0a1af4143a798a02b41b5dc9a49df60ecf0e6e67c349cd1e775f3c30be8630352fa6529ad5f94d5ad479e99299b7d9547c4d0d9e8c5ed90f9cc9604a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663623337830.txt

Filesize
47KB

MD5
f84458b068cbadc932f84e4e6ce5ea46

SHA1
1ad28a028cdd0621ea34a69bb46bd166341c2c94

SHA256
a8a3efbccbb664d4570c5deefead309f57f1a745cbd3e084a7b67320789492df

SHA512
eff27db1eaf1ec20078b1236df36a7ee34f4e054f24c9c9050ecc7c84a4dedd6b28ca5430434da989c5970347dde0834451362da44f99924251f8742c38bd282

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727668521654543.txt.EnCiPhErEd

Filesize
63KB

MD5
36f8f2cd4b963afb58172dbc05af0a63

SHA1
37f04cb9e78057d7874e8a65f41c932dd544863a

SHA256
bf8292d4358857cc1a42b00bd74cddd2db51555409ba598fd2300746a0132638

SHA512
54c48a358332819fd2c27f949207b784bf0cfb27e9a84b7912e3a1bac3c21b6f290d2f1ab530767a022f7f34b153cebc00fdd8809da0ac59b7be51ffd43254f9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671211214398.txt

Filesize
74KB

MD5
b4313ec02bd78c8a944e090e4c17dfd4

SHA1
ed3c1018b49894d10c86934000be8e295b36c13e

SHA256
260a09e73b3050dbd309ae1843ce380ff47527cc21c04a39f1412109dca9ca8e

SHA512
8422dd1a68e3e6e270f05429c5bc9af80761f2ca2562e6cea4566908849abd5b227d1d7e29e8fb179ca8c81684d82484c50e3ce3f1d6562382f35c454aca036f

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
a6c30e18b00f118f9e0b74d39eef3e27

SHA1
694cb79c0e03fbad5cc8e89f6bb8d08f1caf0293

SHA256
927148371860c3a19d0a32b1cdd1a872e8b09faee3873ced68624365af1e07c4

SHA512
01e4dd05e8357a68393728ccc6b594b279014366b402204b9d25252db77a2ec228159fedf522a78575b474a7f10c3d541a37fc656ca141a39c84262c1acd33da

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
373191b0193289d8d3831987246b8206

SHA1
6f3c30807d13ebf6c78eb6f6e8489d5114a624cc

SHA256
9af3b12020c841ee03661886281c774c9a5a35055bad821792a593e8ed98c2b0

SHA512
f3351fbbd86455cab17c98abdd15efa264fdb0c61a57f9af6a973e0c62a80060a91f4f5d2a569402c3ec60da2ead0906672235b92e5d295f18f302b19c1669e3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
28e1bcd4d60c3a62e5c57972242f0a2c

SHA1
91a5efc229dec23db964ccd84743c9a569500fab

SHA256
f7584cd18cbcc4df29ec5bd5bace5eb540bf2fd8b2247c6664a91b11484769ba

SHA512
70a085790aa8d39713ffa7c95c60fe12c2646fc443700532dc13b3fa322c8d5046e93f4099415d4d57d6ade4a362eeca042361094f8246929d856b1ab647b8b8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
a2018a174a3a44ccf96d443d840e1055

SHA1
64a1cfefd0e654d9fffb1f1f84f6103c6dcc8a7a

SHA256
d1023fbc1bc19c34fafb233ee5c19018358cf6099079f38a0547217e167e541d

SHA512
40c6ef98bbdc4a8eff9d64aebc0b366e2cc760a303177f1e551d0c4bbc571c8ab6958ca5d8a3e5e7c5f5a3f31cccfb1a19864a0721ef24895a2035a7105a6e62

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
dd070b15d8e292e25ca67a034a46efbe

SHA1
4a64c583ddbbde8c7c88936bd9dc72b4912a25f2

SHA256
5ce00439dac4240ecf2d4f3a5c553ddf4baf2c8fe225e1839afe236197878c95

SHA512
4758dcedc19710a32b207dec03a8e1acce8b92b741571ac33c6b8ed5dfd3c906b850dc3e8e92e76de859fadad267adbbe7086a22844bd5326a21227264ec0377

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
b5e47e28586df04288f4b0cdcf1dc44c

SHA1
389ab0d5ce89842798cfbdbe09bb6c6b40c667d9

SHA256
fe2d20dde4cdc9e1447d847b9810e315abd6b94e16b9b1fcfbddd522aec243e2

SHA512
f9426abc1b21b830811a9264e2e1df38e2e562619a3ae1c21998cd454d527a47297b62a1be8fedcafc78d1dc8cccf41a55165b95c483fcf450d811656d8d0a64

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
12ce6fb5e58a440abae336616ea53941

SHA1
55f24ece6c3335792c6a32eeedd7bb2f1975e0cb

SHA256
50c9332cc7f20a817c7cf1cb24a4b18a33f025fd46c6963b8e41f0d2aba54547

SHA512
adf28f0db10895f52ac86fd7e93f5c9e80345c8db9f05c2e1c2ce7e62597e4830938b9044beb180bcd474adad80bcc85f20db874e51998702c65cbd5792e3c63

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
d99817311ca43f6351b2c7365f2d1c8e

SHA1
87d87f7c6abd84f392961c0ed12d7c85d01c6578

SHA256
261317d3b0848c80bae251fe4359af60efc807b24d285ce91b6a117f6257745f

SHA512
20b97bb7fb7ef36f42a8d4b339144a26863ef49c8bd5e1f64a373b5f906485be01eed823ea97ca6f8baa7c3347b011b8ad253f2525919a7ec3f3bcc877757fb2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
b6375aea5b3687390731be08aff1881f

SHA1
5994a29956af7f964bbc3cba39daeb9bd6dd6d6f

SHA256
196cff09b193fe392aeae8322e1f1d056eb974c066432cdd1f99003b218f3e08

SHA512
b74c39c1b752d4610aba9bfe0f963ab7ea8f9e3eb6a7b46cffabe53a063862f5ce2f2db045c3103ca26c00797419c9156ff7e95e4207192da77b56779de02b57

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
06bae1481577dc2b690187bcdd51f208

SHA1
2c9abb8ad3f78d773871b7b4c5031cd2fcf38331

SHA256
533d9ee043c650ba8f4ca5fcdab94bfa9ce4956d2f466a2102bfd679dc543669

SHA512
6d4cb1ecfe5084d21900a02d5a597922986f8a54202f2db17cd8d5bea502b69454cae0e19e39db847b4c77d0b27a7dd9076842a6ab97fdaa1e3e50a4aaf7f055

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
d71522f6d324cbe19e464d2a73bfd2d4

SHA1
373586a120d6a51dab204e4c7d2dec231f2d91e4

SHA256
626236e8289c0b3bcd2079ffb635a0cb49a45d5bb8e0d1f98fe181e0c90d2fcb

SHA512
d47e0500c186cccb2c7baf82d2196a3999481c6c0b02ac1a19e43bae5818261018eaf50a584e6530fb67765248567a10281956630d563af0098f79d80d6be0f5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
cb94a7177fa2ea599ef8d3a7f70ed345

SHA1
f90e8e361edbe8e9e971b687cd58c749d9912473

SHA256
c4a4adccde1bb1b5086922556493675191c0030633f57cbe13e3f5936db59b57

SHA512
f8a9b3b1847369c3dd48b99eefe340193aebf9ebc8fd6dab83dceb6e7bc5f36fbb7fef2ffd5791994425aa2ffe4ff3ee7528c55d6aa4025d972b171b4b86c3b8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
4decab8e1a579c3bf63eafeb3f674809

SHA1
6acf4b234b604d3d615f2b483f806e0e084c5ed7

SHA256
134dfae0ce3e5f5ac9a93635afdf621402f7df8a397f52682238556541dae116

SHA512
a8d74ff6a045fd1273845f06e0110b5f30a8877a1ba0c6d069906d024c968b059c9f4e8469d0776d87bf2076a93a75518f433df75bee70c1609fc94fc3a71f2c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
e43f3c14a33e7a2d1ff3a93d8ce39caa

SHA1
cc8eefa2db2db8625645cc19a4f292fad62285a7

SHA256
5b1b8b59750c26ae9f00f0da27f9fce33ff60a6ece79b542323325665388b106

SHA512
560d1b69a0671d69ebd7705cc24e8899bb6b2861dbe217befe1379cb2a2c672ea6f095c5d475a404189cde4bd136a2900de3742c6ff3b16f022ce544efe6e145

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
196f4de263b14007baa6dea269819fcf

SHA1
6ec97c14212ebe4b52ad827fd91b8b905ee1710c

SHA256
f8a8043c725aaae5ee489dd1f5fe74a6a8e952770965b759e7be7f9639767521

SHA512
49eb7ceaec7e4e1f616fffb26ad7ae7ae78508530d0f43e67cc97cee72b637a202f0be2b5b2a7e9b2552aa62d8b4f66b76954fe1b85b784dd78cf562e3134a97

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
fdf7eb3b1bbc883c173378ef79dc7675

SHA1
b84e000b1df47041aeb8f1d26fd465a6d92d5fd1

SHA256
10284aed46c1bec236fc0ab7a9963759513e2e4b57cfe6affad2e9ea7e561d7c

SHA512
32b39e446bc514f120f26cbdb07c8fbb74ec1ab45c54a2840eac1d3156187be2222af2027f687c60fa35a99ba04c3893e8473d5bbe79d3f1efbebc2efe36b522

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
3a3e2e5cab16e46c25c3cad8a684eedb

SHA1
37b57687977aa02966dbbb48a51cd1e15aae20af

SHA256
e4f1a45ef9c30d072795856927ef916332d8e799bd1dc57566a5fd7553b71f01

SHA512
56e912906ba37393e2a92a4c1325f5409b43af63aa04f57354cc0f571167c5b1bb24b70fd3ad29cdbaaacdb3aedea66a3162db817b34460c49f527671d4ab6b6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
5a2573a486b47a91092f093772d208c1

SHA1
226be1848d357e98234d6bf293c192ae7923d996

SHA256
cfc1c981403e00f46f9b641297b5fdb1db483731a220f66b2cf5f6348891991a

SHA512
11bfae77fb95a825584f34a614630860dec094b57ae10c2523617dd7a362d0e8dce2444a8b917f41db5063c986efac1d6db88ca64f7c0f2c3b80d90bb5c72d50

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
3b576b26485f8335a6266379e01e17db

SHA1
b4ac4fc6375f3efdc69dd472e9d2060ebc3886ae

SHA256
8bde1307535e326f2fe65a4c96b32cfb6de1019be016b899e9c4924656191ecd

SHA512
d42cac3391f15e41f41f37282b99708978ae00d0e4393d8da1ff8ebb11649a12b68452a7c3547034a6bdc6b8f80b84727d1270011b362e0ff43a6503fe386c7e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
8f2b5bc23310b0300eb0f9e9f70f1efe

SHA1
9d6daaa907f315e575a12197e7430ead8f5b19c7

SHA256
eeaf18b0a2a01a7bd17daedeca378879ddfac7eb2434836581dfd31638e44b42

SHA512
8f6d858e55a244ed60f3f68d105d71f2a46ff241eb82784fb10dbcd1ff2bdf981d8430acdc132b17f9dc6a31cd7da7f6812a896a09c4c95711e89fb2954646b3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
57bd182b1c493bc4ab471fd012d2ff26

SHA1
6694b9259c0e3a77c99ffcb1cad0d9430478523a

SHA256
e356d1825ab9abeb7e0fa93f6551fb7110bc380b84a7dc18248ee42527c6051f

SHA512
3e1330ac5178b454b1e6ba49a7a05442b55c29afd3f54cc3ac081c8a7315b0550850397a486c22ffc9a3438abc27ec83af0031a1f0563e4cf8f65cecb1d498d1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
41f57b3592731c029d97390f6e8034c1

SHA1
fe35130e6245050d7a511b6210787249be2f0062

SHA256
08f52261e99c2a751367f917c0542f8d21b5b10599e90bc8954cda7e7b1ce1d1

SHA512
9891474886269c3d9831b17718143b25e46c9e63665890cf2f5583d5ea0610cbaa3599fe210ba82de4257fa713972365e71de8d1bba7303ea12e5308670bd1aa

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
a5221ff2e02aff7a133ea546ac537246

SHA1
fd1c88dfb957447529c9427a08041cf5a9f4b348

SHA256
338385d91d6e3e537d965a425b8a4e5f87e57a063f6646c0fdd7bcc57a4dabd0

SHA512
2970ff8a54407c24e08c1e953817e7e21edbcefc515730f90415b1427d3aa889a70c98db8a967f07fbd32546cd94b1c6e2016a8afab62e520adaa7e8b1d89487

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
30e46b643a2edb34e747d2e114106a01

SHA1
e4cc916bbcd37fb6d61bd2f5406fda2b877ef3f6

SHA256
643041d6d5efe60d202972168c52102f6910e9df067d38009d71a4b5a21572c0

SHA512
a500f59e1c5a271f8b54ecb16a7a6145b9e3699416d808304f8b2b9c1c6d23f8caef12c1d009d78ac02d2ccb88368df7ecc6d4c6efc1056cb4d9ba868b719f02

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
87b021c34b92aa08ccf9b3f97b9df6fb

SHA1
f31dca21f151fc9ed45cb8f33cdd47d3d6bd5e1c

SHA256
1d156c7424bebfc020d57c30c6c078c1731d68f95560d4d7d7d937f877680d9d

SHA512
5dc3bbbdd2c1e90c6f01f412a801763c8372453c1d6e83e354dfdb14c3066c4a882ad861c279c339175eb464fc2d9255bb893cb9a7106349d43558b0557f9a02

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
300f4092c673c33afa225c833a88a87c

SHA1
e0afc8f6335ba403bf1b9b79e84390998b8a72c5

SHA256
12385764004f091120223bffa1c9372e7ae96872cbb65a4bc961310e81ad2b24

SHA512
fca73b96427956e83c42f74a74bb3d0fb4adf118b66b1257341b1a028ae2278eb44713251c3c170703d849bed79379e6f1769d1ffb53be976111aa34a2b14753

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
7c121b65663d6390152e6993d88cafd6

SHA1
78c9ef7f500e7d5da043ba97fdeb2c8ab57d58d5

SHA256
2d75fd429e6026406494aaf1d33f1b775f2fbd950908562be0be484085aaafd7

SHA512
3d4cf624fef952ebe08d53582a018c5478d230495965dee3ff4cd4802a922e895acaf8b69bc1619cd139b56f417a35d2839c956088b30b0fe4d95e703d5039dd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
9bc25386cfc94a870e848b98a7505f30

SHA1
d5607a09936a45232f93b3d2b23163ccb973aed6

SHA256
7830a8edaf432ec3d5001d3be2532c78e669f94456ac0540f053c8e8c1cad691

SHA512
9206d63c8f9267ef294e32244479f7b2e1fea7008322c2e3b5fae16ca4f86d583cfc568ead3dd440a251c26b5dca308c47426ba6668424d038095673b004bf8e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
f91c773f9ad3586aa0074065eb5b1d2b

SHA1
e47c9fd16c7c28c906c271d2f651ab3561623dee

SHA256
6376d291c288a2b3c5a01cfb5049756d10f7e12086d5208c87f0f84ab2a34958

SHA512
7be76431ca60ac9a5afec747f565d2c72493fc53ef579cf207d4ac396f2daf0bc486cdaaadfdf51714a3f7359682b6f2f39197d90452fa94075ef8b6652bcf41

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
d3f85fce1786923f69154f83f7f898af

SHA1
9ceed3e7f185befb64c67d14688ef3b631dca349

SHA256
d8b8ebdde72ac8fa00f2649cfc3c8c2cf49e0e0dba5e87194fa15bfe1b5af9ba

SHA512
5f1a7a162025f3fb78a76b9bf5484c56b08fa091a70fa91b39e07b2f2921a42178d9ce7c19cca6935542020505c96cb8a3ce427be4638220daf505e04a07a315

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
cf3f52b58c5b26ca97120a04ff3cbd1d

SHA1
bb14aa9e36d43a4d2ca6f0e22abb2063231a3c98

SHA256
54ba3a54fc45f87eb3b5e42f02e70afb6487b4bfc8b714d3576980ea377da87d

SHA512
f1a242d0c8188c70fe38d54c9e97d6bd753ef5f2247cf6cd9587d247789086a5f3568cc1a5a4972cddfa8395bb861286ddf4ebc5e9063ca9e8539eac73186358

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
808b1effdf104f69fa82d5849c9a987b

SHA1
f7604d775d98a67cafd009d9420c9364718b0cf0

SHA256
e9d268be5c45db4d1995af5445fda76d167916f9e83cefee881cc995f0ceedfa

SHA512
12f11b01b36c4375734bcd2fb122eccbc9306fabd2e66c2e49f34d099c8a1a3a5eedf950f6f542990f3e5db53adda183765ebe6555c91be55786a21be215bbc4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
d2d31de5091d2e225b27481b1ee34915

SHA1
10ecc3b114cac6c6fc96a3cc26743c3f7290b9c6

SHA256
7c4df977ea49920b0ca233f361070ed8c9a8a5a42c106db14a0397eba6b895bb

SHA512
5b149efbfbabeef47f1ef4fc556a2a6b8bfad938f1cc8e04096f37a291b094a2b2734aada12a3546062762d636677775bf164a49b582c5caa3f08466c9d82d90

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
7816da1a67e1d2991429889a863f4dd1

SHA1
7549df6ba5a3a8ad533b120c6f57adff93916b41

SHA256
875b327affc0b72a0cdcf3f2aa83fcdcacea36c1748430af77fd1cd8da209c98

SHA512
70595117f4dbb2d8513ef18cfeddfbfa3dfe5f4f641b19723d0c90a4d33ea020b79bcf56b91a94dd14f67fba34eecc3b08af6a0232be4f7852038642ee2d1f94

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
eb48a91db9719a3b8b594f146145ac57

SHA1
56fb75488dfec702a66aa08ca7df9da7c4f336b3

SHA256
ce2345cc900e681606719266fed6f5bef73baf4d939c9b03592829938db3a3f8

SHA512
388ce194ff0c98e8317ea77ebeed3ab9c799e5b4fbe6b082adfd142696a7ec6bc8fc296251200d68ced38d63f6f738dbf7677713de3b398ef40db1a563e20549

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
5bbce3971ce67fbe74f7c48c2a657cd2

SHA1
0508ededc2f755749713be576d42462077649fcd

SHA256
54b12197fac8dddb45d6e1739c62c1a448f2ff9fa63cbd35eafc0d5b94dd9804

SHA512
817f5064eb781bf16ebb47fa9f907b54e3ebbafa559c7527d040bea5caff0da349138f07c8ef2fdf7bad429e8e8022b9d8663964b2c6c93357c53608b3e0c3a9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
031c67ff9d8b545cad2778ef3cee0086

SHA1
6f39ef8086e30de0fac004268364a6268b65f992

SHA256
2c4101f81baf06ca3c00f8006a516639fdb9988e7ddfe7756c0ab4f26535be19

SHA512
fd4a5a4512c54647f72787854c01022d7d76d6504926d6610a2a7f099b207bf8d692783320136168956ebfa9a48dd72227cd911046813b3e1b303871b1bdca33

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
beb5da94c329ad1a4744f2b3167137a6

SHA1
63a5ae749290d48a68ad6774b3c1c088ecddbd74

SHA256
3ea04c9af674f32e198d982494a451654e163ec6149a5efb7eaa37bfc0598a6b

SHA512
7ab2d170e0aa878c065cf3880bb446bf2606617b0aa93ab32de23ad4cb69409505ba2657991b9e5800f1972dcb9ae848e3deb62eeaaf3cf8f731b0f0818bdd1d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
2b9df375c54684e6f6a5a2dd71c58921

SHA1
dde8d9e0e68cf27fbf86a025fc6f2fc48d8b4919

SHA256
1a4129a6c0f4bed7a3cec3dc27cd4c2043c1373e0ff0c70e63b1cccc77ff4cc1

SHA512
5e74f3d57de473ab1034dd3aa5edc8bb55a4ba5547b615e7568f14ef79a9b740782a540da07b74387d91f873c59089276b73790d0a8f6911599c345e1be82c2b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
f26581904ff6fbd2b3e58a77546a92c8

SHA1
8bc0ca7bdc7e7bea09cdfb6378bf99b97add5857

SHA256
d9817f3ea966de1a1070efed718f31ad2f40965ba66b047e6fff9b817007f65d

SHA512
2b39458baaded0495480f7214428380397ac354b6d5a4445f76a8841aebe4f0d7dd14ad150f9e6f962fc29193e54334e725bdd9bb0cc3b262a5a338fdae4b34a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
d4e2582b6d01c87ea72feca970e93af4

SHA1
d4e7037731f8dee1157815f63c0e14f1011ef2f3

SHA256
56a8aa114fc6ebc46dbbece7f773fce9876afe8a02034e35989bcdd60527478d

SHA512
ada4176298d3fc779fb84c9b1f480baf3b6c5cab8ef3615e31d608eafcd768499139b060a6a3716c2f90c992fb5a4816f124fb459302ec438faa08fc440d602c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
58c69b524921bc66eac84470bfc98ea2

SHA1
4cd75a1b96c632a6e6ea18b38345e40a83087d5c

SHA256
76765e5dec952191efc74235d4d0f76801e0f4175ae6ff7a65de28942b34f5ba

SHA512
0259fc1996463ca87f0e433ca9ed065f47f310ca6d059bb535d11856877e93453f5e17ea345820ae84cbec77a9bba29b059a12e00280ccc586e813347b1bb97c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
9c7e89a5b71f74694489cabdd38b5823

SHA1
7d8248af0ea8bc70ddc7319afe5455edd72e741d

SHA256
b84896b2965210c37951c9cd75dd3241811a0c8b1ca997e48e7089dc45211fe0

SHA512
a530d232df77b9f87f768c2b9cbfb0dfef1e5ee23ee16b7a2aafa2e2f4a1ff787413b620b63c43bf452e4a4313aab5b4b181b8b0a38d41e7490cc9874b0be956

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
b68c9206ec50fa3896634b837ffe3713

SHA1
30f1bdbb1ba27d70cdf992a6c13e8ca60af82497

SHA256
8668f24a53b5196080aca6b38b99382249423d34ee7ec972d1b121c6f9b717c4

SHA512
9c63d4538db98dfa0340ed5fb72cf2f2f261f5685654610177a9fcb8808cfe654f0d3ddd05a2fb0dfacf99bf6d846b4885da3b9bb61159d96c8b7393c1fc05d5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
fa1415e95643fda5ffe456be50383e34

SHA1
cfda765791fb66a61e2566a519ac52575a9c480f

SHA256
e4041d3edfd3dde47db55b9ee3104bc6c7cb5dacebdd51d6540f998c3722065a

SHA512
646561c64070c757dc16c89f528f44d2b9dff1810bb4d78490f94ff3f366301819afde308fc3fbcf6200c198ed85a077a5028c8f6b0279f5c1d089a8b42615fa

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
0aee1e76ccba5da19226041b7e0dbc7c

SHA1
a180e47a49b5bddbef24548d739ede5722da7b3c

SHA256
f2db60a3eaa648eae567a3053f795e8a5cabe0f0a3de1eb4d01a38fadf911658

SHA512
1e9bcb21fad15c53c23d2fa226c4e69731bdf65f0565ab181c2ab058e89bdb7180f4bf296750c4f41a843f4d28f48dda1b7087ef74f12331a0264e1dab6b79d8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
5e752e852c0f8e078f432afec41ee96f

SHA1
57789b4be80a10c78aaef1be6ea5e6ac54e071e5

SHA256
4f2dff7dc6d5ec103eabd5e3483870fe22b85e6168914445575753ae0758e081

SHA512
d250c6feea016b8fcc60dda3d34be7c9489f6f8c4f9c5fdfd43e1c14d4d8400859cddd962968178498616d682ec7e68c16b62540e778a85b97f39ff115ec5353

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
4897595c671cc059574d27c7f12b1c2c

SHA1
d983f967f211a040b38626668674046dc257d21a

SHA256
2bc292f1342b9bcb9fbd62b8e7551acb641d77f207716e18e315e9474fc448c7

SHA512
6e2c674b3fbcc18a1fe8be1897d55dbcd1ee19ccdeb6cee5cdabcb427b5cfe82424d3abf94a89cffa097b5d85ec172791e1632cfd13d5739deea3096a2a30bb8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
ceded62e010dbf10873e95c186162db8

SHA1
fabf19d760fe8367edc4a83e2e85948d575f1de9

SHA256
ee1b9d4d8c67a4fc5928fde3011a376aaaae557d00d8ce6d93ab6776b9c25333

SHA512
3b4acbd2cb6c46111a9b9e0ddade8eca4b981a86d5884cb0a5c3a2085c81ea801b873ba448e5693abb5ee7614c9247bd25127820cbdfcdc7104f3ae27b060438

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
52940da582e7104de80f637d2b2ddc73

SHA1
511813d8aa4c78e80e362944e9f355daf55ea199

SHA256
ad3f19ceec47177020e18494600acb0e10d55c4f57fce20a2cf40abb5c9e054e

SHA512
678640794e8189746e644e94ea407a17f1e19c8dbdfde61622055a58afdaea0e09f76fd39dd705cbccebe04cc5d5601e816844f01d044e82700a82df57a8ba25

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
bc04c0af944c03f8230e3c7d29ab8096

SHA1
a1b5521246b2fa1652980a449ea730b00b206af7

SHA256
9c6ba42bd9064ab248b84ec678633d68a021509b54f17e91b424829178a8e71d

SHA512
25de4579abc28e7dc5a187952f1191ddbaff999ec5007684ef3d582a82ddb7c870af681e253c1492642e64b8b86617a41855e1868f4a5c316729e63635db453e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
7196910f304598fdaad9be6ad2ffffbc

SHA1
449f6f3a27e2f1153d35363e8c9649b6fc03f5d7

SHA256
d0fd2bf39c50b7d5c2f4a79e810db345060a1c15562dcf828c1a6ff9d4dd65c3

SHA512
906e142e7e9b83a09b3e9c611abd13b3a574849256e7a0dc82066f45451ef43ff0e679b66148399c5f75f9b02382c348b05fd58c5b9a4dd10031e0fefa9fc921

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
1182f80f013b9ae1145537245bdf00b8

SHA1
e74f70e334bd00997391710eaa0d483823c548f0

SHA256
a653f76a5b1cf523fba53e337d64961da3ff8d025819fcd3e62b6330b63378f0

SHA512
4a0d95cdea4ec3f9e17d14ab221b4159065462edeeafa10a1c986b263f64cbc7a8b0634db710a11ab8b5622c46a1f4428be4ce139167502fb0f4b00421e35fe8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
01c4fa2ec6e4a0fa453871d2b3fda450

SHA1
02cab5f219426697ca36c1dea84df8986937aa29

SHA256
7b4f374add3d3df35f41d3d81642425f1bd4e2dd41c419cf4e02ba20a36833a4

SHA512
b9f442a7dfbd7c355775c90d7d5753dcebcea673fdd0ca36bedbd087e31eadb7ad40c0d15c6d3297421a9db9d424512943801da3ee1078b9538ecd541e489208

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
914f719479a589be570c4138513b0879

SHA1
6fdd3274a5f4b4d4eef649eefb6e932cf88dbfdc

SHA256
6eb3cc51b14f0a654e4400737a8ac03ca6017eb4c07a7d5448dadfe3451a3c0a

SHA512
018749590a90075643508a5af74fce619948bf04b3a58eb7345815c369c3c1ba44b00179dbffbfe5238d7b74419d7d46660b292024b13dc549b70c3a616d725b

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
96fdf609418a0fa89105dd2d3843434d

SHA1
a8d7fe2ec26289f8c598a74fd3d1c11ccd55f924

SHA256
1b472748907a09fbb46470063ebb32cc9edaa26120bf1e68c9562e4d2aa3f39b

SHA512
6973eaa95c942033ca92716dc5329ccc563134894fae83161d0083b52f75a6ef5394f2fb54f7bf80e6352377fa4836cb3c228fc259278fa6220ba8bab37678ac

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
df285e6c8ed327bd9d98f9c6588a906e

SHA1
fc2d1ceebbcafb4cb8d93a2b923a237a5834cd05

SHA256
4c77ce1a1e6a31f5f6996bc0c2344639535259da3e37a3daacf5399946afa7c5

SHA512
d9c2bd5f0c3545e47830355528115b5df4d05e81ea6172b95cafedce017ffd93e00245d051842209e0a7b2f5391db903aa3a24c360b89bbc315468b4af404de5

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
3995e579af9cf8bf1256df30a83ab99d

SHA1
aaf80d020f5e05aae0e9f6efee4fc42e9d747c24

SHA256
257c26362c9902729b2558466630732f8613fc81c46e85c9e80d276029fa3498

SHA512
f8be875aed20905ca8d6f0f4796f620868b61c64562de1b89a88d2fe1906e7fa4980f240435e73babeb8aa97afcab0e82692ab51c1a20c36709476305f2e89d2

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
755221bb1428666ebfbf07a6854aa4f6

SHA1
a435b7ffe22082913a9e788643ab3f5163013c7e

SHA256
71d205c73a07d42d4638275ebb5c818ab199e4693107e51ea2c1d1a5b3760db9

SHA512
50ff4eaf99d70a5dd909f630d2d7136a5efe9bf31f8a08410868e7932cb6c7594f648ed94fccda5d573f17afda2566675d877585acee29bd95e374263e28033e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads