xorist | 9e26ae8f25bc652990615b37c49724377bd9e07a2bc3cfb9c9d9ef19a59b8a98

Analysis

max time kernel
138s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
Size

7KB
MD5

6a3617e86953e7f4b177ead1c84f71f6
SHA1

60ec0fecd409b5d9cdcb7e09bb9d692e2a6746ec
SHA256

9e26ae8f25bc652990615b37c49724377bd9e07a2bc3cfb9c9d9ef19a59b8a98
SHA512

dfc16fb2efe581506d943f4e1ce1926b5ca28133012d9ae51393111f90895587610cbf65e626051fcd30ec54f80e098553946b081510f85f3a785b18cb976321
SSDEEP

96:1yZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihEx/XAHwINBXlqlDmMUA:4zdrr1FG1WDCgmjPZ/XijNVlYmMUA

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 8 IoCs

resource	yara_rule
behavioral2/memory/3704-5791-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3704-5785-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3704-9842-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3704-10839-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3704-11156-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3704-11179-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3704-11184-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3704-11185-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2180) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\79l4PX6H5ZTE8RE.exe"	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\c_fssecurityenhancer.inf_amd64_e84a289dd0df20ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nulhprs8.inf_amd64_e65ae5a38cb839e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oposdrv.inf_amd64_9090a824ce0d0e68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\bg-BG\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kscaptur.inf_amd64_b95d9f4691816045\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnokia.inf_amd64_9be5ff0f15b15eb7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ras\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DriverStore\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\avc.inf_amd64_0eaf27d749819837\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_dot4print.inf_amd64_33c48c563d7541f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmct.inf_amd64_0f3268711a5b2622\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\amdi2c.inf_amd64_d7ae71f8eb52c084\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_b8b0fe7bbc76405b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj3.inf_amd64_9658f2eb83f061c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_9e6bb7a4b7338267\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_multiportserial.inf_amd64_e92b6921fca885d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint4.inf_amd64_0958c7cad3cd6075\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\F12\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bcmfn2.inf_amd64_5ebadf201c5b5845\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cpu.inf_amd64_0abeab1ee6572232\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\digitalmediadevice.inf_amd64_5b64b65052c3a32a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_glk.inf_amd64_7b6c08738ca8a856\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pnpxinternetgatewaydevices.inf_amd64_82b90e51473d48ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scmvolume.inf_amd64_6957cfb7d6fea5c7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\PerceptionSimulation\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ProcessSet\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl003.inf_amd64_6b639ff361f628eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmod.inf_amd64_51d6c57c66e3de87\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEKR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdv.inf_amd64_5c153f7ff7d0d00a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlucnt.inf_amd64_f4769cb994ece833\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmega.inf_amd64_f35131186d3026aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpp.inf_amd64_e196624c9ed43e83\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_cdrom.inf_amd64_f08f2fe1cde58aef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dc1-controller.inf_amd64_63236b4ab51ad398\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaus.inf_amd64_f9b71b1d9c8643e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmminij.inf_amd64_a85c8e1fe15a9532\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\I386\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_fd2fe159a9daf508\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3704-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3704-5791-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3704-5785-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3704-9842-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3704-10839-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3704-11156-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3704-11179-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3704-11184-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3704-11185-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeLargeTile.scale-150.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files\Windows NT\Accessories\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\SmallTile.scale-125.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionWideTile.scale-125.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-125_contrast-high.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-200.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-150_contrast-black.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-20.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-36_altform-lightunplated.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\StoreLogo.contrast-white_scale-100.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\LargeTile.scale-200.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageSmallTile.scale-150.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorMedTile.contrast-white_scale-100.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-72_altform-lightunplated.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-100_contrast-black.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-400.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.scale-100.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PeopleMedTile.scale-100.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-lightunplated.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\THMBNAIL.PNG	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer10Sec.targetsize-64.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchMedTile.contrast-black_scale-125.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-200.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_contrast-black.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20_altform-lightunplated.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-36_altform-lightunplated.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare71x71Logo.scale-125_contrast-black.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\smsconnect\torch1x.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Dark.scale-300.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailMediumTile.scale-400.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Square310x310Logo.scale-200.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_scale-200.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-16.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.contrast-white_scale-125.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Images\BlankImage.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-100_contrast-white.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.scale-100.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-200.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\MedTile.scale-200.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosMedTile.scale-125.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-256_contrast-white.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\MedTile.scale-100.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-deviceaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_9a506f171eacd959\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\401-3.htm	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Wide310x150Logo.contrast-white_scale-400.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Data.Entity.Build.Tasks.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Wide310x150Logo.scale-150.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_comsvcconfig.resources_b03f5f7f11d50a3a_10.0.19041.1_fr-fr_61136c918453ebf5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..kstvtuner.resources_31bf3856ad364e35_10.0.19041.1_it-it_33022038d008bb34\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-b..ls-minwin.resources_31bf3856ad364e35_10.0.19041.1_it-it_72d9e24c3acb1bbb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..rser-task.resources_31bf3856ad364e35_10.0.19041.1_es-es_efb3f51b032a5752\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..rtmonitor.resources_31bf3856ad364e35_10.0.19041.1_de-de_713afe8af43de388\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\InputApp\Assets\BadgeLogo.scale-200.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_xsdbuildtask.resources_31bf3856ad364e35_4.0.15805.0_es-es_ab51669a82653921\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.data.linq.resources_b77a5c561934e089_10.0.19041.1_de-de_a5599b9bffdb5f88\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-rastls.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_9e5061ecb97e8738\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\UIAutomationClient.Resources\3.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..emotepage.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_9bd8ebd38e68d340\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-peerdist.resources_31bf3856ad364e35_10.0.19041.1_es-es_d0d5d5ce080a355c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\VisualProfiler\js\CpuUsage\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-f..utilities.resources_31bf3856ad364e35_10.0.19041.1_en-us_395b84a76fe0a3b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_adaptivecards-xamlcardrenderer_31bf3856ad364e35_10.0.19041.746_none_b8cd46df7d27c889\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ents-mdac.resources_31bf3856ad364e35_10.0.19041.1_en-us_87b6628ac1e1ff86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ge-capture-pipeline_31bf3856ad364e35_10.0.19041.746_none_c46cbdf4673e872a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_be98bb8265bc211a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_7cc7a40d5a320c8d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\3.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.1_de-de_542227990f3fe3b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.security...agement.policymodel_31bf3856ad364e35_10.0.19041.789_none_276d10a0a23858cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-00000474_31bf3856ad364e35_10.0.19041.1_none_a8dbd233371bc2fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square71x71Logo.scale-100.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.19041.117_none_946d94acb02f54de\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-shdocvw_31bf3856ad364e35_10.0.19041.746_none_cfc2e2a39f163490\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\enterpriseNgcEnrollment.html	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobeoemregistration-main.html	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..ice-transliteration_31bf3856ad364e35_10.0.19041.1_none_18f2b725fa8c106f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-workplace_31bf3856ad364e35_10.0.19041.844_none_46960391b09a52d9\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-fsrm-common_31bf3856ad364e35_10.0.19041.1_none_23811da747d0002d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-expand.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_e36178868f9ece61\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..iagnosticsframework_31bf3856ad364e35_10.0.19041.746_none_ba540d173f997bc1\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-captureservice_31bf3856ad364e35_10.0.19041.789_none_29c82c298f0789ff\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rtworkq_31bf3856ad364e35_10.0.19041.1_none_a3df82b8c8699995\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-s..gstack-boot-onecore_31bf3856ad364e35_10.0.19041.1220_none_6e6ae35b6d51ed8c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\Speech\Engines\SR\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_bthmtpenum.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_9de99d4dbc58321c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..k-handler.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_422d9ae68426a4e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_it-it_033ba8911be77729\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\diagnostics\system\Search\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\http_410.htm	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_mdmelsa.inf_31bf3856ad364e35_10.0.19041.1_none_1f6bbc7e6077f2d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..tasp1.res.resources_31bf3856ad364e35_10.0.19041.1_en-us_c794e4d422ff3c51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1_et-ee_1245f9c3396d59d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dsquery.resources_31bf3856ad364e35_10.0.19041.1_en-us_0d00190a07b6af8f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_it-it_acca74947ca73d6c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Square150x150Logo.scale-150.png	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_audioendpoint.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_2e2b7075d2a9a2d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..-controls.resources_31bf3856ad364e35_10.0.19041.1_it-it_2b3e354b86d22c77\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx4-aspnet_webadmin_images_b03f5f7f11d50a3a_4.0.15805.0_none_7ab11546ceb3decd\branding_Full2.gif	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hyperv-vmbusvdev.resources_31bf3856ad364e35_10.0.19041.1_es-es_ad27b45a16470129\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..lerevocationmanager_31bf3856ad364e35_10.0.19041.746_none_ffd09f17e1195116\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-i..plication.resources_31bf3856ad364e35_11.0.19041.1_en-us_e32159926166c3f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..emassessmenttoolapi_31bf3856ad364e35_10.0.19041.746_none_c197ace65669a88b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.19041.746_none_e180169f2d62e633\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKED	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKED\ = "GCXSXEQLNPFNCOO"	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GCXSXEQLNPFNCOO\ = "CRYPTED!"	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GCXSXEQLNPFNCOO\DefaultIcon	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GCXSXEQLNPFNCOO\shell\open\command	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GCXSXEQLNPFNCOO\shell	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GCXSXEQLNPFNCOO\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\79l4PX6H5ZTE8RE.exe"	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GCXSXEQLNPFNCOO	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GCXSXEQLNPFNCOO\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\79l4PX6H5ZTE8RE.exe,0"	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GCXSXEQLNPFNCOO\shell\open	6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6a3617e86953e7f4b177ead1c84f71f6_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
d031a3b572ca992e4e853c187884909a

SHA1
e1980eebaf9b864411ae2265e99a86ff7a045dac

SHA256
8a29e7b6d9685074a0007620b6acc54fd4a913de0d994542c3f871119a6c4dec

SHA512
9bbcdd5b67ffb310dd0319a32df77e5e7a88a642763845caad16eb33c575cb6fa0cbeddd98df3897a17fdbe8a684ac3f456214b3d449aed76eab581da6c7e8bf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
6eddd5019f13fe189c361565627fc219

SHA1
c27ce7d1338239ce3d8370d93b0d148067842fb9

SHA256
17bd23364e93ba238ded05f1862979781657b5a79e0776c0bf18ba49af6f3ba9

SHA512
d1e486b37935bec0467903607a4dc6bfc0b700f3c82a3945cdd10f6b120e10c158157eb147764a1a1edad9ab39ee119906755bbab26197fc4fd4bc87725907c4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
5bf8d5dd2eb5291e4035b4fe4edb5006

SHA1
898458089f7e94d2377dac3c458dd15ea151c04d

SHA256
acbc9d7ad3a1da57b3e0377b85b7bcd42266d1e379c8173ec176b5faa4065bb9

SHA512
1eb05993ce6bb085514ce30ee172a7a414483c9163b0f4f35a1bc2a747144a271261ccbed93183613a5d4af9ee0923c016a439331a99cf46613fd59403c1c29b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
30351193f7fececc0c420871af565ec1

SHA1
e7c83197a297ddc04b64dcf97b0a2ce5ba6c3656

SHA256
f8077f7ef7348f111d9d42cc831419001712a6e6723a723ddb5ace313ce81856

SHA512
4380c559d19725962ee7f78625cd1062506f9a7702bfc761d3b3e26dd4d7e667f005ed220817cc0c2e6832246e5afa1dddeaeae263ec4e93016d552f8283d4f9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
abe2b3df5785aebd540a3645eb0ec5ce

SHA1
eb19cb6bf4430c4f06d9d4aea8d94fd194b365d9

SHA256
04b1d0ed8a57a8e28fc1d2dad3a232ba2c01970c5bdd3613bd7296fed90c442a

SHA512
5da8823a70e211db6ca09fdde67b2884c5b476646a5b53267d380f754e2f0a688822d4a49b4e04cef6f6d99c438b3cc8de09f321cd26c4cb5533fed70c6e1bc6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
cc996d64423364de83abab30c5127b19

SHA1
9d881c2d8fbdd93a9ddcf1ec5ffc77da03d6b141

SHA256
696684aac2c637ea1db5b0119fce5b7b3ae84a4f0f41ed3c21abedcbff4ea5ac

SHA512
f8d222c94cd40bb8743fca8de2f6d81c99969e8a42bda8ad3e5c4e86778efe4d247af4c57b75a2f37e6ce47054622583d57231097a837b2acbc53387765882c8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
06c96b93562415e946babeb1440a591f

SHA1
c90ac043388ed85a7298fad0a206bbbf1569d586

SHA256
d59383f4bd2d6db6e681c9e04610476dd45057e3007c034828efced6acfff0de

SHA512
9716889e8243e964fa8a0d330ab8d2e05b4e776d989ba68ff354b3dbc04e0b36130ab843e597ae4551ff500279140dac64389186e9d6579b48ff399e09a27082

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
e6c3a6f81837464fe30210a5bb876d95

SHA1
08213f255b1b1cfc3abe55261b0940c8b10ff7c1

SHA256
8083e6437368cea9cb5ead5649c9a594f6db6f91450eecb7f234491259ee11ee

SHA512
1b26cc42ead0c9aa983af2e7195a52d918e499ded086b0e96ffc9cfdb2ef3156d15136e5e20a9ca750d12297e1f4b23dd3bcb7118101f0a81f4d5b82917711d2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
d9550a0db2e8fec13e0d44878ee919a4

SHA1
563cb91ddaae74d848fe8a38d734747899388fd5

SHA256
78511ab1816799c65bebf08ceee1dffbf51173f504e801d2751628eb2320f637

SHA512
86751d17de6785877429b2cedba0fd9e6b111c91e132abb5465f16a1225f63d7424e7474b538b313e249155a3932b7b0ea97c98cc8e780237307ec6c0e26293d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
0fb15e956efc0cac24487d4fb27c0ed9

SHA1
f26133590048d363e83b5fdfa43537f3aed4efce

SHA256
136bb692f4b8d0c3d99389691ccf0c29fb554cddaa00d996ee1fe910d9899320

SHA512
5aecdbe80e7dec97699b64b6a5a33f49e73ab8203264bc18fa62741297b7f0dbbb4333cd01ca53726b1709cce8d4d47387e0ce50a465087a100be78abb1bb82f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
82ab62f2cad1afa91b7eb70425fcc014

SHA1
8f1eae9268c23f19bc6e3dbb9bce87de824d4251

SHA256
b34560a3e76ba52d890e5b3fdb74a86c15e4436fffccaff79ef73cbe8270419e

SHA512
bade12d19be3113df364e7073f85ae45f31446806be5badc9da59cb0d9d2f6640baaf273b5fe82a76e36b883e4aba12b7bf8e1ed0d308aa73eb3ad156e039bb6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
3fbacae5bbc846f21ab724e97de43957

SHA1
81c30040dc0cf9edc500127e94f15950a9d39345

SHA256
303647506dafbc85a97fec875356fb933e494b7ce2104b0571f30f4d26db2d5a

SHA512
abb47b9603caed7ecd9460b5b27f711e22b89957cd115b7bfd5acddda1453811f8da17befdb6a0da9c9b091efd4ccf6716704b41e0521ac6358a1685542f0c38

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
72e37670af4d084177179641c047afca

SHA1
544898fcba6f3e0fceadb97620812b2d24bd2862

SHA256
d146829d5eca16222f4e697f3880183a587d784c77f4cf18d71cfc1f63e13589

SHA512
5e1c4e84a602581c16a85683333402a6e8ba5200d00dd8a804254208bcf21b861246817586a6b3bb38f1cd2566ccbe5a2c8268f3436899f17c9ab10c7db751e8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
423c58e9a8fa82e488ef19ee97fb0c9b

SHA1
b4a7a80dfc5c80208227243c12ed470c8f1fa7a3

SHA256
118bad7808817e2b787a804d3519794d976fd36282ab7c7164dbafa96de6d11c

SHA512
e5ebc54903e44540d713c7be98426f5f897bbd01dd115dd9c0105a915847f2c2c61ab08aa6c7bfcf1c876971e30d766ed6b77c8c187bb7fcb7a9f84a7d909711

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
c0a5b132fcfabbd0da3d6f06ec02c3e1

SHA1
ac9850f79fbe3a18075ddce4a614831d6c4ea827

SHA256
e468097987d58128251a678b5147c671a2ccefaaab98a4f54fdce7ffe5b04556

SHA512
b63f88d731d0f1c5bb9cda21af0358b092a7ecf40c2a5796004f37d6a5a4d88cd124a9697d948b56074997b1218c71236d5c27e15e5f630dc8d24f1e9db4d6b2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
422f0a37b7ad90ae9f8a4a2285118907

SHA1
7ca3fc7152dac786c2f4ff3e0a1f62f0f870b7c4

SHA256
f3e4d5548d5c9a3b2bb990b2ded63875631af4653d53527577edd45226a6f6bc

SHA512
7dc82b583559c6c9511705f984904a43c898b4f6469d9d03e5a4ca7052454844a73622bee545cf683fad71d5e9ef313da677cd8f75891ee729cadebabd00c459

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
eaa40cb28d49bd2e1d9ca6dff840f735

SHA1
f5990b07dd0ae0fa5f7cd1d9c85363905f877bc4

SHA256
f1d57782c10e525d9d1fe44c6cf0f17d56f831344651374ce3528a252af80975

SHA512
b9de44f58aa9f6a57bab0a9d3f00b6e51e33b9402cffe4ddd33348bd07d4951130011000d483722041df99a3e3fc3527d48d15dbcf7481abc34dbc1ab3b7127b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
c8c23869cc79815c1b1a082d6478a027

SHA1
708c2df72fda77850b4d0fa71b97234eec463f47

SHA256
a0723795dc6c5cc4468aca0287f348835331ffba994235c0637c8f8ffcd00029

SHA512
73830c76bf9ce781f98cbde3323a8e813289050f34e6024e46dc95ed2c2396a514b5cacb0ea1d1fe0bb492c955a85c639113f1ad0ee642bd13f10695a30a52ac

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
60c3a3b17e5bedf3db69c46538d029f5

SHA1
5ca1edb12cd7d9a3ffd03b986516969174bea63c

SHA256
b18e9a08d424c32dcce4f71c763d8976154860cb15722a011e858a3a8855fa86

SHA512
211e9dfc3200bd75c552a7f57c065a1d9793e70352ec9a332b2a9ba0483374afc73e8c4d590a7843f14996e70e9cdc5af7ae7d29c78fc154cd54bdae73d873ef

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
105ee914462b7020332dfb0d429053eb

SHA1
9fc2fcdbec112e8f171b4bbbff9c67a5167180f0

SHA256
8f3924a2f284c41df72d18167d0e53c40f22562da932f42c979c6b54892f52fe

SHA512
4273eb6547eb0c6fb8cf7acd9e04483a3f57e17a93687b1fed11f2241c92018ff4b7ff5bbc8692f4a1cf240a7cdbcc6aba661f0e2355fc5a5e48a179c7b20092

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
c69b7740fb76bacabe92098c0b8be20a

SHA1
daa3cffc624785bf11d8910eaf005caeacee5156

SHA256
745cea17661b8dc8d0ee6c4ac834235d9e5aa56ec75647afb4c2f6bcaf7d6959

SHA512
b10e031a4f39b0ae5a8c550a85046f484057f765cad0e438185a496fceaa5de76e7b162153a8ecdd6fd20e70b8d793d5261590ad6a7164da8775dbac85ec6210

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
1a27dad5d76c8b0db33c6adf6086dd8b

SHA1
ae179cad631cb73ecae6c0b6ec6371f51128cc02

SHA256
819901a43e3b2e0c5383643b51db3acf9b33271b8687b8e4d36b2f6fc3fb4f97

SHA512
725f5680c2f353b6ea5ad36ec02887c8f9fc1246754a6c72262b29ccd742ecd767e198f0134172b8b02a0f67b5c01c59238f5a924fe66a4b0b38fc5f46976439

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
d8f51072ed18ab1286074241a34ef6f5

SHA1
f1b29426d7918dab0d9d0a7d9db7fb5290228583

SHA256
7d86cec11f098910c6314811ff6b5eab2788e6a191a932e420c4ada9916cde38

SHA512
abc508290a939715575875ff076e1905a0e7fd8b22138dcaeb190c050df169e18d9b4a8c2b9330c64d9279a4b898f25a12b26c8b35eb2360610c666d74f4af8f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
4550b1c14e742418fba63521caccc30a

SHA1
68b59fba9b508f4f2e4bd7edae4da41184c76874

SHA256
5beee2f1f5e30bf785acd6380c89c888710aa5821100b2fb3fa59a0527fe0ea7

SHA512
ed2cf0784ef988851acf5e8c03c6db3611cfbc5b8445abef76574e5768bc2a758443971fde502e5bdc923d85e316ceb4aa5028285e24a955779d5f1a8d2e1f7d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
d1509f9441162135851d75f035389083

SHA1
520c89b5ee19e447693c7441caf2535eabf68b26

SHA256
db6e0043352fbe6aed6bbfb56d7c622b59b8365fbc2a712e589e5f09caf0da5f

SHA512
ac5e155f6d60040b244a5c997f2a4d272901a72613d05440c8bc621d70e876c1e5070a3e683164b4c49bbc5c647ea0442665dce088e96aacb194bdb45c26ee7e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
77e395842b4debb4b92a073bedff9756

SHA1
42e1a80cff3a32a47f4c0b874c2ab6ef14dc05a1

SHA256
270b177464516adb293636e3d0f47c770b9be60fd91a231cbf568072c4edf742

SHA512
e850029b9522137b1d2aa57e8d341cce0fb86ea2740311c802153d0e6265929b1263e367f523c2e28d07e533c53b40cc95266283f1ed5416a4f2219420c61992

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
2e3f22d903cce8a31ea92f46e85038a8

SHA1
30b842e4b11363d0cb4dfca28714a73d856318f9

SHA256
7939a89470dbc93f77a332d070d49947cf449343165e4ba80674a519fdf89cc3

SHA512
dd0ae9af16156ec5f0f8cd23dda443aafb0b670c58ee3bf693473a815f0053159c5b5bf43d287cbbcd0ea378ed719655a29dca283fb2fa2cdf0b03ffb34402a1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
247f1b05e5c2663f01d7d5ba1312c539

SHA1
6ea67497bf8213b475c59a34b6fec3030b78df9e

SHA256
e9f4d8f27de19e9a9af5a2d4cfea6e4490911482d3e6b35704ece2f49f0aa323

SHA512
9664e80f173e94d6a6b8c3bc64a304e3ed71fc8cbf721abb4b1a9d184a65ca149f837383342cc58c1670efa3cfc53a91622980be5e14da69bd3c253b1d647c30

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
e6a7dbf80bbd31cf6cc4eec6e11fb16c

SHA1
679327ddc1669d8747a2e25a145abd7533c6beca

SHA256
cae05e73c6bb22778c0e3840dc22938896bd151bd0807808e503f8dd52e27d36

SHA512
a35f38b06c86a26e67fc8aaa601c63458aadb92100652ca1889a35c0c8d4bcd59fab2a06620194c30204d2f9b5c1c073474217fdfc0be29d78d859ff78c4a64f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
29d4e399426d8a60d323441611148bd9

SHA1
66031c19f466929b8aef45af74640c67932923d2

SHA256
3b609ace9bf73245122ac79898462191ee7ae7853dd88b65504b0b4f880d365a

SHA512
052bf469ba495da979ef2b8f1f164c87999f72ab14b6480d9785e6912e0f9ecdbbc375fc18ec663aff6ccf0a11e6ab12f40aca7c9aeae7d7b4c7476fd1daae9e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
9c57fd7f6386e5e1ed3fcaf71e3990eb

SHA1
c25d1c4ecf36fcfc8b789b17742504828fcf5c4a

SHA256
1aa7f33fe182dcbeaf692097f5adc0a0455b4f361c00981f2632ac231e3c1b26

SHA512
699e04eb0adbbc43dc9944526db8334b6a2967bf8128dac464cbe0bbc79479dece41126504dec9e3742d5c8792e32259e6b015569a23eba86a2cdfc236f9ba0f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
880092d0bf469a43749812edf43cab92

SHA1
5386ed66065475e47380ad8017388b159976e64c

SHA256
ee686d62699655f655cea7864883b2937565db1856d4d7c2853e224f191c295f

SHA512
6e3bb56525a48949eb0f150817f36405c44848d600290f57eba78e321cf33709fe47bdfa15dc33aab8c108cb66de1a56152123630a51bfa47cb630f0dc75d3d5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
4d6d5c02547d38ef16100f27c156c1ce

SHA1
eab970c96ecdb280df702a585eb83a151f31c9a1

SHA256
daff834cb16f9557b65436393cd548417f876a2f4cf668342177fc8be0f91030

SHA512
5184e9b6884182f8672f83ba35a3657c9cb31307a17189cc28663f8220fd932cba3a19162e9577ef945a9e91ce10719f40ba6d7bd258116aeb51e3d09d4534ca

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
c75d487e14084ba3f7fc3d3b0d4fd336

SHA1
417360ab2d2b5df9821260e02f4314f6329afe3c

SHA256
2215283f12efe06b3361291722374e4ca7a30fbc826f256b22757411a6c98074

SHA512
968c2acf9b852dc6c31d4201c3e6abd7aff5d46b40bb3c86a3c45ab3c76c3870349c301faeab2737c650677f3cbe825fa94ec14e84df27275a4e1ead6f2da734

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
00ed4bde5dfcca00cb407a7d2f40d631

SHA1
bbc51a4b337b42df61175759d3481f588436291e

SHA256
0b8f6a99ea1edb910b883bb918a163c48b35dd8c6347745c122c5bd72be854ac

SHA512
563baa41840ee5309cac1249c88329f3733eeab430d33cc7a07dcaf3560cf3b89dae6e65428f57c05b6c61611c4bbbc9a8efef94ce2934371387a92e297b4ef4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
eafb101f22d3591c1210fe68140db39c

SHA1
14ec6593f3d022acec7b55908c0765fb337cd7a3

SHA256
98a3d9acfa87e1bed765392f8c49c7b242efc8c39efd27f7c5d14e82117f666d

SHA512
ba8e756b121cb1511d7ce188da39f783690144a542ee72feb6571c00c2f60e40136a72ff1d9ff3a93e4d1c89245dd0f8fd87387518f623164c0c34d87f932953

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
b237b565aea042632f70072b4abfd97d

SHA1
ad636e3228ad758cc82b29d9d270b8773c225b5b

SHA256
36bb13dfa5e18affaadaabfd075b27a75c22d649f1e5b363e63d33a23e2a9505

SHA512
64367bf28d7663cff577b1a814c6d484cbc1ed15646e720ea622aadc33ffe018debed0c92ffedcf3a1af9a3f2e56056d3fd2ec5bbc0bf9ddc9f941ac68485332

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
aca2ba795ae3d1bcda96bc1bfbe77e2b

SHA1
25ea23785f32b82de6c2f22e5d9ec7035864d4e2

SHA256
8e59e2cc39cc72e9706623f0df78be539ca576d2ac5bc336fdaff7b052655621

SHA512
53d56f4b306e1059eaf25b6205c1dd11a6be06f82788c0515fc78a9fc9831bd4f585330694903751387de3bf3eba8c7fac01be6dfccaf7f9e0650c5507440250

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
183B

MD5
8c3be944a21e70bd7cb910b11728be94

SHA1
a3d2fca2d8f79a59a5f9e63668d42c4311a14849

SHA256
6522034d3e68f40daa2869b1be177e0a02fbb6d047db5aff0648b6dff5cde104

SHA512
714246479ebb08cefb5ca7c45f7b3f29042540ebdd3d3d2afede2f2e194ed6901c3cfe0899b4101267237496e16e124dd6fecbf245961bc2044ab76f8de249e3

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
d674fec2b5259ecd4af583dbb7494432

SHA1
36cc344a61a22231c8996bcded5df8afce7839ce

SHA256
3c535e40f0652b5a8323b34cb76d0812243999b8c51ca4e2e22497231bc5ad88

SHA512
e5ebfead431f10030d90212f5ed7928b1134401566b0b369029f424ca2698c0fcde2a8db59123e5547c025e3c5da608001e955e2a688cb49fa735990d266d77d

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
4b75fe8731b13b451c4268cddeb29226

SHA1
b86e0a409dd7b10b8e688f968060c74e38fe550f

SHA256
7a59726c01b6c91bf1fe3a6ab8f0c14c2c7f0c5c70a6152a6917e2f8bfece3cb

SHA512
15453ae4f5ec4843f7335060b4014b7a58fa099a6f3cad557b45016f4d7bc59f7fbea958cabea3ab37f1a0365f93a0a22cbaabb88de8259c488c2ee782c2c3be

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
2f736190253534563676940d05c9ae3b

SHA1
11b06598548e5a1ceea15c023572297f3d5d91eb

SHA256
2fc4cbdb1a86146fa5a1e1289c1446c5a45b0d26a17d8cb93dc4f4594daefc6a

SHA512
60dd6230fbdba1803bb9f012d148825e3c99efb86e1716599e46165b099f4d80f810cb539178b96f8c9770058f03354eaa8f634b433f36c406c26702fda53dc0

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
df31c5faa2b2df3ea96c06cd050248fd

SHA1
10ca8abd9bb4446d420e665c1742f4c7094cb490

SHA256
c14e3e044686fe05faa82105b8bf9d5742122784ccb770d0c2a0a7be7f490c76

SHA512
236dfc5b816ff286201f14fd8a2408fffe4a7be0010ad86db1c697a28981a43225993b25f95891ee36cd682fea874d6d6268e8f4405a6cc1853253cf53602fa4

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
95e7f04efed8d1401c72fe55b81e56be

SHA1
d3b144bc86c194bc71f0b220dae7d657f5ad1900

SHA256
d3fbcedbfa5bd5a3cc47a0e99569fccbc583dd8fe72ff5e3d18d4e0929e30cfe

SHA512
cc2217c5a7e0bace7b836ee1b0c18b4ff178d133764c26f582a72350c194f171621e4c2c709fb479056c4b83b1be3d12bc47d9e365c8b32f4a9540637f5a7662

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
b5a2206ee6abba9a024552cca70155f8

SHA1
28c843c3884ed9046aec14d1d4475fc2e62ecc88

SHA256
fb106ec1ba0f45a3ec20eebb6d6c00e48806f158262c657437e6a3dadc99f5d5

SHA512
b6d10fc3989e031717c51582e62fd786916af83ab91000473b9b6d17827635eca4467cb26610751b44c19f676b7de822c1bb4b396f4afde1e74cd0cfb150b015

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
efb0357d941f5ff2f977a738e30b5523

SHA1
c558ac7b5c7a0e0be7731cc27fea4e8b8080d500

SHA256
689fed4ef88f6972224237f692b930c24791731882c9d0cb4db91905d7f34545

SHA512
92f75ede15dca51d7cd0b8117f13293e7daea55faa09b84d333000b659a42d23725200250a90865ac2cf824714f96e7577d0f016139047456904675d4109b567

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
a2c8c62366e77cd88572966799275120

SHA1
70279c0178f17d89b4a33ecfad853e868dc5aad9

SHA256
edb1e0cf355eb2d47d54b357ffff04ebd3944ac3ec12ec240d81cbf7ce7e2916

SHA512
770af992f4ca6b1f71ed4c8e1aef581f4f8e1447adc33f2abb47e5aebea97b43c7cf9c0e692c8b61cbb91eb75a703ee12f123f3de1c2ec05d03a040cc0a258ac

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
73fe837c510d68dd3defd29956568bd1

SHA1
6ff32e2828a32f0b4633e98c8c198fdab6331e9e

SHA256
c237f7fb7b3571938d84ecfe36a9217abe8c849c3dcf0317f375c7545bf18d57

SHA512
731e39b06e8c1941356b0b0977b0a3c3e945ad80bb1c13fd8d38c227b51be393ddc5ed1cf38367c8e7399f23c2f40a4cf576b6b47c6007747a343c2841cd2c12

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
6147fb876c0651cd961c260fb4e549f2

SHA1
76084c793b5b8e702ad1220591d23f67784c7b7d

SHA256
6cfd93dad3d0a619a88138d56c04935eaef72cd3d555a614d5e6b9f07bbea6d3

SHA512
5fd2641d24164ef64efc9528f98c06aeabbee7925e30568421474b630cc54ec257bcd40fd7d00b1c2837e00a442cd3b6234341df0fc51cd2cc9c72f2183369ac

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
62da429a200137dbf3be23fc22009ca0

SHA1
b379498abc8c5538aa80437314264c44ff97ca9b

SHA256
06fb44d3a1da22236cdc240d33504f4daf2de604f46544f3498006fa9d34ed2d

SHA512
1fd60eaabc16894648ec8e7ec1343c500ab416a7162acc4db85d039cebeaea32d3874ceeb10098055431805c5ac960353c4ee21fb716196e1e15162961941e7a

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
3018791980870a5b2d3bbdea1d9c1c17

SHA1
0d5a801cb1d28e08dfb3aa96edb028a7d374cb72

SHA256
2dcb1179d99b08590dcdfc2d8ed18a285bf8a1a4396fbbabb9498c52c2941fd8

SHA512
fb4f12c38aeacf6879dfada150d92ff9e8229a96213dbbbbb5a58672f74b98c0acab65f1ad9f44f792b3b8759b0f251325567fd3524699cac75804646d53eef5

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
450000606db36db254c4829d149a879c

SHA1
474e415cf646766ba8347dbad72386fb80e0f870

SHA256
65837e55b1aeb0c455de0aa949e34e72e95e5162bb7b34f179e283417f65896d

SHA512
f4769a8b4f98ba7040db4e742c11f7f59bc9b2b06e2aff52af15b6404e4d28ff27295c11b93ceed54a0fc31207d1bc86183c49654a33d61826bc081a68a96564

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
35b1bf046d3c8599a32f3aa4872fa518

SHA1
175645b7d532c70d7f1ff94ca85323b02814f348

SHA256
0601e0d8fb81aa0ba661d133ada7de423e7786dc0ce05a71bc83e978ab972482

SHA512
f9f115a70e059b8d89a51c92c5821b458b5c9fca9e7b77afdbf1ab5b53e3528f10b05ba6a17bcf78109d2a252f34484846f6d62de1022d145d88344dff50f80c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
4d25cff9422437321219ed7e81996cd4

SHA1
e2c366b1079ec38f364103b7df20207c419805af

SHA256
63e77ae4039e8eece6829786b51b5a2bf57b0daabd50d3ddb950457310f2faf1

SHA512
9086bb9caddfffa22a0737c73accf6add8b7fbd24235b77da53a4484cf411e2b903bd6d7c0d77e9d2941bc5a981eef8ac5e1389753c52244c1dd2b9e5bafb93e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
1a026ae70ff453db1cd9733119c87eb2

SHA1
6e12dfaaaad5a50d506d02dda37a6f4f4eae537d

SHA256
f158046fed7db551a2d4725844073303e7cfd1b2fcdd64e8d486085e9e9f9a30

SHA512
5321f52bcb747e3b593f704c323a3d912085b454ea6dc038b51389cd8c9f4c2bc22152f5419e586c7811ca7d73b411b1056f7210a47bd82aaa98e04f0329d08e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
640494a4d6b33410086975eb2e3ce748

SHA1
011dec72f5bf7046b75a6879471e2766023bd63b

SHA256
57966cb93a373346667a8b3c9fcd20a43b53f9c0e1baa0303ba4c3e0791f2a72

SHA512
b5093fa8ecd5c26ec307c4509bab2a62f3b5073674366b4d7146f05aad1270dad08f4fca9eb4a39c40a87d353b78748f77e7f7e2baeb8973e98cf92226ea7d58

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
e20bc742555c91bded94fcc26db42b23

SHA1
9ca74b5fe3c36d8b315c2f50d49057bab096bd2d

SHA256
4b5be049fa7a89425c50b60c343bc0d5f9176b91b0933ec30e1f2ce6eb2185ee

SHA512
4dabc9aeae67875b6b40567506a509bfca634d9760aa97c205e9485f92c0de87282dcf60572da029aed0e4db1cce7d833844c6cf296a646bd85e75bec7c9970d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
102e88e8a4e83c3edc3cd574f32e6d59

SHA1
a71f7c0601bb155f5a6663cef36573d24c36409e

SHA256
f395d55ee98e36aa71c8281018d49e1686142eeea954176e5f6028c57021f15b

SHA512
f77afb3909d525aff25a1cedd6cfc62dad51cb39deeb1301c49e90f72175765b501220fc625b03c88a6c7b19067fba03bfc5525df662b3f68ec6763e5e5bae68

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
e930e596d64ba766fef1fe5d6ac8d771

SHA1
d1aa31b6a2553b1cb0b3349705e0ab9b0fb292f6

SHA256
b0b56b933ef7236b30e250c1de94c6ba0301e19b21b4793cd4ed98d979726a26

SHA512
6aed52bd9af01b0f8841e8a2a480b121bbad192b576cb195c23b83ffd39f619aca9dda4281ba75a0418ec19612b204b4ba7cf25810ee290fbbbe992eabb54b5c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
521b48d4ee8779e5fd1b8b82098505c2

SHA1
34704d5cfcb921e5a004275d321fc0028353f3a0

SHA256
40d8270c17699ac84df62d75b1988e5dfea74843815577fb8b17d30f2091deab

SHA512
f79a7ef135162bcdc9fa2628d6c0697266197b82c95b888de09bf0eecc92ed64f9bf831bdc05dc67dd3bdb460c47e58c80f3b3919c9ec2569ca72f6cc4a2fe8c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
d84af15326b0b5e5dbefad2c79b88321

SHA1
70da3d389da0c9ed86b5a64d1ca22607d7c96913

SHA256
ff381d1e34ae1d9625bf38b2e349e7b077b5666e54ae0f1ff8291514aba7e289

SHA512
3bd8205c1f6b12bd451909f56c5239df248f22172034c1dedfb395a212dec4b878bf6739fd208f5dfc539d115e2a0815a27679c953bc3e24df65afff418afaa7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
b3636dbc75088e5bce9172e680b2ecb4

SHA1
c996bdd7bf5a9da348ab70dfe6ce8d68a344a420

SHA256
9ade135ac8fade07e1cbc3540dc7bb2d9fcc28455d6c5646bb27269daa06191c

SHA512
0b6daa801c5f83381200977eec410837e109fa95488f2fce9afcf306fe0de718e53f91584fc47e84c76cc88ea3a70e424b2f770de9cfdf7ae562dd25bf7e9dcf

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
4a93a6f99a1aa047d471ddbb3f466333

SHA1
69daa285fff0d668d4e6bd152d06b47f780de497

SHA256
c52ca937709504fa8440bc7c0701a0329a9c630b11ca6878f735cb3c362efecd

SHA512
6b0544b13e632b02669330d6aa4a0fae531dc9989c07791bf458a02e41b611fac6f270f4d548fa5dbdd09ea9930a0cc4e7e26ec8eb207dae85a0ece6356778ec

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
ce92e1cb517f7114103e98370088225d

SHA1
54c385d602bacc37e8dd79c32d728c3dbb7a7c1a

SHA256
6fe4cc88f56eeaf7c5b182ef0f8a4115497d2b5678263545518f6f63b81cce86

SHA512
77a2f580ad6deb9861ff74fda86aa74736cfb3627a47d6e769c9a5b2f8bf6f702653cffe7e83f92f6b41a68b1d52d83019569279e6afdbb12720bf7813c13ce4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
431adcac035555cfe4fb73116a464ead

SHA1
7dd21db49c1d49b3e17d635e67dc838a0c031869

SHA256
2f829f3122f9677ae752201427d0de6c83ab5b7c97075930037b0775cd5de656

SHA512
4bfad8912180b09687bc256c92b063cbf333bc632c3db29a9581ff7bb55b1b69178cf5c0c36d2c4f7e6a132682ab42afc404dee958809f64a57567c1934dc3bb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
1889ad1e7fb74700c85f7c6af2f1ac3d

SHA1
52b50bb3e3d98d5e3cdab4aa08b68275d69d89a2

SHA256
cdbf1f2b97419a58d9d121757b233f91254998c8ae25b0871558d20acb3eb04c

SHA512
2f75a725bd2b6bf192eb78246493b217361c4be10ca176765b39f38926e1f1bf9f573bdeeb7d8067799e6e3b433e6ea6be75fa711d35b9984904bd64cb37fca9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
729b0f04ee5aaa8173bd3836cdd0bc8c

SHA1
3afc33b73087adaeb067b7e38de7b439c4b9487c

SHA256
bf338f13fbcc3ae3d4288da535d13649988e88382ff3a9507fad97b652eeba8c

SHA512
adc7daa04c2870338a87370a85a335293dedd3bb0dfa677b5c9c97ace5ebbee797a01843557d5c581ffc8ead76e838c99c25f51c4bc57a41dbb6215ea61fc494

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
fef7cf106dfa31a2e5a05efd1bce0e38

SHA1
5f5a3667e8c298bd8b81a54087032165887fbc3c

SHA256
71467abe5a3cb6346692ed89f7e717b9ee50089440f1515c23f525f104a514e9

SHA512
254cb2b386afef710428608134b8c4d90e2dc01622cd983678269ea319c3fa16e5f5bac7eef0b0df9834c07a6c48080c2e07c894699c4ce7601bac03b11f4f7a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
b41d2d5de0769bcfef14f90e014d53ec

SHA1
4ddfcaafbf77cff5791a6f736ccf560e3ea65881

SHA256
33299ff3bffa4b3c112a5b2b8ae3313be0d9bf18b56ee635ad988763766947dd

SHA512
37fc16b16ae02715b6d863118724cfce21e462769a0ecf86295d9b4e840feb2c4c8da9127c1f2e92a266f17116d8530e32ce11c8e799984f06af8b8b5fa1edb8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
b70136b1271a677adc23aa318e904899

SHA1
a5c079d123a23c41cbbfbceefd0ac9e381cd476a

SHA256
988ef865d26587c48bee5fbc6fb9756db29578771c5d39188554f536a6999c8f

SHA512
86f1e9fb1594042a458c542216745598a1d9aa188dacc01070e13b3fadfeac38639ec2150f3514ac2e583f20f5aa1d4c12da00cd2a245973f1765276eee5f1dc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
ecb2506d64d29f94281c5ceb5cedeb22

SHA1
f52eb3eb84b798deb76cfb7585160397ea3489dc

SHA256
4e526c27f268b429b38dbee4a751aed1486c176e58844e7294ff3d9b224402c7

SHA512
185e50b6db1c01861d417d695859d75c59e651f625efa8134ee6fed00ac70effec27f870d3856aa77cfaf9e56553def09c1d1e6e0ec048b4fc89cd32788d4c70

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
780f75d0e85e7065e783b659ceb4474b

SHA1
907505b6f87952ff79c431e30789637e64fd827b

SHA256
76c5954ef52a20f0c63b6c449d0b563b6c47ec31a0b53ad03b0f5f9cd9d93c1b

SHA512
ad8c54b559f23b2a8089ad96714894e1c11fbcff6fdadd5e666f03822e84bdaea5119fa38d8095187d972358946e5f9317b23db01cf3593f6debd7351385e15e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
c689219e92116a9f37b5b7107c420d17

SHA1
1718140de9e5859fa0dcd99f818e14cb7c91eb23

SHA256
04785b763e59533f2b9d288bcc54aaf1c7bb17f93e5601dc07567fb087605949

SHA512
1eafc59a6d85e9a5e9d48153c16e292ea6f02c28a09ed89c837b63cb0dc9c7628fd656ae481c83f4196060fc063dbbe2646370e3e0d811c3c1d1608074e7e461

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
bd05e558754d52a057517a1ec7b51656

SHA1
0049a95d5098f8b91dce391825425fa3d3774611

SHA256
58b61cd6d70709ce5048f934423ad8f0e308e286ab8cf9e7c3c2d3ab87af605b

SHA512
573f727eb8198fed278548cffd8fbf4768ec681116ce4b7de1b514d26ed2fd36c7e3e3c8f05acb240ee65a95dff0688f265a4dbef0aed41456922269f671e268

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
46853d36d919194262bd18c1b8b30181

SHA1
1ff04a537eec200d91560ee7c1033a0225340f2a

SHA256
afa64e00cc337cbbf18ea083669e345ae2e319759177119abf81be191606280c

SHA512
3acbbd81c117db2d5db06a9857825bf373bc636a59884193502e7ecc347229e1388c102eecc23ba82a2882ccff7a932c948e6b574bd2c4824a6dd1a0dc894992

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
59303828690a91818831662e42b7d497

SHA1
053400ec20f8d914e4730131301bc5cb1872b6bc

SHA256
332dfe00eae256365e1c7a9490f10b936ca76a2532680257a8d88a2c480f42a3

SHA512
9063eb6b0fa9aef15cd09a6c42bc1fbfda85ed9054171ae861e9b2be47cd1c11267e80b008801ae17e31ba7bce5a289f69621a77830759c0efdef29a734fbadf

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
be30d1f1ae6ae379b1e8917adecb2aad

SHA1
ce21e1803b63cd6642df934c099f1cf6e3310b61

SHA256
af9495a89ff024049cb99ac93c45520095e210eabab567c53e3e8c6c69f7e9fb

SHA512
ada0a1b5297c3f8d69612385980e5bcbb679a8f54d21579eb09724ffa144ac506d5741965fec5cc207261aaf357adbb57f51201c27e11ce642d7f8b1859718dc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
42fd1f95d93203ae899f7cf41f6b7d5f

SHA1
7059ddacdc24892cb84c41ce2b3d916115b6ca0e

SHA256
9f8cd8a6dbc839b14941df7af6d510aebc5742342f6559f80efeec980fe485cd

SHA512
15821133bf57725e762a6d77d661bf184f1645e07e4f979101510062f0f0c8971089d8a89f2929cf0f4fefb0236825b78ec21c18a03e2a8139dccc429a77c54a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
50ea6fcfbfc3ae8a59c2d9ff945cfab0

SHA1
1f705913cf2e0360951665aee1406b5a0125b35a

SHA256
9f169d90dadafd895d0443195d17bce5b681fd34897952b12b1860535e79b909

SHA512
5bc2924cb09253c1d099910ee7b9ee5a1dedb67716c124b75b133b4dcc94b8ab0d97fdc837e244649be3dd0f042d2f77818434c8f05c001966c2a7f8cd4daea2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
f1e7fec9d55493615547a3711b52c88c

SHA1
2baf356fc0c8e95f2f4bcc267ac1ca1c8adca47e

SHA256
d79a8c7036b96151c5439ccff382e46cb190193d90d42cda02f762eff1eda911

SHA512
ceb4aaefc9edaa576b7c7966fab8bc490471e3b2dbedd1fae3b4e4fad6d78d24ade5500d64d8a7a8f7f51ffb608427b78e775795ea556cbeac870b52e72b4091

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
50be2ee0895e0de03a804aa9cc266c6d

SHA1
a68691e5bb7781af18c250fbfee6c1b1f4ec0a48

SHA256
83c35254dc8ca833d6e15e282e6327540749377c4d873023684eb172ea739622

SHA512
22a07897c9d006e7cc5427640b8f1692f7d5f5e28b275e4b824dc1086055cbcb8b8e31b6069cb94a2cb18f38226267cd83c959b85150c283972293129e045345

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
b1094147f93e321bb38110555ff6f830

SHA1
5660d7d201d5d674a6da740c7b437af244d8744d

SHA256
da18076dd973a28e668a7f42a812a8c47cd2e735e40487e69485347b7a3c8a9f

SHA512
0903256d921105c3c6972c92ce2792e452ee38800de65e2a86306280e3f0376849c2a6608aa5f58da640c6995f2754c55c3e3952711deec34fb64f0d9cc638ca

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
3288e66232f4457c207dda97cbc146fd

SHA1
eeedbf43d0a49cbcd9efbb8974df7bb56e686f14

SHA256
b48243a51313569ad8fc77a0fce374aabef943b2075391d68d2d5060da043573

SHA512
050df1a5f3fd1078fbf2c96fbe846b6ef75afb7f96e91a542d6ef23e7191578481b92afe8419e3d377dd395f508d39ce0d291daa9922e71398ad8297d59b6a0f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662610078916.txt

Filesize
77KB

MD5
ca54150ed23b029495fd067b75780651

SHA1
e1372f4a5110d16c19f49bfcae35f2c161bfe6da

SHA256
95e037e974beb0eabfdc38867b03b9c0b6669273ef7c33f686de28eb7fcc6aec

SHA512
383abd4e73217877a92794a096823ee2ca54bc4a02346447d6b7635373ac93e5d47804dd592ccf695302a95227f5c82f6b227a5e4c36b4355c4451efbba2f366

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663116015387.txt

Filesize
48KB

MD5
2cf6a209db95376d3d2d341e08ae000b

SHA1
016638687c8204173dca0e90a1663457601eed12

SHA256
149aa6d704d36736723e0e5209b0394f85e57e329d0583bff60b226dbe38241e

SHA512
04d74c662c0a47f4ae65447a197d9a79179c07c72b4ad994d86fb7722624fc06b21c6464156fa000b4d1e84ab62c31267518d94f52f00c6b0cfc40fc5be4a3e0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727669820222616.txt

Filesize
64KB

MD5
19f3918faa5abcc43cba8a9142fbef80

SHA1
3df7cbd2ad44145c3504771cc98d59dcf2919c5c

SHA256
7a102f7f1aba70187fd911cd52708d1180a87ccf45441d01f1a754f2adaeac0c

SHA512
b8efe362c6217e97ab21e9d01c2ea360fb268d87f0f4f7a896078cf38771c71314a48e09d668e49c1d7bf6218f4774ea46a0a20486377742b9617dd60976d073

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727672589120253.txt

Filesize
75KB

MD5
a39a72704eab037dff371c931f9f0884

SHA1
ee33f63ba4b2f093d8f4de3f3bbd3cbccc7d28e0

SHA256
14019aea8df9223526bf44a38830a45ce564c689da82136b31a0a3e6a2f31906

SHA512
eeed9ddb33115f949527d3b923159027a45cf485fa024e62ba544f9c0f55ad90922123e2b43be5016afa202384e1040d15312fdda0d44a8902fa1c38fd5bde9e

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
6806fec6568cc15b96f3a6a677a6048b

SHA1
4a7767e3a250a631c540ba00eee132b572073372

SHA256
ad592a4627c4c80ad3d50e68dcc9f682fe0cadb8e6fb9b3c690d7ca00b10d25a

SHA512
d88dd54b9ad0b8fb1b60d22d48a2e0dc7f2f1a7cafd2464b4995b846054119fb19cca4f2e645e6fed3a0d80b5a624257f1058aae5a0f959d968f4595a0cfca29

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
de012a95ebd246953c2353dd672981a7

SHA1
cc06e9ab6ccdd408b6ad613cedc882d275dbebb8

SHA256
e52a16a7aca97aba51ebacc5340b7611946ce9274cb7a68216b96a5aecc629a8

SHA512
09740b9ed36a1f29e2c9af34492570093cc1b7f4c08d8b729ef5197e7461810bf432e39fcd7fc0fe1ad2b4c42dddd84175d9a13cb7e231887690ea34ba218563

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
a347d278e7c1a66fcd0e7198d3768431

SHA1
f74968df47cc9571a1b06062ec99c66ccd5e4316

SHA256
51e83cda304c4085d90372e005c44c4fd1d6dff5db0a741a31c9c7b1cdd207eb

SHA512
83cc27aed922d8cd598845f0891bb05272bdef7ee42ef1b5f4d3a715fe66373723dc6a8ef79db6785bd83c8c1ccf5e1ce8e5b207addd24ff0654bcae114e21db

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
0e287ab2eb55bc185d5c1b42c414c238

SHA1
da8d06a5766f4288e38e9cb8efdd51ffe7ccc01e

SHA256
1f6a3d3492f2ecf69e6cfcdf784ba7b59552303bd245c3539d9b5b45c3c814ba

SHA512
da27172e37c742df2432621b3fe6b3a2cf1e479820737c76726e3c3ca9565fbe3b505ea976980eb3d0906db340e19f8c24f9c36f2358b4540d7e4e28a29a8f3b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
50bdb61223efe9d96126a0eeb1653dba

SHA1
a9f6279889d7683a7badf93c5eb67741890d92e1

SHA256
3e36a0cb4cf7997247798b97cf278b09fa99b0aa6f62637998172d9727b49bee

SHA512
a7127afa211bceea833ea218f66a40595986db06ad352c190f61770ac3e83739f65db2dd9c84d46750153b92a65bbc3c62900e6253b8c180ed231d433ce25a03

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
a6f779c75b72e763a4ca4c534eeb5a48

SHA1
9907f7296e04e01f0600448397816b5a338e426e

SHA256
4002c1fe04d35d8d052e0aac73ef011a263d80e6821b7bb2adb780e14f21a38b

SHA512
f6a5148ca91e9acafe6b300a0aa8a27f2670a3f11e754075fe3cf79dffa9f7736377ea0fb9280f5ce674a31c61563fdc55d4575f671e28ad9b07eb35bf426ad7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
5bfc08300b19288ded6f8356a827cf36

SHA1
a0399498fd341322589aa0bc57736da1ef4500ca

SHA256
c85af78a17c0b788b56e5b2c00eb2d4c789aaf2bf103bce874669f568cba2e00

SHA512
44da679b5799d49e8defa5bfa8d14b52042b62c19f4245bd9e5069d19a916a5d85270feba9a22e401e1169de9445d9f06cace0d87ef322586f89d6f737a92e04

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
bb206a8b738071cfa06e06a422a34862

SHA1
e2c9bed83457bdf19164d092af721a22cc4fa0fa

SHA256
e20b158fa62797e467143244729237aa618633f2b977575d80f99d343501dd88

SHA512
b889ec5cb6e1bc37f8d0c99c8055052f9a26a268bfd6ecadd506875304e5d26545876390ef68f754d21b517af4f7dc692bed87a73fdbb635d0d29032d532cdec

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
68b176ce12e990e229c2e93f6d0bc4d7

SHA1
e4429b39e5571ac53c60976906946e43689f0991

SHA256
b10c2a2a1f21d4cb35b9998cae7e7098ffb1645318ca0336ec2448e624aa41c5

SHA512
87cc1d43f6a0ce4d6d2a24dcb4799d1b5a1febde0567d241eb4f38e1201a5031bfa01743e83f3ac130d0cd03a1ad39a98a79346a1910278cc331f81427ed5fd4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
897360a7cf70b9615fc416e3db53a475

SHA1
b0515257ae287f221c66f72912e271b885a7e4b8

SHA256
adc35d57c90a71f96ad3bc8f3a891ae6eb6c165beff122fc9ea200a90191bdde

SHA512
565d3e80238b74fbfea41cb55313fb21ff11369d807515aacbf19200cd5b9bb3ee3fa627cd6f9aa60a66126caffae9d9ae8a9780b74ba40c1984adcac5283838

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
851a4714c98b95f54022e936e0e44d1c

SHA1
b9cd9d2e2fcc838d4ef8480bfb7089a67380298c

SHA256
b56a54f6e216d1b9e685ad800d8fc81121db57d6427d7e45af97082bc238ad7c

SHA512
f88a14fc3782b0348bf853a39d0830bf97dfd0d56f6fc72fe4c90fbe0711f5291873af445ad96b5029219a11066f6c5733675c79cc67a527359b2ee565f694b7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
cc3a062adc5b8be512e62535ad5a5e11

SHA1
93ec646acc28cd2ebc11022f770894dd24a20608

SHA256
680bc290055932f24871e0d7cc437bf27dd78011414756ac2c887409c6d94c7a

SHA512
6de8c1e0df85c5963f02e9f5249d5f06b205d655e11deb7a4af33a5ca9ff05e83a6e885c6b39e61002a9ae6bc7a73b2d310ec83ce89f179a12a1e7195aa159e9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
8555d276324ad608f744a64be88617e3

SHA1
028ba721213d4ecb91bee20cdd6b0847f0a9dbdd

SHA256
a1dacf1448633b9615886812332be1b706e2a675cab812845b38d572d7c5f98d

SHA512
6b9a16aff31fea8e297a3756e2b9f34d0b693f0c765291277e03ebd1bb2280e18654763621efc058793235ac921249fa657aceb33976e5c45c0b8753ad2a35c9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
bb36afffef268208e9441f7c082dd24b

SHA1
96611707fa30fed956f20c43c1f9fa8c204dcd67

SHA256
da4128540028cdcc5e9e3c25cd3aa9f9e1441b2edff4f056c9170fb1e6fbad6d

SHA512
f1415422c16a00c561ac68af92c2c51c608b29d3453b73c88f683258e89710fc6e07f3ed6e4beda1d5924a069f9609c65278c13abfd0cf4e7f7dc2cadd71848d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
7a3d3c0c59736ffc3e49f45bbe468a3b

SHA1
53050b6eb6194a4adf781565e6d6d16ce9443d08

SHA256
63acf8bbcd09f40d37982e298fa682fe357888e1a18eb70208716c8710bed500

SHA512
37520f505d158bf6b91dc76a41f557781072d981c01888780f7499367a73b5dc91ed779cd656102dec3caf1c39eb16aac67e21663975b317fd1442ada336038a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
665f8ed8cb25e039b8386e76516a0322

SHA1
5ab1a5fc60f0ce5923ca783f40d19096cc2c2831

SHA256
9ec08f397b90f5871f29a69446d4818544de9658e42754979d9c13ed85e0cb82

SHA512
86838994909be9676a5783b5586960ba360993e9def61ee0cf855e211c878fd72d5b586a7a83a69e869af275fe9bf9d0a59266bd019fcb75685e0f3e27e1ae51

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
a98c0ac10422761d17187b348acb4bce

SHA1
31e0099c3972d313c91a4c800bdcf700870be53b

SHA256
348842a3b38411dff26ad255ccab16892a34b4402cd496de9c966b0cac9334c0

SHA512
28541ccd9c7ae53787ee7adbcd0dfafe9ede5e4ecae18b10af8793b23f832d315f16c7064981cc0a89ffc44ef2ff9af1671c6c4cd878b7fe51606c5858a7ae33

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
f206de3bd31a27046197777b958366cf

SHA1
e3fdf53a73fe1c7264da5ffa5eeaa898f89a06e5

SHA256
e2b29716f62bbecbfce04b9065dd2aa893d556ac345c17230953721017800daa

SHA512
622dad719b29df862008f498f32842e03a81892a13b12e4b9dbe51132dcdc6669733270785495cba300af6aa485bc5d87dc1474a2c35cad4610d968753041d2c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
d7980b99ca2e83a83d38586d2d28b3f5

SHA1
96297247fb76c4169979510ff88797ab6cca8cb0

SHA256
685cd81185b239ad749855ae18bb73be9583a07c607e504a32e46c8d0d83986f

SHA512
5a6ff40b76caa6c08d6dbd30fb50b1b84c2cc3c243cea346a107a34b69613d83e12076e66313da010704e15d91b8fcbd2298fe05423ee3321eef9159e9508c15

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
24bb780b3265b76adac2a5dbbe254b99

SHA1
c99241c461ba647bea2c0eb13e8965df1da49668

SHA256
915b3080b1510d67f74ffe7e94ba9830746b29e693213b1d4b2ce3e57a3ac138

SHA512
a2acdd15c8b5b70e96e8f263031a54332480c20884a5f63c9eba334d8efc57df4c9e4824397e9524f7f87b1d69c79ce4c8362986a1a4888698d0e48ddaa2caba

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
d3427be36a7ca9a97890fc36cbae794e

SHA1
90167a5880fba7d96664edafb61b1c87e0b83475

SHA256
5422340e569fab42aad436ccf70f93f0c946896705ae07568b868142f7d03c05

SHA512
d88fe06e2fa9bccabd0d0d3d686ac2223f19336dc792b1412bc3917df30ab7434b5c8f0d8e030e5e9b1b47cf9978e8e906bcd0dabf96b0c78b79f3990ef2241e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
fa750729e77d923bfe7518852bac76f3

SHA1
9ce5c7c8d7679956c416f3a3f9af99e5b48bb352

SHA256
834fbfbae49fab553bbd561ca6d813ee5e3cf14ed9b00f2a6251cb78a22d114a

SHA512
061adc1ee015060a5512c55d241f773ad20ee8bcc1c1d6533e8009e7945a6db8fdb0650d77712beae1a542113e3f85186f7f626a01b5b9eed518e3be0a71a1e8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
326fb16f7ffe074f31424aa5109ccda8

SHA1
1295e639dc6b02cf73b00a6d6f2c801368f3e154

SHA256
4cf7c91e717c7ebcaacdd3bb2a7e9dfe8525a6da789834d3a23ee0a7fa2be2a7

SHA512
da63b39bb5bc7c9eb0ffd5ef8cafc511c0af1669d669135cd6f030201d83f0175ec60ff55ab4b308df012099691552054fbc5d6b4070da91f91eb78e8896ff92

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
65748e3bc7660d4b761889a96b57a392

SHA1
e9905510eb1e3c5fbeb7f2fd50476168a8d3c80a

SHA256
980df8191f9092ecf45ebc631b3c5ba05eb595b49185c1c64d77d73438f90540

SHA512
3bfe0edad83e6169be720d9ba4b4bc6bd368f48efd9e4eaa24f7752e8e04e4ca8e41c0e3021aca01ceb8d4c6f47ccf51be521b2683e9c9d8f1da1892cf542cef

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
b2a6bac9cbb06a02f122fc979022c397

SHA1
15c0c918a7665ba43482fb032bbb8187b7107f70

SHA256
d5c75667cbe2de13cef413e9a7d247c2253d785bcfb3dc3aac076b0305ae0797

SHA512
51592b10b79c52e36df866854f43f052fadce4961264c2f580c5334cce5382f84cc5e1b18d613b941ca4367aa7eb83ac273bcbc63c39ab90c2b9bacf12350907

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
009faaaa73121bbdbf6581a220b2f4c0

SHA1
7a2d943e71d17b296f753e05b3642bad251377aa

SHA256
92126565e259bad8a5af5b821b75ca1ff575fad9a63a03feacf96ef8130c9b1f

SHA512
6b4f4fcf07a1c98493c3ee0af0e1779ce01a54f9960a09b996894278986e546ab9430eff0da8b6331cb37226634e9d0a18cd4a0efa0bdd0954d76a013a5ff2e8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
0300260dc618671e8e876bf93c0cd5bc

SHA1
9ca0369e0aa219d203fbfcac54e3d92182f769a1

SHA256
fc6e98b47b2744d30a717e95d66b1d8903e2945518e7da71adfdc25726e0ff86

SHA512
891233c0306b377ac94696f6dad902709b9e4afd56ab464418aa1c93cb4e68e61648e9218df12732c98e00862c28894ad25d1ec10618c015489428a54c0b59a6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
0a0ad6af9328090504ef638bd3858cec

SHA1
15bf27eb62134d6be06b17b5dc347c9a93d7da79

SHA256
87cea6aa4155d7b56a5ae150c53f8b541aaadc3341fb1bef2ffbd9ce10a6871e

SHA512
7678d58fac0029a48675e075667774dd4ea2381cba53cec1b245d33e936f2a36c0db7ab147043be81b038df4bcc28889b8cb987bdf2a0ffcb61f8e9699798d92

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
5cc076b034bc9980e7178e2b3efb53b7

SHA1
9c175280c6a46b069fc7cc2af948b9b110027fab

SHA256
55d6ede47c0524a92fd32121434127ba45f4d9a15b036a24c2c1be14f6caf0b5

SHA512
a8bf902970b5d37509d49e4bd67b884fb81a5ef4adf5e5a656649c513373907b204598dd3517624b65721b87731df4ed0a3d55b1f0dd374b83b95a8f3b3a6a1e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
d83de60ce9e03a09e9788d7d2b169d08

SHA1
a3183c1d889c30d7b4eb9e19076b6b36b0a02e01

SHA256
7ba171c1666ce648ec5d014f381f51215338dc66d391a30be62609e07e24e0e1

SHA512
9f8c7b4e6f141f7cd6599b74f78c05caa9a1653d7eca2e5b091122b65b55053cc78c749bbedf101c2085e6638fa930647e99939bc71cfd3550c1c2ae7795b1bd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
c966bce6dcfb5ff91a0e49891aa20609

SHA1
40687055f9e0bb10fd81698c69e1551d540b42c4

SHA256
e6f9a2546ef6603d7a8e5a152a0fc1e23b1ac4250a65e709fcefb670037dbce5

SHA512
bee40d38f1cccd2d1052419ab07c51a2161a207b7a73aefe68ee2b6aaf701901567aab7385eaf98329e84f13c75ab0dbbcf9af3c3ebe0b02e5f8887355025150

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
c39416a0d913c2f19d8c06ca3134a4e8

SHA1
25e9968ee050dd3e5a857c4832c12588807fc1f0

SHA256
b44d5479a1bef0187e33f5d6d7c1d2f9c884aa8ce72005cac1370455b84d57d7

SHA512
e98dbfe859312c68a9fd6ab56ca00c359fd670e7ee6ec82072a9e39ace5cda5bfb23a22658d9753541d1a9897b5711ac931818618a5c0583cb6e2247e350ab42

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
9b2f12734ac566b41de1f4863509f3a3

SHA1
d166dbdbc83f85dff8baef9414da29a1248e193f

SHA256
9fef398a98d9f6e60fb1489246dc4cb191892d1bcef8060c379fecce7f237114

SHA512
6126a6a8475ec29acdc86a62a84f8ad1f229388bb94b2ad3b5cc8897705581299e06ff83341fcbcd2ad3adc0b2bd6c79de3048f9c8d33094537fb6693c44ce7b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
5140f12cbe2f33cd8126c1d8f3c136ea

SHA1
ba03337e5d57013387ade36ed6cfd429f266f42a

SHA256
6c9266ee555341977000324742372dd2258de3271f923225c1485b2ef7f77631

SHA512
14e3e3c7e71ea876a2802352284d83249fab542e507303e40bb749ccd77144e329cdd2cc1659cf4becd4e8f867406928a8285bfb8e6771b55d6811944a473c4f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
21d7cc9091c61e2cc8b836c5d169b4ac

SHA1
1304231abbf6cda5c0895bcc13b2c50e6e800107

SHA256
049d9282c69ad529954faaf3812381e7532bc69f6bf54e5f96d75c2b7e513f17

SHA512
773fbfadb542f049a57d3021e4742b8aa8db45d864e09d148cd42bb41a1154c18f6568c3c78d50044987589e8c5849f12e8c90b9fe260f0051c5f1165c337707

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
f6e0c083494e3bb1e369fb4bd3373d67

SHA1
bbdb2606d20c4b8dfa75386487748997c56de42c

SHA256
1ab813e2cc9d6f23adf936f0088ed462b9e65b0bc55c18a93d670e4acffd8e42

SHA512
c3785fa1bc1406c5e2eb7785e51a48f4fd62afe5090efff3bc6ae59609abad0c5c237728511d03f02b4c49aecfb42faa008e5d9cf668e7eabdeaca9ebb4ab7e4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
47b8be5146ceee7a9341afa57dde197a

SHA1
384457c8003420ff05a486dad76b136c3e8128d9

SHA256
219aa63c2846ac3945018efec1a712fda84fae72e50768a5c7771c81813d5a80

SHA512
52f63a400b72226bf4f154c84541a081e39c1e58e5af47ca6f95402d3c5e6519d5cbad6b07db2fd742c2a9250c0370ff8712f557d585810c723a834614460efd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
1434eb42dda33f15619ca6333d8caa0b

SHA1
dccfe4937b5eb3de18464230a49785632ed77481

SHA256
cd5701b123fbf5a383ddb0439e7cc2ff3cf2d72b93164a0d1440b5896ce16851

SHA512
adaea45b2ef17a13734df6226ed1351f417ada6ec220481c98dd3532f251d69ad5f0c0df7ef99dcca1bb97b027d225589541f367b57d38446414a59338948f13

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
13a33d3bb1797f4eb08ea261651988aa

SHA1
fa4a1d19875338794af2429bc53cf905bd156343

SHA256
cd867fc46edfe327db53a1276bfabf325209dc6531c38814e24267f015e308a5

SHA512
4e23867d2f25d10c6e3748309036dea8b729b818843668732658c06fcfe7c561b4faa885305aaf8442510807d34aa451fe71eb450f09356e4539b255d3799cc2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
54ecd44dd6d8db0abb309edef4049cfb

SHA1
9335a79cf855e40b292c0c8aec71055b50dc01c8

SHA256
e9c02a4baee1bd2bfe7a4e32518764761a0212b40f8f84bced7b9e57384f5b96

SHA512
3b1dae9c72969d6ad329a1e7d63bcc1e5ded499a9949fe859f35d58b632a578cddc4c7d2e6f1303f70f9b48c134fab1ec0209d10e1d145c12d406ab93b8874ec

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
22accee562c4ef3933e10d5cd7d807d6

SHA1
ef86aa3c28eccde002ad0d9c979a8681f7c70098

SHA256
d15c3ac8f6636c6666f38eab5285511f88b8539c60892e914ed3a97afe1256c3

SHA512
af6c8df9b871a249ff5a6d4be91e3802de65ba8c041c1619e2711819032e111589f1459a3874e141b66a0f37dd531452dad639f7920910e70ed8c0d069bcefef

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
6550e679c8a5f73533d9b309e937b8d8

SHA1
0400122b2d749711393d264fc78df04be7295971

SHA256
9b1754d2ee811423c69265d20ca66356e00c4c98bef3f5eddfd94a3c5ba8e164

SHA512
e46773ecdb36dbc9c49f8e3e6a417a5c5c8d8296d6931ed7d52488465e664fd524e9ba58c0bcd1c77a888d195565b941f1316991ca424c2991fcd8f2f6b24955

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
214a487c79f23f635765bc3841a2a3e0

SHA1
64520c7add85813531cd5f20e7240d561ec59e7f

SHA256
2dd85c9440278678799eefdd10cb59765a81cb72e10ed2a2eea22bdbd1f5b4e3

SHA512
af6363b2912dd875236c0c5db4e867d49da3148dc022bd67cb099b88a56d1a433fd57ab816d21efbf839e587132e6f255c913e552afc99837d288c6e453d34c0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
47f0171c67a38fc068bc8f81ebce56dd

SHA1
c7528f85bd4c145082c6fe7f387a560f9291e262

SHA256
3059f5dd97deb4ca6e7d98d9f560e4e142caddd9eba8cdb9dae1be58e36fde9e

SHA512
b6b9190ee546b15a17dfa58f60f8a9bd444c1b14213d14dfc06702fdb0b972c7a3e7cc9a8466f1d9a06ed55c201a14dcca619c13519723a4e288d96688f880a8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
1a7d92e866031355d1008a1987c79ff4

SHA1
5880c924f7dcdd649cce0922eb81d5a376dfcf92

SHA256
d02734270dfc8746e4d214cb402528b5408f46c874ccda13aebcf256aa5c39d5

SHA512
6619aeead67e4159cd4a5651961cb6fa050146579dbcf6cc6d4ea4e51d700e567e41b745f57f48e1992d336948df49edd96f5b40f4008c26271b2f84546caf5e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
9431f7ce874674cce1e7253ebeea1006

SHA1
067e8be62e0075f4a91d0cf0281bc155233e9ff2

SHA256
cc105f9d9bcbfa51ece6cf496d98a2bff3cd2fbd84983fb4e4fdf5f4a99767c0

SHA512
5b0b6b1fb138b6953c833fec25016c4d0d47676af27dd8356a481415e4da040f0d81b8035aa04f68d64420a84fd89a81a15e8f8e6b0defd7305f5c25a0a82ccd

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
5d2542882bf01cacef5ba19ad58e6899

SHA1
ba3dee9587c9770b9ae1f5d01cdd8a73d4880867

SHA256
15423a69c704e550ab06dfdb52ffdd23da0ddbea1bd288be3f5b6fd3d67ccd81

SHA512
90923af05b6c50c4b16160a126f8b6297f31c379cc3c7dfcd63940d8713278cde8932b7214bd16f79b4d7bafa7204c65903bc55198085300cb62917c9c4cc3ec

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
33d71ef8862da02a4bb25b9049cb7b17

SHA1
e7b434aa1c00e8a53d1823d67a8cfd55f7324d5f

SHA256
5c4185270daf8caed1b62da83e926f141c1c7974b693a15f052ee74fe723d654

SHA512
5bef1d45c8d8c8a675439c425948b4a1ba863f9543a8947d43a4f15d4c7d0c1ba2338b4ccecd8e3b4b87eefa3cd8af4dc57dba4af0c24e7af6d1890a578581ae

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
6d46fa32c2780a5193636ed0a2d20573

SHA1
057c8c84783f5712e6c23f676accc5f7b910c0ee

SHA256
da4f2a1d1509fd2c037003563cb76810e8d6a1ee0b2b0e447e48ff70d48e4f0c

SHA512
b67bfcbc5d9a156f0576dc7614a7c7b18736c72965e069cb6b842f235fd7c2db075df9bab556c41efdd3f8c2eb4694b8ad50089bc55064ceb6fcc1488b41ef60

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
fd474631b99cac1d15619faeb93d15e6

SHA1
6c1ee0a95b45cb5d4c4e91a7e656ca9157e31972

SHA256
ed51ee03d107f23e371442af21b00e6b77b8bbde5dc2107e9b5a5f1b9e4d2170

SHA512
c342a538734da26d8e3b65214d6344522140a7a94c9f8559dddcca6dd0eb890f9c1994a49245237c4523f5f872346b6d478f03e64e29096413bbdc865ee2b94c

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
155a4c312cecdb281a06f5f04673c3d8

SHA1
947b2088a1a956749962263a1d6b7cac4d8eaa70

SHA256
33073ed18f832b172a74b463ab78a1adee7a88246a7e171ef68d214b991de053

SHA512
431e9ed687fc2bba8a09a3580ec60abf7fee4ae193304a1111f0cdd1aa19249caeb32e664cd2cd2d5bef599a932ffe0005dcf422191503097d2561a5175e1c21

Download Submit
memory/3704-10839-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3704-5791-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3704-9842-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3704-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3704-11156-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3704-11179-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3704-5785-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3704-11184-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3704-11185-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads