1a7c95f8c16c474b664589b60104a9d5d97330ac0155c199b3913b9854d3c2c0

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2024 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
Size

12KB
MD5

66b7a800f6a7f327de0eed42407074ce
SHA1

90f85519957a2db82d86db84331d1479f2b839dd
SHA256

1a7c95f8c16c474b664589b60104a9d5d97330ac0155c199b3913b9854d3c2c0
SHA512

c795dbbd461077d047cec0c93b018175e1a844b22c94133eaf244a0ac843012c80ae7b35591eb5bec00c2ae38f38b62bacd3b0e73ec5e2e5e7d01b3eae791f0e
SSDEEP

192:e/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMTRVB4:eebFNw4Pk1itKkpAjjI2YpdmTDB

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2184) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F1LgVty9W3N01xA.exe"	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\InstallShield\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0015\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmvv.inf_amd64_26dc960cc4c84207\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_avrcptransport.inf_amd64_6506aa4ac05430d7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0012\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0416\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\WindowsOptionalFeatureSet\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrm\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\basicdisplay.inf_amd64_65ab9a260dbf7467\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\percsas2i.inf_amd64_a7f5d94e6751c911\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ru-RU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.WSMan.Management\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrm\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_magneticstripereader.inf_amd64_86e291110e37418b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEKR\APPLETS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\digitalmediadevice.inf_amd64_5b64b65052c3a32a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\intelta.inf_amd64_ba962d801a22973c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kscaptur.inf_amd64_b95d9f4691816045\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_sas3i.inf_amd64_79c7a4d8be0a9744\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrgl.inf_amd64_19bd1d6c2b642b6f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ucmucsiacpiclient.inf_amd64_a233292790c69f03\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netdriver.inf_amd64_2d569d832b41b8df\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa.inf_amd64_7cfab61cbab23e11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sppui\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_barcodescanner.inf_amd64_266a07997c075b30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fssystem.inf_amd64_89e15d7e662d6584\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wpdfs.inf_amd64_1183fd0f13045f2e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpitime.inf_amd64_e1498a974ab95ea7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sdstor.inf_amd64_0d2a33dd67a36577\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vca.inf_amd64_6bbc643de0df118d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\et-EE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sisraid4.inf_amd64_65ab84e9830f6f4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ras\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\iSCSI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SecureBoot\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpssi_i2c.inf_amd64_8e00e1aed7fbdf70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lltdio.inf_amd64_4faf5a37ebdbec2b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-200.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72_altform-unplated.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\SmallTile.scale-200.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.scale-125.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleSplashScreen.scale-125.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-20_contrast-black.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeWideTile.scale-400.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\af-ZA\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-200.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-200.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-100.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80_altform-lightunplated.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\LargeTile.scale-200_contrast-white.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Confirmation.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileWide.scale-200.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\SmallLogo.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-100_contrast-white.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorMedTile.contrast-black_scale-200.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-white_scale-100.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-left.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-125.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-400.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Resources\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\japanese_over.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-right.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-125.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\MedTile.scale-100.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-300.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-100.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\MedTile.scale-200.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-60_altform-colorize.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\TriPeaks.Wide.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-150.HCBlack.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\[email protected]	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageLargeTile.scale-100.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp4.scale-100.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-400_contrast-white.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\ContactPhoto.scale-140.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\whatsnewsrc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-72.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-150_contrast-white.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Success.jpg	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\SmallTile.scale-100.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_fw.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ar-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_92d74798c6364795\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-winrs-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_ee3e9fcb3ca32d3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..xthandler.resources_31bf3856ad364e35_10.0.19041.1_en-us_1e8af5a2a3894d28\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobeerror-main.html	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\SplashScreen.scale-100.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..hony-phoneproviders_31bf3856ad364e35_10.0.19041.844_none_c87fbaf3835e2c51\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-appresolver.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4b5f14a2757df311\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\NewWindowIcon.scale-150_contrast-black.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars43.contrast-black_scale-200.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..r-service.resources_31bf3856ad364e35_10.0.19041.1_it-it_0045d40071d3b1c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_scmvolume.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_fdf68eedb526b50c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-minstoreevents_31bf3856ad364e35_10.0.19041.1_none_da64afa015674e71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ls-setspn.resources_31bf3856ad364e35_10.0.19041.1_de-de_5ec03b0dfe8a0171\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.workflow.runtime.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6266ded7a8ec31ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..rdefaults.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_911f578f28de567a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.powershel..hicalhost.resources_31bf3856ad364e35_10.0.19041.1_es-es_a1d8f56573592abf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-chkwudrv_31bf3856ad364e35_10.0.19041.1_none_3d0cf44cd5467f9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_39a4d63e07cea862\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ndisuio.resources_31bf3856ad364e35_10.0.19041.1_de-de_a95325c7eff2b9fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-winver.resources_31bf3856ad364e35_10.0.19041.1_it-it_67e0598b262c4cb9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_netfx4-workflowserv..ormancecounters_dll_b03f5f7f11d50a3a_4.0.15805.101_none_f765d0aa13a0bda7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..m-install.resources_31bf3856ad364e35_10.0.19041.1_en-us_24eda5bdad1daaf1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-r..-profile-hardwareid_31bf3856ad364e35_10.0.19041.746_none_d1cf54db9d909fbe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-msctfp_31bf3856ad364e35_10.0.19041.546_none_b32b50bf82215109\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.Search\Images\logo.contrast-white_scale-80.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\NavOverFlow_Info.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ket-win32.resources_31bf3856ad364e35_10.0.19041.1_de-de_d94eeac525eed496\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..lers-assignedaccess_31bf3856ad364e35_10.0.19041.1_none_4058372892f706af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_netwmbclass.inf_31bf3856ad364e35_10.0.19041.789_none_da7c52a020e37ab1\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..oryservices-ntdsapi_31bf3856ad364e35_10.0.19041.1_none_8f22fe3bc4f4994d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-beepsys_31bf3856ad364e35_10.0.19041.1_none_7a11aed6a6faced6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..extension.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_cf98060850ba8277\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Exchange.Theme-Dark_Scale-250.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..omponents.resources_31bf3856ad364e35_10.0.19041.1151_en-us_0e8ac7c8d3abe00f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_ndisuio.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_8154c7690e7d5c12\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-onecore-inputhost_31bf3856ad364e35_10.0.19041.264_none_7ac1827e896f13b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hyperv-proxy-onecore_31bf3856ad364e35_10.0.19041.928_none_49810de45ba21255\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-quickassist.resources_31bf3856ad364e35_10.0.19041.1_sk-sk_a07aa5d0aeec3685\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-twext_31bf3856ad364e35_10.0.19041.906_none_447e0a3126041344\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-unix-socket-provider_31bf3856ad364e35_10.0.19041.1110_none_c281af5a93a8fe4f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_fundisc.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_36ab53fd4f0fac3c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_dc21x4vm.inf_31bf3856ad364e35_10.0.19041.1_none_ef9baf5f73df82bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-extrac32.resources_31bf3856ad364e35_10.0.19041.1_es-es_c1106a7a90a217fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSplashScreen.scale-125_contrast-black.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..tfmonitor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c6d9b9de90d2c81d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windows-defender-service.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c8312ec6994f8dbf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.runtime.serialization.resources_b77a5c561934e089_10.0.19041.1_de-de_4ef68b8c75d57a6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-256_altform-unplated_contrast-white.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-l2na.resources_31bf3856ad364e35_10.0.19041.1_de-de_b34b494588c102a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_frame_grouping.png	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.746_none_dbecc8a3cdc7c3cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_systemresource-wind..tscontrol.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c29160c69762894c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_6d4be35dd691e117\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..nvservice.resources_31bf3856ad364e35_10.0.19041.1_es-es_ccaeaf8ba3acc8d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_tsprint.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_eec20e43d76f31d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-o..oth-avctp.resources_31bf3856ad364e35_10.0.19041.1_es-es_86570387bde43fea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..lperclass.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_464f4a0dec10be92\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..emsupport.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e4aa550bac34458b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\PLA\Rules\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-execmodel-client_31bf3856ad364e35_10.0.19041.1151_none_8c3fec56daa82a74\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_net44amd.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_5ded3b7b973c0dfe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\shell	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\shell\open	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\ = "CRYPTED!"	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\DefaultIcon	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F1LgVty9W3N01xA.exe,0"	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\shell\open\command	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F1LgVty9W3N01xA.exe"	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "RQTLJTILBAITMBS"	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RQTLJTILBAITMBS	66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\66b7a800f6a7f327de0eed42407074ce_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
ddb5ef0c7c647f02e67a01a294800ea6

SHA1
99be01698335112bc018a6ad10014284e9a56dff

SHA256
48d682a30eb4eb2abf9cdfa45bddd4c680a28b434292d96c6d544a319550c7cb

SHA512
6c10a05f02e5ef9bd8b816e568e6fe021272e943738440977752572fe97589bec0ad16fb2a5cd31f8d68560eece14513a1a8888a4fe5b4776cc9204f61b5aeb4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
7cc945264a83bc33bd0bc3856f20dea9

SHA1
28b017fbe2324a6571e9a16ec777dfe7996ea155

SHA256
a9dd4ee472e46faca24c0473f43c0813116200574e64146a37fde22a9d8749a2

SHA512
5c63b6e3517442d25b6a164285d2210fdb628dc5d0180bbd7a7d54ba9c5a29b957ea3291fedeccb38f2578fff2f87d5cc4c7deecc3772f913593b0e60802c3db

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
58895dc83d6ed9891288c09eea660fd8

SHA1
663d5e4eb52bd0ae23b33279cc20b54f9700d259

SHA256
9dbe3b031309ab506aef88f958ae1f79a95c62ffe719713a32aed6ef492ab812

SHA512
b4dfff8c81ea6fad717121648fd2e676dfc1e58a6aba52377602252b7e14569fc44f4f662b7b3805d8cc36d2ad691030130de723aa71baacb5c1ed786372aea4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
cf0348c996f130a8ffbbd7094eb08691

SHA1
7d6b8b1a97e758311f9a4b488027d716d2c5a0bf

SHA256
9f0cd4f02b0e587f43c4355b14316151d25a266dcabc7489d42eccb429d55fd1

SHA512
90f7234bf73e1acf8929def052e1e556f6f0df4daf200b5468841dff4f543e22c63ad7b512801606efee66d42b1fda38a37ad15d6d5c548315f0c37469195acd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
db1829ed088fc537c04a6fc3742f1001

SHA1
b526becc049f6dfb61aaeeaa66557cbae6673e89

SHA256
17f842096a16d8e9e7e57e4a9f6fb1b321130a09f759440c08fdab4a6dacd9f2

SHA512
fe2032e2f1bd54abb19fae8dc3b0b1cdeac67de8559a46b477445e8a0dbb7b229f534c9742d4315dc64f8a8895363d66d35378a1716e83a9cf0dee68d28a1a00

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
2af1edb4c3c560ed987879ca506b2c2e

SHA1
e7975f3fecc9c309de94185dd6f52ab208ad10fc

SHA256
2daa1334242913d43a94056844661999ad8e5c5461ca664ef70ae6d200474ef6

SHA512
80396e00e7c2a0fee78de17f4ca604308cbf0140556ba2e74af55e2e8b4e721d88d56bfa5c1df5b2b9729ea8ececdea0c6bde16d7b80e101db781f9d5f3fc19c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
85b9477060c7f0330fd03df58b982ab2

SHA1
89c0f6beadbe8ae2c1f23f6f6997eff6d23767ff

SHA256
2792c12f53eba1e1a89d38a2209c8d7f27fe1f3b2b87a39e3919edb1f0b83113

SHA512
ab98518653dcb5ca8053f1829cec595f705e9790d89ca43fa476808a77b04854ac6ddf8d92f3c1824832da6944a34061386f8144e54490d5301d1cc29aed9071

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
f0d19f9ad0f42f0852de499f1d393be3

SHA1
352e955d60e64d17538c01317e9754bab5f9564f

SHA256
565740374070f0850be2b7e7f51e7ddebf1b4e9d34109bdb1591520e4f872ce3

SHA512
132ac1664bb763b19c3ba2853496f6e934ba0551f4c25aa3c56450d0518d7362785cf4674e7244fe11630a0598542d7fef2ffea98ddbbeca4780f872c54f5d91

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
1c610dd7c495f0ba38394b2e4a0ac008

SHA1
43152ff0107fcc479bdc4f7ac6337cafe0203b12

SHA256
30946a641f16f2a0bf333b6111a87b0033734ba839144ec4267f68ea74cee846

SHA512
f4c545e36af19cfd12eb7a9ccd6948ee4fb1b3389cf23748b0a7d10e7115f2e5422514112fdb88b923f00de048acb5d71068a1d4a6ec1909d9604e8da74efa49

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
a5d84e2154520dd1dabf9ec4cc5f4929

SHA1
32092261e57cdad3551b28038eccc01cecc9893b

SHA256
01a0a31a8f739b62d058a92dbadadd2a65262bb83629f64eab766cebf1fb0d95

SHA512
13dc772586b4dd655ee394be6414e216883d044fc33414870bf181e02033593afb00206a3696d4bce5c753ae1ad8027b0310fa6899911f423b11a5693a41550a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
f91720eb91323966f1b93c3d48fa92fb

SHA1
924d0ff0ceb9af52891c306a3873dd9d030e3bec

SHA256
77a55e29f3010dffe41e0dc576fd05ee83ef84f102d1b3b79a0becaaa51606cb

SHA512
774c97c40de9bb96a5a4be4f278eca2ac132f3fc3a1fa255f0c821a4c45c4fff13739adb9e3a4499e03e2fdaceb08a16e5be71cb4d1db07cb15c76c45728562e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
8567f0de7dc2d3355bbcb5fe046faf00

SHA1
d0bf91868147d7da75dbac8f43be4e950718f9f6

SHA256
93fbba66ca81ca135548e92bfe13b4ffccc264ad52549ee891eaf9d954412abd

SHA512
e1a950b094a88d90247e8a1e4ed6b87af3750ce373350c7b4141413f4a9832b8ebb79c9540e231132f44a6d98ccc505901f8631aee0d52417cdfcbc4bdd4293a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
8177ea7bcc0a5c21f91e757d737ac2e5

SHA1
470039622b4fd612076e340e88ba70b4e0648819

SHA256
07520cb758021e42b2dbbcdb044cf19c682e1775eb0772f373a07761e7717681

SHA512
c900808fd9862dbf141e81e2991e581a1ac3990b9dee33878ec86539e8cccfcd0254993e1e4a83a09a7ddb042210e9e090fc92c39e0bf5bdcba9ce0edd15d2ab

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
14483eadd12eab62d73abda8850f9789

SHA1
fab65332cd110c1166de4376c9d18b152e4dcad6

SHA256
e99b5ad8f28d0a9ff03c190ce1d56030a0410dd35ae89a84e97e112659c2d066

SHA512
cc09109620b4ef053e19f64614e81a17f1984cde12b574604e92381b0e2fa8ef97601b4aa704b0a373912575f4aaea6ad63409a7a5a916c241b97ff4fbf4ee2c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
5eca98f4b70befb0cd9bc7c2fc159473

SHA1
c3218889622eb4e95ebc5c2059a55e00ffef0707

SHA256
caf489eb52b80188594718ab78934e0ba8d0e5f23d9dd079e88bf2da3353a1b2

SHA512
31ad31ea40e629b87859f1d33e234dc6cd3a97ba03570e640ea5891810dea247b9df55e72614c94a7c26c192aaf381ec43385f81bf12dd83d8763e188a2b42cc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
5ce9b7046eb2d668461a470dc79f14b2

SHA1
571f1f3ede4492e8761db0fb4790e6a6ac7677bf

SHA256
89c7453de99480e82bda6308c5a8493dc390f30416cc03e9ef231f551195a38f

SHA512
3c1128f96ee3658f0bda26342096dbbc0bc303071b8a0a2cae4d575fbe8cb5b17e0485f54e1b3eb072f42553d09d6d7c66da5352ac704a6e6d0dbb2364fff4f1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
987ba581fc2f888b313c7b84be4c9d71

SHA1
8401f8a8749621dfdee7a25410cbf743e5c25e28

SHA256
dd546f0ae498ae524ed41a83f749a5bc3731f447fe73e7a9b2988ab67ee56f8b

SHA512
ada47b45f39f9c5f063c229b0152e68631cddd611f7ba8d50bca3a70c9c2b16655584a1b2c1ee9758b3274a5864d6b934c7d57d8ebf2f7fc781c92ab78c6a4cc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
0d2d0bb9b7a7f089af615f823169efb7

SHA1
92cfd11b0ab9b2a78ab1a45ddfe358c4c6c9dc2f

SHA256
904a07800f16aed85d43cd65168bd12e3e02e83e65efd89dd8cc0d182f5d1ec7

SHA512
58db6f853e540c05920675f3495f614b7ebd1e6da1b3dd93d322185c4c695e195a854a5d7253c889114dc089dc84398bfcc6293c1f942796ae6656a64dc29939

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
81791d025e9ca09128392da81acad0a9

SHA1
4d2d941923abbcc17ac16e91af67e28f01005520

SHA256
82299e9dc2b2c43c53bc3d20236cb5078b4d476c9c777e95f039165e63e1cd11

SHA512
2ed1ab259a88d1b5cafd735dbe88251700ac2a0abd067025a4e42296740b834906a66253fbd7fde1c8402299a3b352b57ccbc9b4b1fc3ac7f75a7c5256ef2e08

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
0b9072cc376d450feaf54b3a1ae4a475

SHA1
be9497516e9974d033056ae4829eac1141dbb38f

SHA256
041c2797cc56b6c7ea38f82a4687c68820e83c519cb650761c9e4af581fff6ad

SHA512
eca797c5fc96dbd5199f8413014c630404f3d5e21cfa90ba9c01c7bb998681c06b1339194978f86423b422f065b5c4a0abdeef545ee773f44e7d0dae7b3dbefa

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
bde868ff5f158463466c7afbf364597e

SHA1
31161e706f120c2ff605608a33d8ede19f99f6ee

SHA256
c5085e4d5a64b8e8be4cade7b3a848b2e31498de6b2a97ca470a67fe1ed6f171

SHA512
3fb08350c0f14a89d670c8c4eb038209c7f54e719ef1ee334dc023e94522b4f0d9b99dacc5c67bf7de292ab240a5b6738052a5f183d06c48e68dd3abd75c7a9d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
317e5b92553e4200e175817487ee8ce4

SHA1
ecf47ce1dcc8f73111a4896fde3526fcea4bb005

SHA256
d8eef3ff8ef8b9afc5ac0fc01ff0457489e5674c6da31d9aaf46dedab54461ce

SHA512
c0b80aa85632d8ba0ba2074a6b45d688e68fee8069badbdf8cb6f6272f10db398bb79a24ec451653991a567205c52c77b9a0960c4b11802df3f3b260765402b4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
e29c16cc5be07dd700a04acd8fb9f3ed

SHA1
24acd3abe3dbd41157286114f36f6db621e84d80

SHA256
c4595fe22c0f53d8923854545eae8dad10e1ef5dc36f0d871e221d6e1d190477

SHA512
0a256aa1afcb75067bbc2a109dd7192eb3c52f2eeb71e31938db3c76a19e79776eb7f675316951fcfad3016bdbcaa9ddccfa7a020caca41b130432f07cafa644

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
34b8736ebbd9825b8c6220db7b395e4c

SHA1
380111da7301ece2627f71a22aacadea7f95a656

SHA256
eefc0cb70fa30f8cce85ed5f63e146a89ac3e431a3a419396ba14f0028d4f62d

SHA512
09b7b51522b54e03940cb51bd401157c6a008cd9106c7878cbf86c17005d2f0078c3113a71b2fe02823c21ad394463c529e157cb9665242040c7b4c34becda4e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
4b8f14953f3630a9d0e75c7eba6813b8

SHA1
2dc07dbf8614b12c4fb46f3a76b4c8a6ed9cee49

SHA256
5ee7097861f85791f6e87d806073d1e57e65998fe55ebcc414ff7fec2791e305

SHA512
5fdb9dbaad43e4d8e511375c51d2e7e5751f3170f7217ac82ae42e8f123f26041e0931128709ebe4a1bf4c43546017c0c260d59d1bb7eb075f7220c363169c04

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
6c0c7dd1a7ed7daaf310da4e6c93ba29

SHA1
88535f0db65bd7729ed359f493f23b4dd165a7f8

SHA256
54cd5bf0ba0363bfa839251147f1d5385fcd2d943d332a8008f3c099cbd21e59

SHA512
e18144636c3bda383e20c71817ec222430cfe6642833698e0ac63828e3c52214733d91a61cf6e6e8f0d837ab30a6f68a368c35b39658a06a4c6d5d16a729bbb5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
608bda6c30c2cd990cfd2f16fde0192b

SHA1
8d9fd229f45be651fae084a55bc02b8c8cfea072

SHA256
7d8fff95f7d42d6793824cec26787b7bf3d6c728ad55c297a2a0feab81b83654

SHA512
c984777f2b653029446efd7c66d2f5f84a301ff2ef1038f3c0199c06a2cca0d0db0373c835474bf4a36e0f7a786433c7e1c98fd062460d20af031cfd03c8cce2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
c7adf8e2ec1fad0e46add952d229d20f

SHA1
c6314a8e0ac00164b1a23176261ce47e6f50f63d

SHA256
d96df40e1a9c8fc676e4f5251f6f5ce3290035e088d5acf4a8b8770ad8916f05

SHA512
5c3e6e10e3c3c725a79889f6a7f238f585ffc89dc9488206c21d41d20e1bb6d0adc61cb7c644cd2b3ac1004cd57d2adbd835442d332edcb3614dc80dfe7ae66a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
849e9e12ab6664592461383bd183437a

SHA1
a1b652a78cb7d8b9a071e3ccd6e4ebdd614e4438

SHA256
e5a64426c3545c8ae3c51031978ad2d4d11be7043d9cc4f9f8fedae507f98b13

SHA512
306da4b2b43b1da4627a20ade9c14568270b16625b04da4f9243771c60ab3c3f51d5487860c2e5d533e9e6f33307bb2808cf0340ffeaf43d84a2207faf977673

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
9e42b563e64cc2d3d4d0c923ae527df3

SHA1
0a8ddbf1d361d5a3466d8af35847b4c2f04ea49f

SHA256
a6b4f8cb17ed830e2a7a944f3de4dbbea35f2a5d7e4f9f36e0294f743d3660bf

SHA512
3efea50338d89b7fe661a2e7007f86d7c3b4800e149a244aeca17829d38d770ab0a42edd5fdb29719a79e669ce9cb17dcd664303329791e2f618bc5f4371491a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
38d11fe090af45ad1bbbfddea85764ce

SHA1
fa6bee68384241222701c035ced6e2c805759e45

SHA256
5711d765175a8896bc254f4632115001fb63582b8af31d3868ac646bbef48aee

SHA512
d2b7e9016bca80215801bbbc24d4949eac92217397a24c15cb05f0ef96e35327de016d6d505feb4a72439aee8a2a02911aa3c4b6e2105d565a373d042d90cad4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
de3e331a7a786f5746d71744f3025412

SHA1
a1f59193fb0077417b4d1498313f57f55a601a8f

SHA256
a4bab1f64cbdb4b32bb2191aeb3a9fd69a234fbb134f5f18bf0aa0b85195744e

SHA512
0aae59fe29a768e539329eec50aadd19d318560e7ac1267bb7b28fe9842e21db30bcfa0933ce60727deb11d60c702a03e7852896727445d5670e58f9fe987859

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
ee43aa5aff8da85881871fd4f682fc9c

SHA1
dada059492e1f5ffb31704ba6c86198af7e0c90f

SHA256
3402523df72ac0d2ca3f6f42ca09544415c232f413a59132e54a796ce17357cc

SHA512
80ee61c190cc1bdf9dc733c39ab9f3e283a229996d280a8d2528fcd2779bc85e6f5aeba5f0fb84b6f08ba8c685067262ce9d3ab5619075483ec70b3273a79caa

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
d1476f23d2378f5ff04161d18d390972

SHA1
d2c6aa1e659542c52fbe208eff8fdf68c905603a

SHA256
3c309d428ae509132ff2edb3bb5ba66b9b94e73376606df577ecbf0c5d6fa742

SHA512
a622271ff17d27082fea0b22c6184264ddbc3ea4ba208906195864d6d202fd0c44d7a7702e27c0196814231f9da745d6159c544bcf92b6486d56af714ba91f38

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
e8b678b6a91963e2d89a7ce87bb13074

SHA1
edb582920fa9e42a53c2eeaa6a53dbe837d16a07

SHA256
34059b32e73700fb18a6e290515e6fca4db434d903a7ea0a0abc28a0f453af9a

SHA512
63c33ee1d3b7abf1c9c190a9bda54991f005d3ba98679d602212bebc521fcc4883089c8aca685c34777f301d0d96ab3a489d9cafc3e311b4fbabb976d2ce23b3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
25e27747adb1cbe8eede05739a2534e4

SHA1
c7a979737675f2511dc211937072f7de0baf41af

SHA256
c44b3ef68ef26a956199c8016f3d6357c379436a8ccf0100ad9797c6ae9ae873

SHA512
0d24d79da6c7a91d22cb91e361df984a2fbafa9c3b9e318d9b195d29edadbc32df04d6581b90bf96c772df7d74b7df59cd0150b5e8f9348427b02685cc33418d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
4e8f5852c6a8a481b36d17c48aa55224

SHA1
516c5122da5093fa3eada89acb1c445a74a6e050

SHA256
af025edb4a67b4965fd416db5393f618ba5c55e38ebf9a107e964e12a7eec0cf

SHA512
198c6ab8c8968abd3f090eb071babf48a8f2047edf7326193d060c3baab2d3b19c9d07f907cbb8a19420594adee363b5445d1b88993d7a57f8b952457505f2c5

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
7c0aa0b15865e2e4ece181382438c407

SHA1
b744f79525874d2286ceb202f06d9184d12f3199

SHA256
c1eb157b6305fe7e3265bca61e28234d8167da5cb9aac2dd6185dda720ba62fa

SHA512
310d49679b71af02d63b17a355e6480f0815543097de63ad03a06bb1ac0a42af53651a4ab7bd939f480cf8286a2175bf0443a56990710997d324b8ddf891edd3

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
285B

MD5
a7a0e123294b9ac4a46d54bc73505430

SHA1
18ad826c381ed09c78662a651be6f5152c7951d9

SHA256
e950e0befb030c6adf6964abf1f3eb60ca7f133292392cb1f4b1de8eebb44786

SHA512
d4959701c26086cbd32b1a3f1d38622325dee4b9393d0ddeb2fb77eae402ce0f965a73c24ae344cd3b37a720dabc066e23fdb8ff5368cab59265bc6363cadea8

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
6132d8a462a751f83a15e2d5409d707d

SHA1
016484ae958fc9be1a0dd139b9086ba375eab217

SHA256
888051d99d198779a9cb19ecf4534fe2d7de8dce1e35e7ed7c4ab253314fffca

SHA512
a3bcfc6e5975a5054d367b0418d788aef5f2e8fdadf32ed51153cea5bb225729d69a710e74629ab6d4dadf98f03487e48e7b7ca3a87c55aa7f1279fa525566c4

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
d0faa7d4552a1a391f047fbe243dbdc5

SHA1
c643bb370f8bf2cc566cbf19237b45a1dd5e6e15

SHA256
8987db3a9b78d14f946ae5cbe1ef004cd730023e7d7c3bd30745d6304d5b9f8f

SHA512
a0fdaa28c95628f560962fc54ec7fd1fce0a7d2145b5dd97322b2b49336705aefcda0233adcfb72cefde7276ed97c67d4bd44ec8b079075a3692f22a9d0accf0

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
83375fb75517afbd53a3f8563afaa6ba

SHA1
c759ed4bf90e2aae9877d8ba5b064df737e6e7c1

SHA256
392fd1f058bd9afe450325a46a4bfcbddc1ae795997e54362935ff7b019b53f6

SHA512
ace4725ae618484b73aa6a6b0e25b77e8ddea686facd496742cdf41f4516fdfb2ed336ce96c2c964a7f6ccdd3d7766063adb8b2c5de409ea946c92a38b7cdacf

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
458e8a0df2f0cdcfd7305966f25c0db4

SHA1
9d1e28983d329c0c973bc00b6b5fba906e788d2f

SHA256
9d300b33e879d8c6dceba39b8818a84e1122f485270ae11a0874f000d9b5fefd

SHA512
bcd0c1c7abe291c4f141e4ffe6bbe59a55eb5073d8f352ccdf2196f6e0b9a1d877d43d7fe1992e6d90e37d0fbc6d1306041a643d0cab96c02683fb8241da4300

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
02e11df37d899d29a2ae585474604f0f

SHA1
0410fa913120a886cff1e37787c1ac13e677481c

SHA256
2c2a3a045fb4c306ea4a91993c8f0d4a086634ac5513f7a2986f89374e217221

SHA512
a9a2ce4139717d32feb4c92d64441c438f2c80ec3e74148d8144ba22b874821ff2528589952266eaacffc693d150a6ae8d1e0f5bc057e13feb9e0a50409b51f1

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
39757b418fb2a4ba739fe36dcc0d32ba

SHA1
9009532138bb52360e6b7d16ded196f0f0a393ff

SHA256
644d88e8318fe71c582eab888fc7f66179f34815d7e8db30645abd3d6388e445

SHA512
00bb1d3360fb675849add5b3886346e856c02dce5e326acb3398c6356046c45acab6f9fabace214b2d6a90e5c476910e26cfb85182aaf2cbc9f728075f07669d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
595716665bdcd93735439ddb9a7bd12e

SHA1
108631f019a9af5c61d5ab76afa48e1eb6b6c6e5

SHA256
990ad6cd2c8a21752356202d65be7f474e7363057e20edaeba239b459044b9b5

SHA512
83e1ef7900bfd2bb4471cff68bad111fc4679e62eec84c65266712c9d27cd76ea9892ccdefc6d436eeb228df8c1909c24ef16899c7197ed0cadc7125522cd179

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
40b75ee45dbd60fcfed7241bf653afab

SHA1
f7ce67ed4b4ddcd7c83d26a3219cf974aba78037

SHA256
768371a1b5b89877621718d3712377f0349fcf81fbc88c69648c449b3a04c237

SHA512
0283e65819d59b7c24021f1a5fa212efdb8d1c4ad9a9a547be4f4429819016a25ed5633abccc147653cd84a86291d21416d1767eb96954ace16654618f2d81d7

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
30140d82844f18999e7d8efdbb550f24

SHA1
527d02e8e68c165464068b1b754364bb1411dc61

SHA256
bbf2b6359827304fdc1b3ef37fd6cba28ea611d21c7c541e2a43860eb343be1b

SHA512
387c88a82c1442fdf5aad71b2fdd8c811328a0823d35cdb2ac4a993a493cd70e6c04f5e73b72235898fe9760267b0046037d0824eb4382c7e8a5b07c3b476fc3

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
ab1549890647b2bba3270ab42e8d7d62

SHA1
1b5f6df040c11b525096a52e0731ebab9228c23a

SHA256
a63f858e869ee84625b64a47b480abd36f23b33612cde565969eff1f211ece63

SHA512
d34d9a52ff257e5215ac51396e460742125a9135c7edc7f83fe0eab1412a8fcdec19c0136b8ce7c0ff5adff00699f71094e44e3aef92cfa61d95df0f259fdf1e

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
ca821bc77aacbdf89ce5f3915a4133ae

SHA1
4708748063588c8d609e95a639ac64c7fbe5851f

SHA256
242f5862bc2c20c41f6893e4c90952fb9d528b60804725d139f8413896034be9

SHA512
cb8261dfc95745d0f7f290a15554a19fe32a895e86d6190dce419b22801820d351f5328b0b3503dc4dd4127cb4d862ad00c9ef72f30a6508763d6281f0008722

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
941329bd6a491ca6910d17854e4719f6

SHA1
2a0543e22914bf007c05c8e8cad537972d4efc1f

SHA256
5fc105cc8240ac0a9595293f6015d7a6c9e2942ebf537dd6b424b372593de935

SHA512
35d4eac19e34738b20476a2a5dc20512b1b42f884987800ac9ab885fcf0546699925bea01f0fab12a719571e46f8b7c3e42f8446842e1c341c2635ae3fd363f8

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
1a16e20aab0dcb36830b613252de925d

SHA1
fdf2431889ba42656c3b7c945036b1e62bdca72f

SHA256
f0b90a848e56323d018675979d6a5fe39bad276f515fc6706838cb919c78c18a

SHA512
68175f836ef0f7f841e27dac52467ee28449d75110b13ce9aefe0dfced2eed704560a8ed5f0c0e225d77ab237d4f6fae96ee851c78e89f2dfb711cc79bfbdd86

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
b8957c9df793fcf2e4c39e0eba8d56fe

SHA1
2144c82603be580f8a71ac4fcd324a20ec3a52d3

SHA256
c252841d0b62ba8303f1fa818a434ee11518b6d4b49b33f44cdb6fb5eeb67b65

SHA512
010fbc7822c295daf4b411a70bfe38a55ad12ef15171abd90e58e979931c1fc623d90b410f3f086b4e05d1c8c4573f076f88b85776174a18120f6db3e1fdcd6e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
47a7a14399d0fa1e826e1423da2ee60d

SHA1
1c9f950be4b68fd1db1c2e6b3f6e1c12c54ba32e

SHA256
cc05a4d0ec2c6c1fa1d82272af7e4351c4f07ef7f9b4f89272228dd27dc9719a

SHA512
e1b225ca7daac26cbccdad75c8056dd06465e731c789aa119e56a068b1a58904311ca12036352866b586d7c496865b90cbe4e649dc2ca4a174332f7e1afdb3cd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
f0c66a425885563f8a1c92a9627b5250

SHA1
b27a5a528c4044d6c1042651b557e82d8441b678

SHA256
a523a8e50a4d15a6326ceeafb23d401d723cae0d7337814abc1fc988355bfd09

SHA512
105ecc088493ceff61f43d9098709bcccb706b931225b3662e96481a495e01fefc3611e09c6fba7d554cc81d943fcde0bb8b7af1140ed161593c6d23c98a4954

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
259745db2b6b79949f343992dc25de57

SHA1
4ebdbf3d771a4a9b59ad4f8ed6ffaf38c6b12413

SHA256
5e439609ec91f2e92e08678b9885168ecc16b2f9fafcdc89abea39cb6956edf8

SHA512
716fafc7a796f2bce655984c5e90ff6bf8d2d3630224675c8387d95db98d8879eec36b0c09aaf093486767f71a0394b345db355ac86e9ff24081d86af3b9a6aa

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
9ec9ce9d34311315d5b81444f88732dc

SHA1
01244cf15183960927e8f9c47f4e6d1398e34a49

SHA256
4ef6b9cde0a43b024825244d99a6f139365685a819a99d008fca8ca97ff32f91

SHA512
cfe9340d46267a1678171defe3509ec2cad1407a80faa9fdaee796320db949e7a0668f322a40284a20696945195852f7339b7ad1aa3a35a6384cfa330835d3f0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
7e33f0408d28ff7ef7afcf98b0aab3cc

SHA1
007299f2c9ed35972408b11007175be8f3812bb6

SHA256
68535f91e4cb15b389ab812e6064f3a277cff7e918895c5faee3932bd737ce72

SHA512
ff46de722cc1a15c3e3aa5f704ff68b6c63c1a12f9c09801130f52d23ee7af2d35930b61f73a0330446d197327dc64006a6035388e12e6586c04b274892f13f3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
b0bf3a0bbe7924382de482aedbeb1c54

SHA1
4efeb9bb0384b545531dc91f7d95925621865098

SHA256
18e6f72bd377daeb34d0e02c68189be1a4e227d3ebfa277120f3715aa8b0e171

SHA512
8f28f4f67fe03698c9e15967ce7db99767812b937049bb7dd5cad14f46c9b5ac6202a1f49aebb13be44b47c3f84aeb8f110fed64d5f0929a4259e0fb69e0373d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
297cdf97c7438113a27d6bc5b2cbc8d8

SHA1
1066df3bf092c07f45b38f4ad764cffdc3a9e4cf

SHA256
1f0a1665788ae25d08478e4ea2921ad81c8bfce025f3fe6a6275a33bee500c24

SHA512
9bffb78de93655faaa388c2130ed67daa82ec7022f8bc2a5acead9be93e380dc6dd603b8a9f3ec145a0031c7f9cbdfc0a198ca907f9c4cf7023ff35cb8ff68ce

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
919d9d171ee74b8b6ab5a288c151d7f8

SHA1
778b163fab10f66aa5b4b6f9ecffc94af34cce29

SHA256
88b34ecdc6c2917e4a94240d83dffa0d7ea8b8b705bcf43c4f6c24ccaa36c069

SHA512
324a917aa8d9304ec8a04a33d14d0b572f578fc0649988c04d830cebe233123be95df16f5818e2f5cb6a9051bcc5a3385e9b2a82963309b6a7ea4ea3c1b9808b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
1b7ee58b247bd65dfa3f8bd68bc11d13

SHA1
1495c6a167e9a3ff22cc9f3c623c7858b54dd4d7

SHA256
02faa0e60a52a2e24f305bbf240cc46e1770fae1a8765c8fdbddbd38059e0adb

SHA512
6151e7b61606f441b76594cc448ab281ce26d68ae69a7331bc570c8dfc64b6600501357542c5e23ae9600191eae7e538d0695cb9b9908ca1017b2fa2a74339cc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
10aa20d5d9c63ab3a222c84119915c17

SHA1
3b7101023f4551da0fde6a33bcaf1c2d366b7f28

SHA256
f63771717b0a1446db8d3c78b059cea38f04dd4b3b1eb3d513c2f000a39e8d18

SHA512
a2dd3c0a36531c8cd4801869a5d0cdb422c3f89df34d512c6ea655868d533b52468e67a81c005eb1424cf12a898fb3265d66c2f986164201914038ae33b06b6e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
4e7018441fbed31f983c11232c4cafe9

SHA1
1bed87e57765e221e6aa4dfdd28e14c1a97584a7

SHA256
a13408a312c6fa9502042f43ba47ea55cd8e28c0be4278d43e44b6c3581e8e4a

SHA512
192dc3afcad2c4573053f8dcca09b696062e24cec091d8f9fb6f12e18b2f0b88f4ef9e0312b4d3a7f999b94f5948c644ceb415ed9722a13a34340920404a8664

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
91f2d66640207f17b864b5b643900fbb

SHA1
2d5c2b33c826c421e2d2a06a1b47ca1d07c1994e

SHA256
9de9118643ea8bf35ebc28762dad93b78ce55b56a797a17784d00ac2bb41416e

SHA512
250b77eaa9062070a6551dacb4b3be7746ef553405fcba16539cb1533615d59c3ded192c2d127da1353f3230b8536785aa8579919536437e6abd8c5365179564

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
6b2b0391ed26b54993dee70c99c58e98

SHA1
e0a3b9f30392da0cf79555d5809c3df64cbae489

SHA256
2316c5f1f87efa543b7a938100ebabd5a875e62f392c33effee28de770c15e05

SHA512
52a5891f68552d30d6bb486a89ef02cef2daf26129482aa2cfbb006d2b2493e51b8c742b4e97c37987851469fce261bf3222e0b2dfe2d10a0ea84354684b0467

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
e5ed77238eb156def8fc3dafb8b991ff

SHA1
a77589a70146ab7284fe0a5322f785e84f4417aa

SHA256
4b8e98947143d346efd77a124a4ac4453d135678d0d7e2d815b043486a3393b2

SHA512
84072921392474ae97adc27aacd9dc9491bfe9af32f3bf302a3c63d107c5b9dbf87a9dd5237d5e8e7eb6290f5736940c163548a48da2254e34924d35f661d419

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
7203da2548f4724d3cece9309439b6cb

SHA1
7195f1bacf3598521b4deb295e81d4c189a1dfd4

SHA256
d4aadfed8e36fe29313b084e77dee8fa03172c289a34a81a83d4238f4aeba0b2

SHA512
61046163c6ca7fbf1db14eb6970c2b7344cf0c6ca9a35aaa8507cd4a9fed712e04542e5a6444eb5b1e44a99e8b3c11d2c749d4b5202030e4585e355f4c511812

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
b2e70571629cb5e21a5e53d98bd5c8dd

SHA1
7f3739262ea4cbe8db561cd5b254bd1ab6ce609a

SHA256
782bd4dbcb133eda2957c43397b825dacc3148574ac33f89a1749cc2730ba33c

SHA512
479dd44eed97f47bda3042477c4009d3a2790f5d01e81c7d4c7f9b5b1dffa5f0372066a37bff9acfa11259dc19c4356c3735770109e994464104e3d5d83f9953

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
900314bb2302715821fa8c1ce36de902

SHA1
a077ae154491ed586b14ba9e03324b6d14f4d54d

SHA256
b437bc0a73b5ae64a2157e5b32a859524bc7d37ec06a68d061fcbfdbb4243155

SHA512
c75f593f1ef64b8ea80977afdd514150195785dbc50c10ac134772c5beab868a8739a84d489dbe9f071fcda2d35117436b00989970425ca626ee0aac28356f89

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
ff08c83c2b4a9b1765f53e965aff730a

SHA1
c3aceeaf8a25b34eb24e139edcff0fef0ab1b5ca

SHA256
d34186455b193c328aeea6696d46eca7bb51fb9ffcdbaf00ca5d5e1e8d489462

SHA512
20347077c8f771f829946e310a30b6b1bdedb47f124e742f30da1fff198bde57524d167f81fb6b52782448a842bf163762dd10d310bd5bd028e77324bb2cc694

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
315ac4ea99be3fceeec271c2b3560959

SHA1
f03883fd55868a0577ea923345c6da33625b92a9

SHA256
efb7eb96ee3ecc8e1c5dec842f176ff690302998d4b96d1ce74bebb70f0858f8

SHA512
0457709b6bfe2592f36451c8558fb8bce8971f0e57a372b63187a885175c77deafec1733cca42035a06a096bafe436d4f66b1a2eaf6f8810a237d1facdbc70f2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
472ccf19c139bab5a43ab606e4b35e09

SHA1
39af95fee161fc72b017bf56647265710bebeab0

SHA256
57a6711deea097028b5d4525b78bd06160efd90f0f600dd91b81cfde1e5771c8

SHA512
141035bde0aa03dca9813e39b79e1fe3554b24ae1b720eca3423388fc6d4487b473b57ae755ced8f79f37bb8e32b74c7122936b7b3a69701a79699fd0111233a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
a94df538a5ae77cce0832eeb2227ced2

SHA1
77d54e392a9b86059faa30a571cf970e885a95b5

SHA256
18e9de708666c253f5a47e542cd8ef506374619432d10d40fd20d2ee04543a5f

SHA512
ce6c97146633e7d53e2422d8e02949419e2cafa061a8f49d21596c2d2be753faf606c8991368cff529e0c73cf8da35e6516fc010dfd862bb69e2f28d6ef684fc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
93533b5b86d928ea3f7e420f8d7cba75

SHA1
65d91ee7ce8b7dc44a5140976281203a1a1c1606

SHA256
f9a1534af1bd2770909de56e5e69e159100760dc99d0d48f3c5c916936afa3c2

SHA512
dd4c70eca151353a704b42e3800af8ca6ead2359e834a08d3cc683f2f5ef887e3c98713cded179f8b53789a8589c0acee1b23c036f9c522b525f11cb94d2f9ea

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
46b6024b963ff307fd665e28d4ce0740

SHA1
f6a6eb58307380e8919727514c3b88aa60bead7d

SHA256
c89a150d2d5bb83450b89b1bb06df216551b5110c00408633b822ccdef25ca68

SHA512
a632e98d7134f3fe8e668683da17b54f538276b143583360fa207aed593cef9cca33695580d7db7103c9f8130ec86e9b06acc9292388db59f61e78fa80adf175

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
77f9360bc3e47fe66a6dc8621e957298

SHA1
2aabac67073124085065ad36cc6a6bb344a26296

SHA256
67360269dc4323d6a4e658fa92445c726c12deb337cf58bd0d514ade0026551d

SHA512
19d5f87d0b587ee06b8dcb62838da0b04c54a8450fd7c6e4171da1c6cd1266e12496808e67baeaa0d714d337321f664553aa0420e4c2ea78753aa95b270ead61

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
0df9400fb419e51dfb112039fbea257e

SHA1
8312118409b8fc757dcc2ace3baecafead18468f

SHA256
8aa5f39b345da43117449f53b64536af14ae7bf3dac75241bd5171be3aaff67f

SHA512
22b4e5ed1d96da0366f4e7173338471af9e9e2ec53d28aa61e5777661d53816db7941d7ec6f59761184b19af7325f5f5b75d9375df5f8abe9cfe33140564b79a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
25e66a385437a1cb9f8d4188d513f276

SHA1
9a460a7a701d89c40ee77399cb6625663e56b04e

SHA256
47c36ae49bf05864bba5721618faf076cec1819e3407fe0082dcb79167059bea

SHA512
08236f5214eac5d4bfb5f120d00d3c1cd90c3616959fd2f8fec9f41afd1bfd398216b97081b072ee928b9e80e2f690fac2c60fec6f6c524c29bc10ed179a7904

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
f08ac1db18857089b9845cc1118e5e76

SHA1
2f3cbd3bd34023a64a85b03140d03fd61cba248d

SHA256
3135d91ba8af0b2a446ffc4e1fa14d9b93ec184f36f85e8a3353b75c72b97a6c

SHA512
b99c18ff52bbeca94bee75339c25410293147bf85130ebfc41d662a795603f7e270a3b150085774de70f053bda87fcaabf0ff64852ea9645e6dcca0deb1c4f18

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
853e4826fdd7fbf515c8c55a07787640

SHA1
b5a4ecc8da689512a1d5c5242e5e5adcc29486e1

SHA256
72a66e82a3e8d97a21274331407b664a15656d092a80a691e532c1814d2d35a5

SHA512
c7f675abbd6ec5bd25dc73ed6c84ed9c9f427eb069c14d4646c5cf8ac3382411511f06125e1c936535308ed07d4b69bc73382b403e6c064a1acbdfd94c6f0688

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
80f77870404da566886b600482094743

SHA1
aae586c1633f9632bdc298e3cbb7a7e222d1cc92

SHA256
4f24f34f4ef179f63c7fa02f0caf36cc758edfc6cae93cf2ee5707830560f741

SHA512
62e7342d0081d7450b901b8386a08e2fa1374bd559ba7014dff26b2cfbc704155d81d4057d565f5bbd77e0d3ccf859c9a2b3e65e622b9424363b361061088fba

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
776fbf89653cf813c40da9473d9268dd

SHA1
c3b31b3db91c5f1ee120ee6903339ebeecda2939

SHA256
76b762dc0abfac974419331e2e55400460c65add8b8cd558730ee4472066e08a

SHA512
ddc7ed5c906543d0d8252c4a4c79554aa0f0abd464dd8f151dc9da0f6e35f76cd927285ce197c86df3a28f4db386f102c3eb9ebe58002a13c22b6fa17fd306c6

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
42B

MD5
ac154d8a3b1315e61e5905fc6fcf547d

SHA1
a50f49738881b22bf11638420bba2b73b2c2368c

SHA256
07fb57b9dd876615fed4efcd8a0f138e69c935e952b87ff2f4115125e06a88ad

SHA512
8a31afa3dc49ff3979c1c2b5b46aa56e4dd2edea918d520c4f414839e6d9bb852430de0c18962480e17b3748bcf7f2c7b0d2f593d70e33be11366fc099acfe0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662721799026.txt

Filesize
77KB

MD5
f197d03560165457fb7e431c634ed537

SHA1
ed4391a1e4f350d894379ac92be8a273e1052a22

SHA256
6dc44ee1c2c9806030019f661618242cd774c620ef74d82161f71ed336bc1f50

SHA512
765ba9fa5bbd9dc246bc05c3250eefa714bda2762fec9d7bbc317d0d3d0bd807335c0221d6942bd130027b085dae91de62c5aa67a95ff4714bffd6a0b5be1d35

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663191189319.txt

Filesize
47KB

MD5
cb7bc3f9a38f11c45d2d2ee2085b4b84

SHA1
ce28d88f0615455125b92baee32339b096dd9717

SHA256
823b1af560186603b78fe42f1ffb0acf5e5c653b6370fea83a749f3fad86bee0

SHA512
49b55c7a58755c59952c05fbcce93bfaa9bbb8fccb7884dd2a66f3548a774e4290f999d5c1a2dec294d1bdf91f7998b594e97eb236342649caa31105871ecaa4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727670188807600.txt

Filesize
63KB

MD5
88acaaaf19327101c10c7b85af14a332

SHA1
6bce3368a6e34c6e0226695d43fd4c1695da8ef1

SHA256
08468612e0d699794e2a116c4c003d26025fe76459d321c2ef5ebd156eec6a7e

SHA512
04e7d0fe90118287eac326cdc36424ceb9c6bafabe71c09558ce003de5fcab6e5ea48c31f499393a2791121e2293c42ea1d3c098dcafab877b3f46060e8604e1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727672984949051.txt

Filesize
74KB

MD5
5c8f51b19b888ebc977c4990c092bcfd

SHA1
38b3cbe0796de876311cb3d6c3dca943039d6b5c

SHA256
22f989b85eff659831eb03514efdda74ec6fbe12c14b73d88d008d88bc512a48

SHA512
24586fc49ac2b24163869123f01cd869959b620d41e84fd1075bee5a2c8de39821b84dd3e41b725416cf1f54bb49b0ddc61568f45a7945d2b13950b530aa2eb4

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
f20df7a90bc20fb7cbd32a4d58016718

SHA1
a8e08f02165dbe25d78c1828689055d2e56fe13b

SHA256
d5333b4366816472e9ffc39b4dde839faf9c9a208168fceb798fbb076abd8231

SHA512
574da41cbcbf4cae8a9160b21ed8154b01c1899b019bf1da860d23e1c572790313f5c43ac97459b7c799f438194f78e553357d0f16a1fb304990c11e1e65ea50

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
22f4e2f23c1198900d51f7b865c6c6b0

SHA1
345989c83688a6e00f89652dc2a252164bad757b

SHA256
4112bc6c34848cf1b5bcacacd56f76ea4bad8f8b4c1570bdc2cf451f6d739c8f

SHA512
ebcf5e7efde879c624c9fdfa37f54aba6cd5f00aa9e8378cb649ea938740801110578bfcb12431b64bc045fd271884fc0dfe681dd536f4edb43a4c1c5398631e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
dc65a902b273cc903bc5822f35bcfc8f

SHA1
8dd2af171fa753b3aab86ebb5ab89ca75dbee910

SHA256
b7b7a50b0fcc11f2030da9dbe246c35c96888d6dd45a061d4546ec7776c42cdd

SHA512
2be74af97609e18b1d90463c71cdc3e1a4e61b2c6bfb9953ba712ad596d5fc9b49645456ac98fb36d44ef4e99324f7f677d7e1fa00f390ebb6916b9359f81c77

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
230b5e3b5c7ffc6cc58bbfcb5f89cbe1

SHA1
68ccefe86bc6cf59c3abfe33ef78264ea0f0c1c0

SHA256
7b4d1b1a483993feb4fcc4e9ace44f872178962b00f5bfd9e2b3b58a6186d89f

SHA512
d503b1df607992ac86a251bad9075beb9374a1e4825e2d253d1de0f55b24e98eb211022c070e2ee9a597bb43f1ce5d9678e8d3dac61e279f20108f5e9e29f30d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
7fac68c30f4d555015aed6528dcedc46

SHA1
57cb5d29f05c0364397e74cee0849dcd4c6a7cb5

SHA256
001461ec05f1bce8d3b91d929caa53f51432621a9830a7ea7193a94dd86fd473

SHA512
ea814da665100e8b4de81e857f5f73a7b38422c382c6065dcb0701a7be4ebc4c0e572955c30fc8c6ace12e4cc17c1c48e24673dc4b74abe5a95cfb532f5f0efb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
0c28233f85a4fd653a2fd25abc1be47a

SHA1
cd7e9c9ceb603e4a5ce5ceab8237f13b2cd22c5c

SHA256
a2d561fb3b47085f6689c8ade1ecd616d07f713c1e4f780bf8a4345fd43d5b0c

SHA512
592e3f8f4196a19319563b9b2088fd4ac6f54b677f20603d7b955c53d6c23bd71d28b67c3bbf00c7c73c69ddaac4ca571417bfa42cc014782b5022c2c7bfb706

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
213ee0f14b9371abf0bfb605edd52201

SHA1
df928a79572cfcae790dc7d7c24fe4d447e9db3a

SHA256
0bcd3ac2aa3dfa11582893937c05130ede66a9f909ae0a03d243ed636ff619a2

SHA512
df302b66d361958c6781f22d0fd4919f8e5dbf17b55e1c970628749ee3a7b200cfd81fe2f47e3fc915028376b398acbad8e5e6ae77ffaca682e67844fb67a583

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
85423017c30958499affd6dd9aa54766

SHA1
b57b0907b759205885da858caf1cc37b1ccd3f6e

SHA256
c2179096f1f71cfca80a685040ec183ba4d6d67dcb685cccdae4659035e56024

SHA512
0d2ee10f7f8bc0b73f5419a016a31ee275935e32d8cefb8da3fc8b55ba9b9d9581fd0531443bee4ac7376726b056e2fc1886368cc934f2e6b9ed3d15575453bf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
245ee848279789ad9a0be59dd648e7ef

SHA1
237d2760d9d8d0f68af8a2f645c9db594475231f

SHA256
c7d89596851545891dd9a9c5376909d81e47e1c5f7840561522d2bf30e0b18c6

SHA512
f2bfb7f9d5477e265e851b8f2adf89e1c6cf5b1d4ef7b138992e1bf92202d321a82ea9de61b4e464b9cf78eef4c6c558e19b79b16305d14586e7aa2b3eca4934

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
443e86363fb6314e91810a94490db2b8

SHA1
1b5c987b7a3a1b20f59024cd98aa70ff4eebd298

SHA256
a31a2d34f1a254bd5aea332eb88d6d57355a1a46040dbce8b58aba09b5adb9aa

SHA512
d5c207e107cf5eb6f5f6222ae7676c302305b62d4abebc2f2fcb8ea5ee55c2000bf5bb3703cb0b104116227bcb6393b342b0f00c93030c121656a3b5a34b4947

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
d841ad7f3d8398d6e2bd73b7b364ae0d

SHA1
7f1b978bedadd05566ce4cb025b1bf6b6b2b8ba6

SHA256
5c1a46b0fd22c0a5d6c31d18cbc4d8897787e9657c7fd6a76449260213b2d4e5

SHA512
4e8d75f70e232d0146e91d5639afc4c1780ad3035c6320a467a27bad0131f0b6007b6b5a99f17ac18aa1b35636bf4d5e2c5dbde5aecb5bcdb0ff1cad9f813ee0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
f9408f8234c0df0acb9d2a118c2b65fa

SHA1
c1e17f64375f754db3c8de39b8111d72904ca789

SHA256
a0bfddcb61326a8e9170e67dd6ada7b5a93312ba52e394b55bca38eb9037e022

SHA512
27e2d961a72f7adb1c1b5548e897f136b0ce4445d5d7583132c2f4309b977d41484985eb05ffed5ab0ea142b38adaeb2d5bf82b09881803779b42c6fcc540fbe

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
3eed7760a7fca390e30f8696c4274616

SHA1
572b7c5672a31ddc4dd796b62e4835d8cc1f8c90

SHA256
233866fc209438722d94feff8dd0183b66ec2b141450bf030ce4019ae81775d3

SHA512
0bb294784a5ea233d083dcf818ef495b0b7e6bc941e1b1eaf8917ae43b1c5b34eb06641bf41fbb501c26e9aa0aaee0e0175cdf304d4858013afebcd564857b7d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
1117ff16b9e3fcfaa7d5e87ae9b8def3

SHA1
2c55e59b0b65d5f6ec47539e96b94de6dc02e274

SHA256
aa7ec1b4bfdee1ef784f65bfd9c900e8ad743552afd97648ded9b26720b89b8b

SHA512
df77cc693bf17fc333ec469773882dd189330bfeccb3b958a5cd06688db2d0b8fcb82bd4e860057bffb408554089c6e4654b586639f41b7257b65dffcb2cfb6d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
63b72272232e2889f1aa7d08ae9017ae

SHA1
f8f0d22b4a90d66f515f099525367665754f579c

SHA256
ebbaa9ec449199a197eb011415db87d12ebbe5e5382bae1745832e2789ac362f

SHA512
d2ae5ceb892a8586b966737bb0a3a3a7fe041aa632a2eab3d839b11b81410778d064947dc4ff3d2d6c47b7bc69a0fd3d982d0313cfa3c6109a20bbfb5a2e8345

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
93646289357f70e0f3afd3405d2d3e20

SHA1
ceb1456e992ba0f53848075e3dfc7f4f2003b913

SHA256
b48aab91594bc9c56febb87ca6cf2d3e976739f669ba8711c5e15de1d4328983

SHA512
ebd613613937ad4001a61de7cb6006037723384d90a425dcac95e77f431f49eee760b9fedad87ae7bd5d4236f7c992a3a4fed4b0afe2783ec314e6ff97785bb8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
850d56b39ce3e14d03af9908a1fea705

SHA1
0934210597c63666172021b138c25e0cde049cba

SHA256
5169f280687c9b39d003a6009d888297a23efc0f7d735deadff6acd6a2b7d7db

SHA512
6fdeaabc9ecec5e5d85def8eae2d21d3c6ba8989534106a273e2dd08d93e3c06645d870fa991570d8bb82bc4efeeebadbbb8854a3435cd0dcd124ccee535329f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
c04c43fda5e13be8e50600c5141a38b5

SHA1
4c0ba5b3a73279ef829dc70f1d9160f4b7b2f93a

SHA256
cabceb98b663a041d77e43b48b4a89afc97b48866f4759343b76ebc210c4864e

SHA512
945a24537914df0bb110eb0b61f21bb092366e5306b69af55bc31e4413d8ebb71f3308cfab62f379516438d514dc31527cd469545a551af3f60abfe7c6fdf32d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
63ef645050fd6437d13639e64d22b6ab

SHA1
abf38824c449ea162975e68e345840be0f6466b5

SHA256
c3c12844a6cf1ca3b78879274c740b53cd6fe0827f7e149e5b9d38514c6da803

SHA512
7af9db2716bfe4310700a80dd8f709858c550746ee6fd02e65b57bba6cddd23d14c41c4bd287d13d5539e7d8ddfdf5c6fc6bf29d1c2ed02cf6135204f3c239cd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
2697d7066e8ba2a75a354e513f98b0bd

SHA1
6e3d0d4d67e7d3b6c823f5d56d4a1f66e6cef292

SHA256
3170e4afc8a84718dc206f28c3d966cb29a423b0991e4f68db7df89265dc68b3

SHA512
41bf2f45e573e675ae7d6e7650818e6392b31dc2cf8b4ea7c6e7a46e08eca21a3db455e37e201c59b4936199522c7aa9db61bbba2256367c1762b26aad193b40

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
d671227c6d6db542ce73700c0bbe6ef4

SHA1
ac3ac6c19a079bffd97c4866d3c7cae5ce8bb5df

SHA256
2e8481f10432dbdf584c848efee296843a110cad5871a4287cfd30fd590ac3f3

SHA512
95ea687d98c2f1121a1a6f43520406c0876f1912a748ddf4b8c3dae5dcf08d7f6216cf07dbf2ab50a459435740d0a69f4ba7bdfe4e885f3657a7103260cc3fe3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
f70b5d88964043c9bf10ae5ed754cc57

SHA1
04f9b82a55e2b771524bbdae132652e655878071

SHA256
e9186aafafb3eae70812b08738dbe5bc1e44397de615082f61ef8d0c1f648d14

SHA512
cce43cd663a1a4f233a6994c40d6abfe3629b07f1ec453da951c406c347313328e6de1bb5434fa0dd01ed009dce86d6039d609c28dafecac3f642bb491854248

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
bddc97cbfb38280e951b43a61cbbaa3a

SHA1
45094681a7d3b93c20cac89ed655ecb8f778f5d5

SHA256
96b312beed0101a92f84868c24c42176566f1457638796d0f1ec2a65ad13aba0

SHA512
c94332d514aaf019cc6f6066ef279548b6e5422b2160a6a7793637c64184efbbd41d28efceafbbe3138ee96f5968190c182dcdbe8943390d4e79a131f7cf5bcd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
9cf1d6f43568cdc086f31b6bae996e41

SHA1
5f555cbaf5602188b88d32f6131e4cd8a613578b

SHA256
b009b5fb53105c38e178f48a0907e35e31efc85678c097f6502e0858e49fa67e

SHA512
864eb18a3d8433d5c01315e4a74c34348b4573cd6d472a9306f42858e2cec029736b69f11fa7dbb311ff3e413e73a82aad6e555e2d24ce39595a3cf92fd0b776

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
df0562f6cdc6fd9f3fe61b1916133947

SHA1
b8aa053e8d134a270f990f1ea452923fddc7847e

SHA256
d913ae3e6e03e2456df1a505b2bfb3708d13c52d1aa87b12b82577e8daf14403

SHA512
83426d689ae7a0d4f0804a8532bc0d76bad01ca971ff8207155aac2492ba1f98e3967bc4cafb632a1b99ff48ce8fe4ed940d47a63b8b797c2bd573b4fd6b4c7e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
8895ac02f2e9d13c126f69fb30e35001

SHA1
4e085b8624c30dbcead638978a78ea4d87b3f8fa

SHA256
dfc5d1e1e52a97abb6b8163065d1d8787cb5c0597745c114bbcb69d21385940b

SHA512
a44bcd23dfac03734cb95b08cfacb9f37f706a6065a0a276b185d8593e3e8780c8cd9f62017fda8ce26df2c703283237ab3afdaa11ef3dd37c6156f74f9f18e2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
ba785b2937ddbe99ac65277838dac9a7

SHA1
467a1ba25e2ea007d7bc6445f162e0db15100c5f

SHA256
57a3654f4d5a013671ea4a66a366b3e37fd546059961a4a3a75f1f0713d65cad

SHA512
677087d28af49ff1c92f764ebdcd8153b96f8b94b6ddcbb99d08f1c1781595478b893bcda3197a6605c10f35f27fae497198a18550292aa81b5110d4c3cc41f7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
0b11d36abe459526a3b30d09c050861a

SHA1
42fb9710546d317dbae6db53f494aa4a44266e97

SHA256
f7bb875f6d23eaa5b63c4edaeb92b0c50427e62f6b388d2f1338df203b263524

SHA512
ec741acc7cd2e1620ed645df62ab820bf095bc025d07ba04ffc20e1faede5f61113c32dde3a8ec3d42b1ecb85d48942644b80e8495b7378ccf17805462a9ea31

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
380bc3009f00732b98c858844b51028f

SHA1
c8adecc06197cd76d46d3cbe411f0024fb309b50

SHA256
fc4f56ab8ed48cd70aedac6b56169a463b50a8287c569c52f5ba128efc398cc8

SHA512
33e0fa7da96888bafee9351f1d1ff5608746d6b58594a5db1bbad5b0cf0b9578bd5b7216fd8a7747308066813e71600787703b37a34c30f9fb89c2322f6803ca

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
9d89f52cad5d3f9a37ae3d187aa31042

SHA1
540001dae003745eb4165c50ed328173c3cf8ace

SHA256
155cad44a963983dbb38668a489aa03540be15a095cda7bde610650db92e6033

SHA512
90c411eb7aa7bba2cc7d6734bf0a9ba2f7e2673779b4caf4309c92cb4c6df9986da5f2ca3b16844bcb8d5b2454aba6fc5684da1ed0b4a73c352bba47b3865efc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
e9f6dfbc2724cadbe5bb7074ce494abd

SHA1
20bb1d8c0d0390a7b516f69d5f5e0c24cefcbbe9

SHA256
8f636fe1e77eeb10fe7d6a24035de6edafcffe1ab6ee5a40022d87bfcc4e8e53

SHA512
3f1c0491f36f72baeeb785be92b425bb2a487102759f74cdeb2b7100c117cf1a38e2b13dcfea734627e6ba1da829c728d0125fa3d57e1c81316b5be8c0316bac

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
4d923d5c5684d95f514f50cdf7991f98

SHA1
496d88070b9d5f4ef7d208633065853c1ca4215e

SHA256
ecffb452f4fd7af300ab141f23b650ba29dac243870ed95e20b55ea73421f0c0

SHA512
41861e3305fd3546a1f4793eb2d5c2e538f876caf0e73147a448842f70d54b891a05a14095e57219a563f3f18e9dad524eafe3c9fac8af2f04202dd02907346d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
a2456da00af4cab38c66c0f8c3b4566b

SHA1
8e6c57c6438d41611f26c0b163bdead43ea72f6f

SHA256
190a16ba3a3074be50e0fea80d1385db1ea05e48646d154c0b0f09c876a2a710

SHA512
c9d19e1583c5ec716fbc3d4411009290779531d5505bb5055f8cbc7d5901841e1280751ac4ecf6414982883e301130e7970cf3a19956813fef63add1d61f9020

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
f58a58e31ff7a19a134fa3c5d2942762

SHA1
44497a789261443e8d4984396c3b930e25828fce

SHA256
334f230a0dc15bf58bd58407057ce01c500911e4fc58ad7a07bde3efd884c634

SHA512
a247f05aff31cc7c32c9fdf7a40a3a48eae2a38a01a19385c2d90fc76f44e82ff2f2e8b5a275dee5f5d20e2fbb73c31efd8d384928e263ae5ed9f3880990ea2b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
b0b4fdc884156500ee4c4df2f727f79a

SHA1
ad200d65f0bd3440dd9962f68107b2d1a50bf68d

SHA256
dac6c7c9b556aaf4b3be9f879e7b479c96ff278a2a6992773273d2c0d569ccf8

SHA512
54c0bac5a7baf28e7bf9261a0689ead7caf42d536f3b62af8fb67912893a25c999372f6c78a243dfb6398e5821fc3e3a5bf68d8e8d98997049b99beb4ef28753

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
a5fb69b008f2a58a88ed9be0fa820ede

SHA1
b73d982c2da0f51a84d0d529860aaf220a352398

SHA256
18e2ff46496600bf1d8d9965bd1ea537c5305d6f49c4fa5514e19f4c61bb66a8

SHA512
4fc9165ae818ba35c4e431c7de4b7aab75a5b99857fbd6646b64b26cf163ce1eafe6aad74bb55129b5467e83c0cd460d98c871b9f59cd57721ebed2a5e09472e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
75c29fbcfbb6af431f3590a343c21bda

SHA1
5a12c93398808285e05b36af4a40ae4568f1612c

SHA256
9a9bc663463db3f7367c1169fa98d38494ced0f6a103203eb0a64c6622b5b70f

SHA512
79490755059dac4b13203c898f97a3b9b8ed2a7ad8be5e7167c5207da300d5f73e4a8fba77d20b415b5ab585098b3b37f7825d57e45819a031ea9ba1436741b1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
f11764533870c78099167296b9aa77b4

SHA1
8f1f4b7dde0d629ceea73af56c37a4cea1f667a5

SHA256
fdfdd56d7eff1667fc33d33955027ae3dc1285a8ebbc32d571115602682e7d40

SHA512
c0a1b86bd463da259b6d7e7115dc97fd9ae079a6290d30a68897df9813cbe514c28da253a91578cfdd757f3567210f0c69590c8fefc2fb5276556fc9ebc5d21d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
67110ea92afa84676ad3fb00490296da

SHA1
bcdb85e428cd1ea1253d28d9f1650553db4c19c9

SHA256
be23a8c17b11a4379363f7924aec044fe88ab2e7bcbb9b570e868e28c5eb734a

SHA512
4046a3a3aed7ac81894e1a3b6daa6fbcb32b5bf6e6d8dc9eee7533bbb1c17e926fd7684a2488504f666ed348f25f2a6a09334947d04ec1934e7e4caacff7d3bc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
db65f7ba8903139bd9c663dcca708ecc

SHA1
3c27ba25091f804b02e8254e773fad1b367c65c7

SHA256
a8297731821364f9861604f8882db0285b1c0273b1aa2f96ec1055174380c972

SHA512
fb738d2c4db3ae03d5b3157b7b71428ec9fa601be62e30f15fa376f9eb2d4ff4e502d71fb28e1d2889b2f91e3d73917d76c0092e71130d1a02b24dbcddd90839

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
c79d184dfbc1f68cb4546d9bc0971d75

SHA1
a484ad1da10351edad348241b1c29ea8e692bc6b

SHA256
4de50d6e0b26c545d5b6a26b5e065ba1bb4caa277fa3b4f8d108b1e182ffd877

SHA512
4adbeb25c5409009ee753e0eb5f28aa0adf086d45055627f16d7bcb083b53a5e06e87b00f054567017fef53096d618e00d45a9ed7eefefa567e1ea12094d057c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
d3b760fd0ca6563a6e390906bbc5db0d

SHA1
36064d5adb1b8f3ae6bb3abdfaf3fa4d4d41bdfb

SHA256
524d8d80fd0c71c59d1e9649204e388f6c0835537026ec6fe351c8e3c6146fb5

SHA512
d4fa0a59bb2c215eb07d009cd1349c1e75af9738f09767701a1f901ee9bb62361280bfa25538ff02d0bc67c7456baccdd71ec4c6af40332c1c6e47b795255762

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
7208ff0ef4c6b212905bd82176dd50e4

SHA1
3865865fad059e74bb3c7cfbc9e59bb537fd5fc7

SHA256
c406f3879414451bf4a53f8f79e90743bf7de4218e32f7b02ebc68824a9c1615

SHA512
bc80ee7613096ad23818ae45e9c93b78628bc9a25be78f85e335af91994ed875eabc10616a6d928d3c3f60e24564e63abe020ed0280f7c01a9e5743dc2617ba6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
c587d8a84c5716a968ecf1028f6a0483

SHA1
81a32af938365f1dad70e130d909202c3ddacd66

SHA256
832b39678c42a7e1c42b64fb204b0ec18853b563bf5843544b09dedda666c28a

SHA512
3c3aff28eddcd398f98fed8bbd39d25e9290036824a3d1ce6767aa7cf2773e5747b5608ae18d0660b3514e7aa296bfbb1031c91fd49562106344fb3c837da2ce

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
1134c0db9918feb788290f5a4e824f1a

SHA1
c7c4596ef5c4b5157afcbaee179dfa467c54524f

SHA256
93b6ffc935082197f792026bdb2374b16da61354a9d2d6c6bb7366514e2667ef

SHA512
1524663bbe076045529b50a33b337af934be0f7cc7218c8fd9e74b98f22b7b742402d0ccaaaa699ff65e42aa616e075a9645fc495073da19bef8e168ab6f39f9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
dd182941546b35165934932f8818e3cb

SHA1
1318872c5197392b51a678f13dd1c0a12215f7e0

SHA256
c92b7ffb3f82946eb3b3a06d0a0feeebd5c5211d401decf62b4b01956f74d185

SHA512
1fc50c0d8a72dc57040454ab9bdd152a2ef74a3d6bd033542e45a506e474ddea30eefb50272f68a1e81cfb0a8be3b95f0cefe4dcfcf8bf2b32392380a50296b0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
4cc021c9d3503b96b045adde3f9dae57

SHA1
4c916186eacd51df8c98cb3fba761d28a64b399c

SHA256
72f26bbdeef2f706cbd175302a990b4732cdf06041a48d500cc59c8bbf951045

SHA512
c6e1cc6d8fe7355afccb81f2a411319b3b4651ac5a689e2d53acb3ba84dd5e198c5dd6169c9e15efc61f792bf1c40e4bd791717101c81c23975bd572f7d3b8a8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
5df608f0b38910122d91bb6bb4fd268a

SHA1
ce803d688523f84ad20d0a448e7614dd057276e8

SHA256
82a9995bc7b0291683542d5d15b4b76ab469b7e20761aab673b4787c248d116c

SHA512
453140117bfb396189c350aeb53dbce7ffabdd5a3abec55cf6556da3bac73711fd31c362ccf2f197f38e93a6ea2d1e04ad900206cb07b985f1f44559a3096f07

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
6891f8d59d714dc2fc94e2c1ee745f8b

SHA1
e3dd527a46d99298f615bdda656dfad0cb248217

SHA256
40fb8ff2e27c7a0a7def6601e1aeaf5ca28be92a8a9a1f11fe617e44dfe0b71d

SHA512
0368474cc562bbd82ffed34708b64e33a410aaf4bb3570bbe5938ddcf3877515b0a7bf263eac11a565e4d3c66b93b8a4cffa64a44b3364d8648bd870d4698abf

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
7bf65f583d569c75ffe0e8f36e029bbb

SHA1
26b97f736707ff8782c279c473d250986817f73b

SHA256
a4ed5868040b876fa8ee266d8e1fefd16ea677a3b6e54c88052fb72221b4bd09

SHA512
49d6d39d1b3c76f4bec14c3d000f292b2e31957767c614faca4061e2190cd9da276b503a6713c3593bdd1e9e3a6b466fdcdd5ee836f18d53ea6dd0525030692e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
5f048d35b45ed88a4832bb9f8c355a6a

SHA1
661b53e73854b42eed4301f10d34082d0a314835

SHA256
187d47b9b94742b66c66383864235888f4bcfed301cb449d29a8f3751b1292cf

SHA512
1a9c77fb5ab02eb49163626f15887390bb8e4f5e4cd688cae5d2b5907f14639d988ddabf8cbaee4606a86204cc858645115f052644d01d5854069d7229ad4ec2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
0a1d618bf72c46e1cad6fda06017f399

SHA1
efde43dcb8c152472e59f9e3b7635a5391f3cd88

SHA256
9151609e61ca992022582f4e7136aef2311c506ecc7aad8dd45d4936383dd0ee

SHA512
c25769b6275f3134159d7d3373d656517ffc050e9edae845bc1668789a8b5527a0813f7317f0be390017b35f7ab755648f6bc64ae0c35f5ccfea7d5607f4fcab

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
715d1b1d36ec63fff53787ce964f242d

SHA1
e54e9caddd96e9b57647c4331d52563bde3482b0

SHA256
16f2cf9cef19f43cbc00a987569f5858b6559518ea44d48f3ff0093599290402

SHA512
d692804733744baac1d71856727c5efb41f0b1ed8ec1f4c34d4b1ae13d626cb1b45cef7452e7704ef4c2863a5e627150978d344fd8a9057187d0f95b4cb88572

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
c400d3a855d3382e710caeb5d35b10b1

SHA1
662e105040e929dfc46eb839d5b255de05684f41

SHA256
64020ecac1f213e9a10138591f2cc5f1551dd76f20262839d74b962647fda4cf

SHA512
2915c8efa399bc707051aa7a3e2d9f79800be8a3b1c8ea11f1af9f618b1c85fdfa908c49ccef76a0a081a209dfa7590bdc500bbf4abb2733c4774ea8bc3f8ec1

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
abecde2afbccf1b16ae605ff206fe25c

SHA1
262b9e6e4bdb04ef08c91353fdffb1ec48e1cdbe

SHA256
324e43d14ec44dc39a397396e09496fec8201f53ef4f831266c2a50d934dbbab

SHA512
a34cd691c3e339cd80c583e582ffe8ae9d1316c438b5d3fee11df1a20885016bd9ad430ae0b9b962bf7d9ff3a9219de54e48bf83ef25f52a4f10157c21bf886c

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
63ef8401443523ecc49ceab749f37d9c

SHA1
1172c814d8b8f19a7fd6f736e0157b15c3050549

SHA256
b576c428b36edc250c16afd06c3da0592ee979dd5ad1f28c48c6d75ba9c39713

SHA512
3d419d7e70a81a3ab11231e5f549991ed625c4eafa4eefae247a2bd029f39b269292a1a363afd707e24f66b7ec0fa1a552b688764f0cb4313c764f043313f53b

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
4ef0d7651623c2e1c0ac97a0b5a98261

SHA1
0ebc05dd66c20e7497fd3eba11b84d07864bd020

SHA256
d2bee2d265e57b10bd7f45bdcf8db0bf6e88134aa0629af3c487bb4fcfe619fa

SHA512
528f0bd5f6a974b49428a9010ea2925db4bcd8669bc5339c1062a80929285951e4e689c91818ae910a87d66dd07c4fae9a8fe124effdd452a232e23df9187972

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
7bfa45edfba45818e5b13c792d57dc6d

SHA1
1b1216dec210b7a6a21fa8fdb12960f64a480c38

SHA256
3f35d7093dc17d21762fd7f40506031fe2304078c4150ccf6e63d98ef8505785

SHA512
897e58067c9801c60e078e0525f000cb39cb687276027cffccd6e2856f0592687a22128ca826db485ea7125880328bb505b2cea6ae09c061c5f679d4d63ed7c8

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
5422651753deaf9cb2285db3726a46d8

SHA1
a2ab93e90c08e4a890732ea6b75da1bbf7978f5e

SHA256
58fe6c2471ccaf6e8b8ef7d4ee5fc02b362775063f9723b3c7c1733c8c769965

SHA512
0358268d989a397de6aa42e4de52b75c4d2199cd5cd7a799aca00e7138b3efd915fd2d56ea0d80d1e733b812ced3ce4f169a231fcd08d6faaf4a5d5d789dbf55

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads