xorist | cb801b4e6ea5f6c1edbff58080c16f5c37369c26acf1e16304ace83aa240e366

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2024 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
Size

7KB
MD5

6ff6d5f4c066ad2fc4bd95a3d1ada270
SHA1

f2ef52519bdd03cf6543873299235fb3fdf9bfa1
SHA256

cb801b4e6ea5f6c1edbff58080c16f5c37369c26acf1e16304ace83aa240e366
SHA512

fcdbac84668c8a6a50f29f1b091f24446bb3e180edeaf1e814542565cdeecd38e1d5d08000786958f9b4a2995140d2696440df3635b00f8ead580086dccc0b4d
SSDEEP

96:lgRZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihEx5vL8SlB2aEPINBXlq4:mRzdrr1FG1WDCgmjPZT/2apNVlxGMUA

Score

10^/10

xorist discovery ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 6 IoCs

resource	yara_rule
behavioral2/memory/2904-3792-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/2904-3791-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/2904-4023-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/2904-4340-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/2904-4361-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/2904-4363-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2185) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\@WirelessDisplayToast.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@EnrollmentToastIcon.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MailContactsCalendarSync\LiveDomainList.txt	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SecurityAndMaintenance.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@AppHelpToast.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@AudioToastIcon.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DefaultAccountTile.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsCodecsRaw.txt	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\default.help.txt	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@VpnToastIcon.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SecurityAndMaintenance_Error.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2904-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2904-3792-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2904-3791-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2904-4023-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2904-4340-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2904-4361-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2904-4363-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_altform-unplated.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxBadge.scale-100.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_hover.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\SearchEmail.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-125_contrast-black.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-100.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-125_contrast-black.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-36_altform-lightunplated.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\MedTile.scale-200.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\MedTile.scale-125.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\WideTile.scale-125.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-400_contrast-white.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_contrast-white.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\tab_mru.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-200.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_altform-unplated_contrast-high.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\PREVIEW.GIF	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\landing_page_start_a_coversation_v2.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-100_contrast-white.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-72_altform-unplated.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer10Sec.targetsize-24.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_scale-200.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-96_contrast-black.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\smsconnect\SMSConnect2x.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-36.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FlagToastQuickAction.scale-80.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\LargeTile.scale-200.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\Close.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text_2x.gif	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Controls\EndOfLife\Assets\farewell.jpg	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Eyebrow.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Fur.jpg	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-40_altform-unplated.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-100_contrast-white.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-125_contrast-white.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-125_contrast-white.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-200_contrast-white.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-96.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-36_contrast-black.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-40_altform-lightunplated.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-150.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_BillPay_Light.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-150.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_field_grabber.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AboutAdsGenericBackgroundImage.jpg	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailBadge.scale-100.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailBadge.scale-200.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-24_altform-lightunplated.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72_altform-unplated_contrast-high.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60_altform-fullcolor.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Error.jpg	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OutlookAccount.scale-100.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\Assets\SquareTile44x44.targetsize-48_altform-unplated_contrast-white_devicefamily-colorfulunplated.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\wide310x150logo.scale-400_contrast-white.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\PeopleLogo.targetsize-36_altform-unplated_contrast-black.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\square150x150logo.scale-125_contrast-white.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobedevicepairing-main.html	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\logo.scale-100.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\ContentPRV.htm	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.scale-200_contrast-black.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..talcontrolssettings_31bf3856ad364e35_10.0.19041.964_none_d1ce1ea46e50a943\n\MicrosoftFamily.scale-100_contrast-black.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-30.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobe-bookend-cortanaspeak.gif	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square150x150Logo.contrast-white_scale-150.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_show_pseudo_classes.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\NavOverFlow_Warning.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobe-footer-template.html	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\http_404.htm	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.264_none_a61d15efb6291d40\Ignore.scale-200.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\storage\images\localStorage.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-white.searchapp_31bf3856ad364e35_10.0.19041.1_none_2f147508fcb33106\AppListIcon.targetsize-64_altform-unplated.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-white.searchapp_31bf3856ad364e35_10.0.19041.1_none_2f147508fcb33106\SmallTile.scale-100.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\oobe-footer-template.html	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobezdp-main.html	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Wide310x150Logo.contrast-white_scale-100.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\Answer.scale-400.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\hstscerterror.htm	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.19041.153_none_e669b22d011fc6b2\ComputerToastIcon.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\ResetDriveSquare44x44Logo.scale-150.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square71x71Logo.contrast-white_scale-125.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\pdferrordisabledforregion.html	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx4-aspnet_webadmin_images_b03f5f7f11d50a3a_4.0.15805.0_none_7ab11546ceb3decd\aspx_file.gif	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSplashScreen.scale-150_contrast-black.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_edda8130b19d4286\Splashscreen.scale-100.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\Square44x44Logo.targetsize-30_altform-lightunplated.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_b30156e32b833fb0\Close.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPStoreLogo.scale-125.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ets.icons.searchapp_31bf3856ad364e35_10.0.19041.1_none_ceba36fd1b479c4c\SmallTile.scale-100.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\WiFiNetworkManagerWarningToast.scale-100_contrast-white.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-125.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\Assets\KbdFunction.wav	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\wide310x150logo.scale-400.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\badgeInfo.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..talcontrolssettings_31bf3856ad364e35_10.0.19041.964_none_d1ce1ea46e50a943\MicrosoftFamily.scale-125_contrast-white.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\debugger\images\stepOver.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars46.scale-200.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-36_altform-unplated_contrast-white.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\DropAccept.scale-150.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.Shell\Images\RequestedDownloadsLargeCloudIcon.contrast-white_scale-150.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ets.icons.searchapp_31bf3856ad364e35_10.0.19041.1_none_ceba36fd1b479c4c\SmallTile.scale-125.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square150x150Logo.scale-200.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\defaultbrowser.htm	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_10.0.19041.1_none_27faaee495997877\branding_Full2.gif	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx4-aspnet_webadmin_images_b03f5f7f11d50a3a_4.0.15805.0_none_3303de6fba37b5c7\headerGRADIENT_Tall.gif	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_hyperv-vmchipset_31bf3856ad364e35_10.0.19041.153_none_b32940cfeb827fac\VmChipset Third-Party Notices.txt	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\refreshState.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\http_404.htm	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..talcontrolssettings_31bf3856ad364e35_10.0.19041.964_none_d1ce1ea46e50a943\MicrosoftFamily.scale-400.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars45.scale-200.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\TabSweepExplanation.png	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Alarm04.wav	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx4-aspnet_webadmin_images_b03f5f7f11d50a3a_4.0.15805.0_none_7ab11546ceb3decd\selectedTab_rightCorner.gif	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\defaultbrowser.htm	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\ = "CRYPTED!"	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\DefaultIcon	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\shell	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\shell\open	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XLYPOgkwnmeI0m1.exe"	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "PLWFFSKOJSYWZYV"	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XLYPOgkwnmeI0m1.exe,0"	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\shell\open\command	6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6ff6d5f4c066ad2fc4bd95a3d1ada270_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
4ff5aa62caaae38485d6093b259b5ea5

SHA1
1a80ed24f1099f9d21347c86fd33856aefaced23

SHA256
2ef4d49e1c366e17effa40541d9c6faeda97537828b6abc33c861810dfc70545

SHA512
9d7775c10dc0829b779dd1f51070e2684eef782377ae496b2e3e8870bf303276244f1419b76211ff45a59bc15d3ccba2c680f252da0a87613ddd6cc40d3fa502

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
7263207718c8ab33ba66d9268bb948d1

SHA1
3c2c10cf2b3b4ddcc9ed8a5a2ff77c68461a2622

SHA256
32b0f1da61c1a43fa601e63d275dcd497cb4c59f0a4e17654c55ebbe75bb94e2

SHA512
ad493fea72494a8b53c7b58f7bd92c3dde63466bebd218db8887497303d8751c36e136386f9c8b5932e6ed96bf79f84381d0798e36dd44fb2568723fd6345d0e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
e4c122579e9feaf0eb9d9a7f6b406afe

SHA1
15cafb3b11b8bf6d7186d13fe9d68eef89e20f93

SHA256
d7fde586e334f56f363f399e236071eccab8f4bf90659482b09fc6fc033f27b6

SHA512
d44e9a784184833180fb46f6a4ed3bf674a38ecd917b2021a62f1528cadbc2fef9551ddf51086f867a41155a14ea01cddb95f6af27cca011d9a4e4c4b1efeead

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
ad8a995928fd421b46bbb5c57ff264f4

SHA1
daab32e7fc1df768cb1dd23b4e89a614f5075d71

SHA256
c3caf6d1cc0b2a719d13e7d8de419c7a7beaab3af9f78cf2a2ba3194971e3182

SHA512
5c87fd5144adfcabc3dc59c26ea228d2651a733cb0045ef9a14336cc08bbd9eda2f93d74f9ff14200ec85113927fbf4917702a7b15f0dad6cbd8120f6a826c5c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
ffa056572a36c2934a685596628f8093

SHA1
01982a62e04c3ea9b4ec82b53b294fd87bc18977

SHA256
002fccb4383c0fd5d439f2d2ac3c16088347125117b4732030757acd71ce20d8

SHA512
6b073150321131617f07d645ccbcce3c98e0c693ad7702112f6ff90b251afc70e886df8fb1db566838a3a632a21628a067106582af5ea8dea321a3156f66ed7d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
022bce3f00532a875ebf4d0831760988

SHA1
c771ad1589ed2e30b0aa67be332f98f4458b05b6

SHA256
57012834feb7adec043af8bc87604b16f30e5a2ac4d82c9610de2f7f08cef026

SHA512
8b15d74af7f8c63f866c649ea34ca2fd91ac36bb2de3e7b94c5a59ec2dde6632f67b79433f4139c9262e9c22039e47b3bed51cdd190b80ff5fd5dea0d1a0a92d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
8e0f309f8f8ad23b778f8a892a9bae31

SHA1
4fb9d2f25d66860ea482d0ecc0cb90caca654566

SHA256
c50aa2d9df3322a4ffb8e0fa1a470f15fa0fb89e4c0be230bf1572d3142ddefd

SHA512
49ed1af826c0b16612a988744836d014787b76b65de6b7db38d2aa85ec8f98af21406e56aba607c61e31d07d714cad1c870e8df0e9329d2e5f572cb1596a7540

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
b38bd05f72aaf0f9691206d5a739d551

SHA1
f4a36319e9c9887632b9eba0878ffcaecceede2e

SHA256
9b0da2c063a2a25cc32d802506e329537b37de1b2c6ac71df0e3dd3f91c05dfb

SHA512
24a1956acc1af668475e495cd8361eeeafa03eaa60db8a08e9018a195ad00f75ad516d87dd0b8931449a2dd74794e6945d261c44bfe0445dfe502778e80f9171

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
acc26abb85d58b8f988d013f4e102b37

SHA1
9157ee7523e10f218cf26c8fd3bb4fc5102c5a5a

SHA256
92e23ae62068890388a6a4cb852d5dab24efc9c800c428a094a5bab07c1a1353

SHA512
613ae789b078ffa1c21ff17e6f478e6688d875ccabf65dc4b8851676e0d4a01fc922d7688834bac6b6b1887a7c26ee5712dbe6beffb00abbd9b3740391ce235b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
d2354a3fb145da25f18522027f8aabcf

SHA1
916a79ea0f72143ce185c221525abbc2ff164e0b

SHA256
889048070cd49ccec4ea6ad0dc1ee027bbafe66a0611ad9f44cb6e8446bf0fc7

SHA512
bac7b4565cc3aac121c2ca236c9b403fcf3a8b56faeb9e2cb0cf8b1b97569db6b1b10d50fdb14ebe203d6b59017322eb1333029ae1f8ba95cda763ce9547885a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
9430f051d70deb1e85655ba6a340e0d4

SHA1
a7f42db3da5bb3c3d2126a837812af368fdda4f7

SHA256
ae519090fbd81d2d96d62d14533581564782f02437007a76b7858638256849f6

SHA512
ece92ef1e286f46c087f65dd5334971e1c8a90b997c994295407523eadc65e1300c0a0e06baa027e7eb9383f31e705a1804a30bb7a1a0c7ea8eac20f05a6393c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
98ecb08b8af816101a857f64423856ce

SHA1
b97398c674cb024d3b5725401dc9c3bf7d2b333b

SHA256
6de5850c1a4c568ed641c8099b63cc279c3259490f268cc96bae12f16629e87f

SHA512
ac8ff8173c8d066b5966ddc0d710c82c6fe6a6d0caa001f808b59f5d2679ae356ff018344585df14dd8fe0824b67847f1fe3a6a8f07e0e8e4db7043f95f591a8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
e3dfb709230282f27df6436ee4710065

SHA1
b7065df719e7bb5db68f071ca91664d0d40e5386

SHA256
5dd7140fa2c63536ed32dcdcefad16a3363daea25a3a40eb4ef7cbf10af354d8

SHA512
c52b61dca00ce40ae6731b02a44956b808fc3979807e89fbe279b77bca72f66d7ead34ceb6ea1658454af4ef2c110062e409066e670c2da68a67c102ffeb06de

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
67aa7ff4e9c493aa8cadaeec180a47b6

SHA1
9e742ad03525a1106f27b25ba5a47b01ae0323ea

SHA256
4987175dd2e5a9f8ad69bfdadcb00e98e8125d69ebf3356b161791c2cf93baaa

SHA512
ac8821ed783324218140346aabe6c10ff7846e3399f67f68c3f36fbdb1858b9fdff3d04b1b0f1213952d9527fc838c0a7dfa5ff68c43818dd77eaf3633b16cbf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
1cc8ed802c5ee45624cf813b753672ad

SHA1
468ca090d1a22e24bc1de3367258c0f55a2571fb

SHA256
f38fc774c3c576b97f290829e4d587d215a5aea69e9c9b03130f6cfb1de84b38

SHA512
98dc359277e7cf0b9e69f0352f0191a4cd9972f224e0779966a4af9f6356150fc0359a2fe6a9ba79b404822edc7b5a3db17669e1a95ec79c784e688fde2c6a3f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
56c683cccecd2fc4fb552236d4436a7a

SHA1
694cf727db6fc911e6e4d118d05e9e459dea99ae

SHA256
ab537b0deb015889d8e54bdbef272d57fb755d47a05c890a74a6bc19f5b9b66a

SHA512
4c5af9c75040c4f419459a1757458d58cdc6e456798e3638c99d70b4618f04c64ded44198c5479733453e69ad675f8d792b7fb9003ccddbc3d5e01c241015223

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
5666e4d7d79addf2db3e8de7428a9790

SHA1
b72f4512b1ce88c1baa04b0c8a5216be765f3d7c

SHA256
3f6b9027fe32ab132dca4085b8c905a227322991f181a92cc31a1977f6d649b7

SHA512
4d5836a76534df1e41bc5a28d45b943fee698592445118988c4f7e10975dca976f488aad61d80cd0e83b79be9b5ad69741a00d0c12a23cbb0fe7cdff37b87c84

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
ffcb6c15977e6ca6b63f76c4a973ceda

SHA1
8c0d4c8e50a9281062f1f71b8db749671fc3fdb0

SHA256
7ee2bcef65134bc16aee6eb0f0785c9875b36d3b19b32e7af002fbc1b05bb94a

SHA512
8ce5eae43e41d3b287e1194cc19d55382348b7c088ddae9a8a47ff560f9cb3cd741566cf23d6419ecfe195cf46b3fd9382362a3ee478ff0b90870f0152fe8bf9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
ca3b965678e2ffc1b0ca6be7356e7773

SHA1
1c678d8a4c82ae6bef3a053a45e9e7399a36acd2

SHA256
014ffb3016918ff9c5bdd3026e2574efb0c4c8e865391f22f271d7213938ef76

SHA512
987a5af725ca0a1411efc9d2955f5801f733e0fdfca487b5706779ebfc37aac9d674318f45b16ac27ad844f3f8be10bfcebacf941013fb1971e178b48857c1b6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
b45fe95ea64537c0a40ed22722e4e372

SHA1
798bdb887bbcbc984ef4d8b3e0682116808d474e

SHA256
834404e1d025e14ff0445896a5432fcbc615cf2ca787bbbbf4ac7862a0a36e73

SHA512
103de89bcf4635f1c81d9ec9c3db62fedc58dc98caee69d6f51900a0319a6dee5f583c9f6ab6ce1136387bca9a6f15b10bbcb5dcb82c72f0d401e415b36d9af9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
a2d48a95a874323476ce94378f5b1951

SHA1
8512498e448c8e7aab6e081ba5f862cabe10c1d1

SHA256
2e8951b400f9b71e41809e95542dbcea017b2804cac3c73f27b83329b21dbfe1

SHA512
51594710de5cf617fd812e687558fbd545795fb9a576234aca48a741b751020a747cd237f2057895655e70936341d4a416d7a1cfa5bb05d1eccd852b12adfa15

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
eaadc5e855008ab84dbec7a7796dbf42

SHA1
0aaced13abaf920283cd9b5db2e5c9a412dfdb65

SHA256
9525f6610bf6c8295f0f63804676fdce94c38a5c4340727e307694f5cb14dc6d

SHA512
6a240ac7774f75cc4d0c272b0aa72776be3d572d50de984a68cce8f241a91f0540880e58f9999d91eebe7e702d1de87ea5decbb2ab3de3a0e01c830e558301d2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
9d1f6243cbd65c7389dfc45e5ec02d1a

SHA1
aa71db3864290330dcca763c2122657a2848f89d

SHA256
73efea70a27febfa397baf3e5d9aadb1a3e58f2bbe4afed5ee86fa91a8df0bde

SHA512
62495b9b9c3ead9f08280ea189dea51e427ad5edf7ffd88af28d1222d0bbd3c26cd089b70bf371c89bd8e3cfe2708a560a10ab90b7614de66b4111955b4420b3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
c80c03bbf986264064fff5a087b066fb

SHA1
3a35fbddd084cc2f13fb4a86ced65e528ab327b0

SHA256
890c5eb31ae8dd1a025efb621c3df4834906d53d716caf51656482f9ca0d41ec

SHA512
83fc333a98239e34422f253ff5001a41c9636fa6b7f08def2d9d2ae84aabcea8934a2288001f245129d2d51e7d6aaa8fad4cc859b0af04cad093cda7bd8650cf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
718340dd074aac9045c572c5b0c9a930

SHA1
3cf6dcf10b4cfd20a458b905c85f2e881e678f52

SHA256
041a191e2fde6242712e6f619f86054c9ac631992d45e9c1e17e9096faa415d3

SHA512
9f9b52e5a186ba4814bc9c9f64660a7828d76bd3d68c51e6216fe8b4e604fa38ca6351d10526921716af7a5ae93891e3019f1fe684f99465389f299c5f072e95

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
701444f8e931bd5c36cf7aa743d6063a

SHA1
49bc29640e154eb46ce7340a7b593aff30647936

SHA256
b19d6b32f541d7d2a95acca8facdd8a8a3a10c36510680ae7caabaea3cff24c8

SHA512
312485e470b8cf6efb7eec77ba6f7cc2b9724c5ee44b5ea4afb81621eb726b164df82d1c05368f29d12bc23fe7df25751334ac30571aa92e7767ff50d68d7832

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
d6dad4fd9bd3fa80d680a2ff54ebd891

SHA1
3e504020dac27474fc415aa233ca583145c6b239

SHA256
53fd36ad0f2ae9cef74ff9136cfbb5f5cf6fc2090b4375db209190486b9a7ec6

SHA512
8d698052a23e0c582347a560c1459ee651310df80bb5c6e656e822f6bfd2b569c13107b8e24880f51b64d85f44009777077db01c43c69671b8d3bb1baa1bdc17

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
88d062b98bdc2534ba10a3a6eabc0a07

SHA1
5c2f98b36ae513206f410cf4b2bf90b25fbe333b

SHA256
6d7fb070363bb94381ef216cd8bf16a5a03bf37aa85ee05d2bb1481ff0b65584

SHA512
c3823ab58cdaa1d2b608ae53f6524fd1077389c49c5c61c09eef4c56c47dbe862740527495a81136b9afd7f3b30571fb795e0dc4fd4cd8aa1d1426443d826601

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
e0528fd300a4fe3ee677e117337457c8

SHA1
bcde56b12dde1832656f300609e5525d21e110c1

SHA256
6b3519d5bfd40529c780e8856f329ba096ed33e93f0d8c4e317cafad7b549883

SHA512
cf6530e7baa16580b090d3473adeaeb7820e9b6251d6cb3a630d1264f5fbb0397b7554f34f21c17c260741d74b30b055fe5656a38501b3251df49d2e2c4a015b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
3817dcac81f4a951e94dd2a8882bd5d4

SHA1
2682b4aa03c9b3865b9d2140d73ba0d6e2d20592

SHA256
8b36b681a23e2a8ff61c1ba610adb1925e4c6c4135a3a48f63c72d3172a2b4f9

SHA512
ebdef1a7362a7bfd9a1f2319d3bd280d092ca300318a1171cfeb81e4d949ece8baad5fe436cb0ed660b73d6d7479f142c9b1ad869fe3005cc58fa60d34e03e14

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
6739cceaea9a9ff2155f2da8617b2681

SHA1
720ff203c1eb03d4f58bfcf37c274af64b0a7aed

SHA256
68668cd7ac7e41533b43e7a617ac2cf378afc76a88b0b92b19b5568fc0b462f0

SHA512
e2bfd1156aac23b0d49a2d826dc7496ecde8b6727a846a60229aa6eba0e34dfcb76e1c387f329ec3411d2b3e554b93e6ee5e36c752bba1de05cc88f4ca0fb26b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
9c1c57d5b0c47b02f65086d71486fc9e

SHA1
19e9e991a9776bf69aaa563a6d6d989939387982

SHA256
2ce6c28d73b928b8e313e9ac9c3071a00009e6c8708469dff2c0f82bc0d085dc

SHA512
84ae3987114dfe6355bb90a06bc9f37a292a2b7b403980f1b35ecdac416f03b7cff7ab031eb0c82ce0e6ca916c02adef72e5492b87ecba89ff4ff7ea28f4b446

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
f62f8928f8b09138902ab6758cd70dbd

SHA1
616b08866c1c2b0fcf4293deafc294256ef56309

SHA256
74b4e50e87ded548ef2e5c218123510551b69a6711237ec348666ee76f6059ca

SHA512
7ab62feefd59576ec0479184289bcb90dcbc1cc76eb09a27e5e5be04210996e60e89df3c03a5a5eb0e4d42e7f8d034464aa19e2183ff5bfe914c07cd0a9ddaa2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
fda0088ed8451e6613778feb7c84bde2

SHA1
064c80c22382fc994f897a7c0215d53301eef971

SHA256
f3538973be2cb3b6b307908c344e2ad51e7b16f3e198a80c6af928ce0f994c7f

SHA512
16caea1d96b3977bbe43ffccd1b27d2cca818128fe88453bb43b68dfacc5d6517a07584964ab28eb762c8dd8e83195b3725165c854f828e04f9f165809b0543b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
ed7ff4e29c9fb7ef743e19b563c426ff

SHA1
c6c681e7b923e83b14c42a701f015d694cab6f1f

SHA256
01a0f8b8bc641d4fcafa949a86ddb3f8c3549fc156e88ad902dd02ba015acb3e

SHA512
c9baa93e34561664d71a6629e0b927711d53b62a916bce8a306a5e02b4b73fafea4ee8fd2388dd6e85668b981b74531354e10bdfed15654268e834064f2787e1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
e866e8ebd6b656dabcb199aa5fd8290c

SHA1
906cb09929f4519614015169b5f1cdeea6679d4c

SHA256
4cc8a69421882fd17ab044f0247f384fcec30fbfac2c0219981a2f6434b3bc8b

SHA512
5228911605bc3240e3b8f7e8711b2e70a5d5536dd62ddee59a8a6c6e110ab4c8c696807dab2f05c78af0806c06663f38f72d8957a8d32a52b1f5a7debf915bf2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
7d235ed618f7c7efed4f15e18824793c

SHA1
ceb52bad283a04f2d8fd1b9310bb08c80d03108b

SHA256
897c6190fd39d34fbfca8b3278ab41c1f491d3c556e6db9ecad8b87119fb21da

SHA512
2271c95bf0a0e336f86d2c107f6b07bf0fb16835da38c3063adcd9eac441a6e26bb33a7243702af50f18f61ad39a8bbf6f99debadc22e57df0e38a7d72b4837b

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt.EnCiPhErEd

Filesize
32KB

MD5
8aaa9f6bc9450a7a5a677c9792f6a987

SHA1
af82f3c20cdc9bc43314af3893c58c27f33bc966

SHA256
864d00f24fbdcffe7b02114c60f236770fa4e732ff06d1b3fc72dbec2d6f4aea

SHA512
2d71b6323034942134d1784655604e743d8762844396f19ed549ad5c89b84e088aba5f0f32423bbe23b13d622f8485bb0745db6224aef04f96384b041dd9d2bf

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
a6d5f24e69f91d9f3e4c3efed189c94e

SHA1
ee51780a545203ed5ccfffbcd6c222426afc5962

SHA256
25a82c9d5b8c79afa9d1d9b1b898a3f954d235d4a26e3052a8ae9aa0572ddc14

SHA512
d9f1677954903efc9921c3097aaa16a255d140dfb7e0a8cc158471a2f2da95820e01e079987c593e5e706d830302b64aa0c555648e992a5ee654ba77d83e328a

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
bc91fdee7d1e40b51177a105c37356c9

SHA1
848acbe655de6ebf2e1566ef2cb97d1d61e5c831

SHA256
7f012b644c083a2c0c395a1439b7c85d65f8a23a2f61d55a8b41bf05ed2aa829

SHA512
0b5786d1b2f78ac2d7bf2f37520704c5254134efb74f1c4cff62bd01a592b68e4ec406930c085e93a4c5edac61c39f3e260b15a7ce120776108b93741bab48c7

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
87befd6ad8caac8b3cf8be805124c255

SHA1
ed4ce21aea77138bc9bc219c51ffaddd888d43d9

SHA256
092416ef27bf07ff453b742c791b84f9bf2b4114119dada8c04a4a9bee63d21e

SHA512
b07b957997a92a67dca680a3147fbc58e660e7b7b52b3e0d65832916b214ba02b2689a6df91b7a52e151fd10d0fa3539d27538983d1c2148f57d33d4d675d666

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
5e82f6e7814057f0fcf3fc5b3cc9e3a5

SHA1
18be7209357a21eb5adaf7de6ee763e16e849b12

SHA256
8cd4f63efd7f4656a66ee4bc2bf84a7f5e543ef2ce4a77242995185b4ccaabd1

SHA512
69e379f3fa59ac7a7bb186d4581a4c4e712778518b9ff20fd2eb1c5333dd6adc85c97b2ce33d3c2adaa49b3c7e6c8054f3716b8e6237191b4b573665baceaada

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
b8b07e51fbaa6c464808bcbc50a2ff76

SHA1
cf47493f885178fe9d3f5754b6ac38f30357a130

SHA256
45aa4410b49302f06bad9583f687d2faed89b941f883f2862da65aee670b703b

SHA512
282355a41982718efe2cbf5b7fb1bc8200ae36587f5b20f17e16fe189daa689b5876f4aa90d2f06fc6a05b710224e0a4341c4fdd02bc0408c75f45f0b3493fc0

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
520c42e4a84792088fb02794051909ef

SHA1
64589e150c84f55fbad7d7c91191be236662d5fd

SHA256
5e0e2fb8f7fdf21f1cac5636f2d7a31067852f7b64c355c8cc25fb28fac89377

SHA512
5d69f5e106425300255321cd7fd5321d682f5eee40d7e4c7012c58101a1caa4c3e1b8f46fb389b713bc94cfb89f6f00244d2becb85bb922aaaf7dd1dd3abb910

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
11c7697e2ba1ebc1439cf1e1e2d03fdd

SHA1
45b82dae078c247073138162f2c9b2c220c0e4f0

SHA256
1690d4a3228bfa24c5183ac01d491a9993f7e6460c2445d720a60c21ece1dc32

SHA512
dc2cc7a11bccceb7d3b6408a4740610113ef9db22984da21b324442ee8c11cf0e3efc8ae680c2a790c3e32b01a33fb5e14f810336e1e9800b9d4c2feaf253af8

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
0316cdab21c9316cf0b807ee6b21ad62

SHA1
d95858f5fa527b8b6ab7b748b8b84ec3819ac9c7

SHA256
23f600a69dba5fe1e3c83b4088ad9f0a70a52d9a33a10dde4f5082f2946bddbf

SHA512
e884a8a252b4ed557a0be7e136932ef315550ea3c8058767d2cc90b9cb6b1d1321cb99753b76452f03e6eb42d8679b5bf00f19e10ebe9ffc38cd9485c9adaa11

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
520fd8724719a24e8349e2cb200b45fc

SHA1
899978e86b1930367293f7bda490e4cbed653544

SHA256
0056e8dad24ffd58b0344ac92164ba396d0a913b87833ab7c45cedbaddd4c76d

SHA512
6d9e9f316cdb5978fba6583dc65d0a90c5b3c39d89902bd19e67bc5c4843b5e51f0322cf45cb2c3935bc90dd6f30f4024546bac0ca674b7b7d5c3d71d9d96c4c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
b494aea35d0998d82dc11763504226d5

SHA1
bf3111db3a906a56c140c321fe75c218edaceee3

SHA256
9def82b570ae004f4012b355c68c84fb585178d3755be6d4f93f28d17a2ddef3

SHA512
29bb7c4029862acf9ddbbcf991b3d6e116f659945fc59212819bc1ec6bcad153d6d65bc1c51426a52c10f42068195649c0808f081153e79e3cdc77d7f747d8b2

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
bac0572904a63599773df5320b415e6f

SHA1
dbbd3e7a990bb91fa72741a78310e4037b6b82a8

SHA256
9b190ff44543af5d965d51d7ee6d3470131636236c6ee9c0d7b1e516b63811e1

SHA512
abd4a58eb8b3ddc44d9beff46d7158d1b58f823681f57449a8d5b7646731b4467aa3533e203dcf730423b31744584c50835873ecccb0904ccf491cc8137f6c2f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
5b5d3fccb431c3a95ed1ff080fa3840a

SHA1
e9ea23676a00595ed662000b95e28c285e50c830

SHA256
4e171c02f91eba2e6087ba0c6b5778532ab581187d78d08243efe560f0b644d2

SHA512
6447f2a63adfbc9e8b83ae888cc95cb1610cc3a080954e0d32ff58972f84bd5f2fdaf23b613d1ebb205acdbc05ae4863bf45ad49c49b19e188334a66a57e765b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
4b21ca2b90dadf96ecb587ecf776f26a

SHA1
67e40500011b85cfffc75d248f4e8a51a5e416c0

SHA256
3dfe5f875ec452a59d092ce7631148aaee9a3580a52d5a39079f0360e1a9db78

SHA512
e9374cfebaee4ca9a73e56a4a028357b71c6f7f5e43c8427ca8fe3cb75b73dd8164c5f1915310646abf835715a6d0896544645d25de5cccfb0ec66adccdbfa77

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
97e102db78190e0f1180f28936527021

SHA1
9e699466d34efd799e2eddd2709c47d9fceb8807

SHA256
ac993ff8346c52b9b507172426797d4fe866f06bcb09ab421eda51fbd701b5ad

SHA512
4d2487a8576684b7b514d35fe98f644f152852c9c0834093976cddd428af66a40b6754d40d87dbd4eb196cf6716fcd51f715b85c0ae6e302a2a3f5bdda420ad5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
8bebbbb9e72d5c0fcb7b1fc39516427b

SHA1
68d82448ddd4c2f954580cbb73b8a446a95e355e

SHA256
f370aa2cbb36858002ea3f222a2e0f1381c9ac6faf1619282c28bb63d899e54a

SHA512
b30ded7ef5d94bfda91312c1d0a6b38f21a0ac7910b0a57d1791aba43cfab52037233eddaa75484be9438a07b8614cd202d181255d30eb15193cccdcabc28f73

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
22fefbf35d84d160ece676283e77962e

SHA1
7c5fc4b06d60b086fe6742be8beb2dd55eca2e17

SHA256
f500c663d87c11c91e44beac31e944e2003f2ed2bd972a97f5020d27bf77895c

SHA512
523e72f553531fb1dc2ecb1cae4b4239c1706ac30ef6a458875c73e3a768a0d91113bc219c1ecf638f28680df46b1f84be69aff5032c2a751e8f6d91605d87d3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
38347eec6c4bc4c69e4e03993c3c5336

SHA1
5f2410df226a74d5b87eb584ac771bb963537f6a

SHA256
d74d2c6d3fe1a25c06cd49b6b1a6b0439231fa5da85e1e6643fed6b22be63f7f

SHA512
fba13ec130fa70cec28254ecc51ff9bd05219e45a950ce2f20450860bc43dc4fec9db169bbef64b46e5493d26955a0d6e377c9116439e8577a9c95780b8b3540

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
50f3ba869ac72d49639c507f5781c5bf

SHA1
d34e348c1a66795fe5f42992562ddd6de38fdbea

SHA256
e30ce1207eb0eaf1f0617f76d107b33561ea559273e9dc3c1b26bea8b2a3d708

SHA512
e79746187b34aa7f691b94c70e223adbf934ace11627978c04a0f438b2993c7ffdf76663ccfc557c3ecaa1a5a51df931a473123f8430b5c9f55195ff4a193ba1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
599695b5403d6d4c3475ad945235460e

SHA1
53264ef456cd9af107ca88df1f4f9d7e487a470e

SHA256
162f153a5286f3eb07aa7f4f34ca90337d3002c8af140a656bd234c3c3555303

SHA512
05269bde65693991f2a15574712607a77f522172605e577511e7536f7e35f5265f4c8424959cb311ede24d64b3864ecb50c98a8002fd1cb26232bd1906a4bf10

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
7b98af32fb577c62dff801d71a933333

SHA1
5b002ca838244ee5edfcae62eaa163550cb8944f

SHA256
5dbdf79efc9a0fabde5818859d8cdd9349955a2853ebc816bbd003c4ed8d7e38

SHA512
b99cf06bfdac0573a72b2622b81ad7563c6a9cf7a54cb6aef2e9d0989d799d8a7939071295fe61f20bc137894745526e02bd8605ca69ae28f83e32c8743c85c8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
80b5e0895b87d161cff626cb68eec48e

SHA1
852fc9bce8d3011d11b640c706dfc6f17e791a10

SHA256
e1d504aa1efee8db0cab284e0622577ec1bd6c47a640bc9e0288de2fca130fe5

SHA512
1c43e1e754e88e01cbe08cbf01913107b960f500f403d0b9abd89d884df5477da9b693a17328cac01177dfb283ba788141d729b2680424503f22adf517aebd30

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
ba2fadcd6d9b0c572150c7a6f26d4f5c

SHA1
95ae45c2d6a844529dcbae541b2a3fd4cb2ac699

SHA256
cd4436c74712e720a3f6d2cc71deb1b26708f7bd6d047c41f657493d7705c29f

SHA512
38e9521ad0ac1d5b309250e4647e685115435eece2d40f42bc8c58dd0a5c687ab1784cf0df822754327e559d887115d1f38ea5d1724141ff5bc7c577abfd7e07

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
a1696927d8324c316a996d4ca7350e73

SHA1
c6e651ed7cb0babdb07d907f2fb254739ec71934

SHA256
526bb41104473c97524c3239afe2f87b85c024200ae5618e0cf156d50457058c

SHA512
fc3d4480734b91d83c6fe5241497ddd5ede4749d6979d9d31215d07858389eecdfbd04faeeb9d193ee5c6b6362ddd3c2bb00e76a27c774485f5d613aaf0783b2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
99fd4d01e0510ffc3b39d80b2426d470

SHA1
6bb815bd2aa2849fc3758f61c563f667283bb46d

SHA256
476ca643f22ef00135bdc146b46695c98449b8670d5daf3c74058036a1f60dae

SHA512
7d69fa8ef4b94e690863fa15646fdea34b8dcaca66e2675559415e2a5df29cb9ec821922cce02b1318267f8c38145d8c329950f5982d6340aa8b8c8e7f0b38ae

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
631fbaeee5fc95abe0e9d104cf0864bc

SHA1
56e0376cc6544f1fdfaf651e5015b08c47481fbf

SHA256
896dac27ac9ef4720d345e5fcf82254482031f1625e6040f52c4aa1bf992185b

SHA512
d236c41c5ba22a3809723fb373ed9c9b3bec83c098134058e6aeb9f42a1aebbe60ea13d78e244d3f22e5dfff48df3d8f531938c2443f7d0209e6d8e4c1172b82

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
b3107115737a849a034d2d931fb30def

SHA1
c80c35256abe6daafb6a290e697e7d29f19ca26e

SHA256
5a3fd768f53be5a33077db69563bb42cd02eb3892eeb9a5e345e14c5d2387b88

SHA512
b58cfa46de13aa87e9eb10bcb83bb8f062579b5cadca344dfcf8cab8b2a4a54683ed8e492138fd0499a5b07e6430114bc652df211198ea547a590d2124febb7f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
0f0b20df5672fe5b412c6c7a779a771d

SHA1
88f31676e96557faa0942e8ddd72c5dc9c45b9a9

SHA256
93555cc692f1d06beb0e6929de70015a95f93cc4fc4ab035552ccc1324bda042

SHA512
480b9e301c7f0868278a7960c45a375b30ff0dcbad2064cb788a01900d45a753c18faa7a607de2eb525b8e67fae7df80d12be70fac3d5782b7edc3a7b386c411

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
0ee97c6d89854838b76e9bb9b6920f5f

SHA1
05e031940f1c67774227db73e5a06999f52f8e6f

SHA256
24ee2927260beaf28aac3c08a43c5b7cdf4f293fb0b08aab451bb905c60131ac

SHA512
5846690c0951c0ebf021d133e9ec8740663d623bb134a881dbff960cb4d5c904254f26bfa3a5fd68e585435c7512ae95dfa8e1d7ea937b0baa622ff8d4e0c10b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
34e4816bec0d938cfda31f5a702e14cc

SHA1
1524750ca289dca0036701f26462912bd62261e8

SHA256
7af824c2d2907062f4bf0f3a0d9b9763025ed0ea040b9fc87186e858237ce9a1

SHA512
1832d4bd04ed0fb4731f30e46bcaf8f65f202fe858274b27ee838b3ae287f258bc49581af967aa1350d31ad247c99f7b7d7b63a96069e982ae67e92b9cb16ed0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
be2d7ebfab44034a0c91467dd0edd2f8

SHA1
8d9ed055c153b7693a7d4554bde363d4fd442195

SHA256
79b8c2726df672d43afee4408afa19a484f1b87e7b27c42f383c24db46a5bb71

SHA512
5dac934618bbc42b47eb13f44cf217518846f19119ff46c4caccc60702606dd1e9bfeab640fe84f44ea52fcb9560fcb63a28e639603f5e0756b96c03c319f30e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
29a2c4f9102b9163f94192e308b09324

SHA1
7fb3517a695d13169a5a71da12a027152c36af18

SHA256
3d9237addc4c317699cd49a049df3d2e9fde91e6b6abfe483b0d323cfdc17fd3

SHA512
a755a532012fa74d07e80b46b57bab039b505d0b71bb03fcaba6b9d3f49e02519e4912f92a196eb3ce9a448957af0699b22045627d1fcfcc38ac6b26feae2478

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
00310eac747d02606926082b3b0d02cb

SHA1
9ea837657b3fef4f1c95a2e030f589ff2ca100aa

SHA256
f67d7c266f22a17f4fa77ab40d43f33851a3f0a81075867d23220c0d1fda1c35

SHA512
dbe33cb3aebe41478b430303cacf16d1230648d6b99615c2c57a255b8c556e01e9817b0aa81486bf01f127683d4d1d100d88609cbf5eb43266f77e8c97ddbd79

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
5f468af3f831eb7371b8bfedcee2cf04

SHA1
d7b43c609442ad246313711ebed424c7300a4a23

SHA256
9343e4889f7a64c33b35e3785d0c44cc8e1890efbaf67c355bafe6c2f99480b4

SHA512
3af0c0560dbfdaf5ed663ee228b72e14bb924d14367c24a4137294a6ba7ca611793c4bd05b72181748d4e61ade4e99214842c0b6e84842e896eb7b98e910eaaf

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
75510ccd1b9eebf874fc660dcc067677

SHA1
58aacf30b4927729aca236727b3dd0bfe42f0cea

SHA256
0edb411eb4d536e0467f979a12bf7f373bc2107dd319787eaa47bad9136f95f6

SHA512
e661e35e5a15520755ce5fdc91928a296a0f29cb621f1bac4888f7b458f45d3c0ef2bf9892cf9d7009bfa4b7ca099bbbf0d65972e9245c0b19c8bbaaff2535d2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
45668f3c93a09b0202e214c1d7d82f65

SHA1
e95dfe7ab0063446f2decc8eb4d50dff9eb6fa09

SHA256
4c16fc70a046ea031db630b2fe44ef9be2ec556686b7c4072e94475abf472f3e

SHA512
3e5be7ea935edc8ea73a97383136886a1ab90ae74b0a70a726d493e9a84fce34bdff1aa88bb77f52095b4f0607dd0fd9ccf38fd8899c602ad6e22b98fbeaeead

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
beccd7989d83beb5d86a9b08f41b4879

SHA1
3e8b6cf69514f8c972a9e8dfcee6426c6cdcb4cc

SHA256
c8dccca0eeb9a56ef63a2698069b385155cef83dc38dd858bc60cbfdb257ef5c

SHA512
fbcfb57f29030c2341d584c0c970014c9fe292c5d4127d67082742b2659642bc0b1dbbc1a1f780e47341a7b744fa36cf8427ea1f9706c5679c0cac0b19632aa0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
f4e1e91f7659dee5950768aa50723da2

SHA1
ce72b5fcc8937c1e6258359b371747371cea2d1a

SHA256
b243c336a571d10b185f8f90aa14eb197242833c7520c2019c567a503d592784

SHA512
da7454c4b53afa4872465023828f15dd174a2dc4aae3e4aac5a0922095c5f3803e8f2485973b3c6914f059df9807eeba0ddb4cd9e506310b1fe9dcd38f7bf096

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
a55ec8561cb6a2d34ece24822f181898

SHA1
d72163e02799750e4f225a15d8c368f6905bd3d6

SHA256
7d80d0e2cf98cb7126ebf16ee6a418e86920f6f37658284e375536a1a02cd609

SHA512
ca69d19dd701502fbe9cd5c7d26574980866cab7bbf070ea15d238c4af577f6a5200ee336ec5280e33f912acfb2bf97b07832f21632e9f1bee793d07cd79ab62

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
4c442c22f851e4fb290474bc278abb0c

SHA1
a4e6f1243b40292719ba0d4b469d1f6855ab7587

SHA256
ce2a761850380c4375e112720bde398aaebb5543c3de9625c22b2cda7dbff2f0

SHA512
c927fda67366acdeea5ab25563b41ffde40699c91f364ec750aa74245a83612e2b7178fd4e1f500fa5ea8e47a4d26e3031f9ec1aeae9a044281f7d14cfceb306

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.EnCiPhErEd

Filesize
2KB

MD5
01f061c37a1ca074019703b222339b1c

SHA1
e82e456f2e99122cc1bedc9958ebe228d3c75dab

SHA256
63da95610206da820208d249e91611ed625ad18a305d65b3cbfe0ae43ee02ea1

SHA512
e1c652b4d95ce52d72898f8f03d445478e2ad81c993869fc8dd09352072d280990c7e2dca666e1ba62dc4234fb6a0e5f619f126e66245380b6b1bfffa6e5bde1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
e4c1041c817e326b5919920430e64e02

SHA1
faefc505eb9a6a1b870af877cdf125ca499acb8d

SHA256
49a588af4495b1d3b62b0f59c8b774cb34517ef5389b9ba3b0791cdbb02af7a1

SHA512
8e223654f905dcea27cf2efb03af001727b8686bb70e3fabaf1284a2f1a5278002c8f3255be1d734860b3f56d645e851464f5b6cf1f6d8db5cb9845480eb612c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
44f1d82c4ce6490deb3d54ef2debdb07

SHA1
171bf01cdce14424fae90112d566ac3080d16611

SHA256
a79c6e1e60b13b6c51083c38ecb4cc4ba028bcbf374fa468a434018df46236e9

SHA512
cf13e4c3ea8331f4f5f9d0916ca8212935fe6b155cd413001b4c1bdae8570141ee8512c589d1f381778fa08d5b239c12c88b9602e1f4556b370cdd288d3daabd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
5015dbd980ae8e8a51c5d4d48e94dbcd

SHA1
9f24629b090756eed94d84366c8dafa776aa1e83

SHA256
923f3d707495811698cb422acab0ded4aac0c6c5b90577f346a62242882d78d1

SHA512
58f1efa1377d34fa2a60de9d3f6daf341fa04bdcca85b80fe9a228016af3937fc1108ffc5a1979fc6c18db35389290ec2fd691e82938e7784ebad66166d6c415

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
deb74ef692bb55ca19bc62f3f9c37d09

SHA1
01c07838477bd24059a1f76d5da41990ca9776e7

SHA256
cb1a6c6e107c517c01f880fbfaa68f4551a7addd4ae182f34aa3471b09981b21

SHA512
caf48d33b2627de07fec9ce23333b8592162147f6e2f668964a74f1a46f97d60d8b180ca826aaac0f130bf956c44dfe94e0d6b5409195588660cd87193bfe3fc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662191305923.txt

Filesize
77KB

MD5
939ddd15525e1ef4b8b82e812dfc02c9

SHA1
82c5bb26aedbc58246caa2898cc2ab16e6147ca7

SHA256
80264a813e81de8094448f784b9444eef1b5195ba20e5bf0f3b1f8fdf324b3f2

SHA512
9797e882b7e674390ccf3434983a56b9f2db56fbb3d6c6d0a6d853a9fca135522e8e42c7c633c9935a0ba58b956aafac53faf0f13f133abb216bb96258783449

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663623337830.txt

Filesize
47KB

MD5
194a8c553e1628072c9c344091459426

SHA1
decf3c4ce5e481b8da5a708832f648330b2b46c7

SHA256
cc022391e0f9a0007dec55afd328286bc778ea9b9dd02ec92edf29790f7a337f

SHA512
81df70acec186f2d7680fe840b3bc151324d43544ac17932620617f10ae3c4d304e2928c068f6b39d82044bece967f3a9c8536e49bbe10d7a2a9becdbfc3cb4c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727668521654543.txt

Filesize
63KB

MD5
0ba7dd3f72e0b0497203ac9017a63a64

SHA1
df938c020020b5567c8a6f1c054fe8ca08cb609a

SHA256
7bd7a0db953f00f2f2c6e4c600f43a564f87397ed9c076c604e5baeb99e443ca

SHA512
065e7df7db7da753a58376a0aef2e6338255c73e4ddc1a20b5540fe5d3397773a674227b42d03fe0993bc163a404eccaabd9e35ed6b32a7541322563743618a6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671211214398.txt

Filesize
74KB

MD5
879e1bd23dc86829b205d88742a1acce

SHA1
11c44b9e961189e156bdea1195cdad46ec110e8b

SHA256
a4dee7af6c35ebced2ebfbfcd0f5090573cf270218b453133f3d3c0a5e798405

SHA512
38c3222852655d210109198cbc2e3966543666558521784c5f516ed4c179baaa14dcc31e47dc478e8d585854274c4bc917b8c7b72eed6633cb92e01a558aeb65

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
9780bdeaaa2926f6dd49aa3af125555f

SHA1
eb105d003dc9a954a3e22c2af80dabce1c2eb325

SHA256
d7342baf7456ec556afd6711a7e677160e0be4384e89db6be168558c9ef342c6

SHA512
258928aca6096d95d10878e8f661b17f664f5161fa64fa38d9bd4e1f2335b876fe481cd4af5604c52a50f6acc6002fb8e0688492720a082139035e167c3fd4f6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
dc0977f93841e4032c18f270772a4cf9

SHA1
33ebda87f601c53ffc68baf8d6ba18bcd7ddbf2e

SHA256
46beaadc7206812a6a536eec5a7b51cc32198109f41cedacee01b3a1c8821f69

SHA512
7ca83096d3109ace1733557274319be1bb71588bc2099c74c2a6ff3a8041b2df2f5013a02dbdf885c9cfb2bfe431d6e9f282de334368391e21a8f75137d38166

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
321ffc71262914aa6a1fb088b5a53745

SHA1
346a4adc27af5953aa8d5e7dcb03e2c8f003df3f

SHA256
7fdfc0e567d70b1528f4028f02fc20730fc9a3340ec25b319c3e5f44f4ecf672

SHA512
3f811fc2feae7241906b718c3af7d26979f030b4d73eb4482b6b083fb17d9ce290c4370a0f4bece9a1a2a91cae6cd5ddc9ad7a2a719d7a628970a45ea32a051e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
bd680b0b05a6689ad181ef060134efad

SHA1
af4db4f7953f3dc54770b0840b7e9b26c6c9f6cc

SHA256
d71cb316ba7c728aee612bf6254b4f6b57d984383737082993a7626898048edb

SHA512
e6b14f9b2febeefd024aa8dc196147e1a46a234469816c0edc2be302de6f237b8bd835f9316f2981001bac2cfbfee9376720d9b230d60e3ee17245d1f9ad7a96

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
8726395d225de45017ce3ef8ded4d556

SHA1
9c6c99b1694ced8bd066ec7b8a85273b8d546d2f

SHA256
df3465807a7d0f6b8d66d37d0dee9f35cfe41f4cf26b5dcb666316101353593d

SHA512
687342fb233f030ab3f1438b02858692150996e27d5819997601ab733b9944214c3b29fe646a71103b7d485e179a829df225f352fda17d89b365565892679bdb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
a922d97d3f5268ece65d8e9dae52edc2

SHA1
b5de818ffb37c56271cb3a801ed583a8f78f5e13

SHA256
82d32978fb6f1304a104514d1173e12a303906deac5c6d6c6ec2fed62a2801aa

SHA512
759738d6e99f0edc2e96e38cd594dfd6cddafc823e8109e9e6e7bc065fea896c5c8c3826db1b393a6c2c6739ddef308cfa6ec6f7be5fd9bc3efccb1ee8024c0a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
80db7ffd6770acdd8e105b28ccde6ea3

SHA1
175ca19948ac4ea3784f28d9b6c27265104a2136

SHA256
be0ac9b32e31d818f97554eee02931c67e098864677293b5ecd6eafbf2ec8423

SHA512
bf8b1f259f56ef5af05eb1760774b362966e65491ed98874cc1aadbe40c5ce384d59aa3f8e40df65799f403ada7357bfba067839cbf9c2bf252dc7e1915c5e12

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
3136ba3729d85a279fc8bac78dcbdaee

SHA1
bdb2cead9db03737eabf4739012e385d784790da

SHA256
a57f0e9f387dd7c4286860a68f7074d5040057cb10d92ca06aefc3eeb3a4beb5

SHA512
92b23a249e78681861af97ab4be386b1a3cb3c3f65542356d949b455915826314fc5120949741f1f39f1ccc1ba1fa30ad1a8db269c6ea64ca9c5a90819ba9fa6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
b73109c001bd4a8654ec61084ccd609f

SHA1
c0ee3a4367151af70b92db1e8cb372ec0ce0b7ae

SHA256
0d766f7a1ed604ad8d82721beeee001d1e644b279adf204098dd09fdfeec2502

SHA512
417e8c38fa5243b7facb4127aef7325101c5f56b5bac033cdb2cc9e0c6385f479d8032c173f020edd7b23d2bfc8bc1b97882e02e062bc363cf0237a31f75d5d4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
ba5baa818a6ac49574bde1078efb77ef

SHA1
4eaaef8a9c55bbcc06de3c9ecea9dce30a449268

SHA256
34cd5140f21735ccc28e111a5d87f82c49d7b258668008e6db42ce25cc76f8b7

SHA512
e0e33727a1dc639f4963d87690355903eaef6a9c8ecdac6a9feed8838d040a85086928d2f30fbae48553516be55de03a9acd7738aeb74293106e7bf62ac3e779

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
507f33795f876683efd2b79fed05401c

SHA1
c47b83c85da56cd5df3d5ed60a3104f98fa30d91

SHA256
6c721210f12ad015ad82418acbd2e0facc3f332840c795b4e83e8038204e33fd

SHA512
c219544af1cfded170511df26577ec57da2a17e3787230c58c12131de105ed6a890d6f8716881b5cb38b547195b4c6540b8ee99f31a8b6fb70dae03357906de3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
851c808a087e68885b19c38f6e18eaee

SHA1
2ea62e80daecf15d7b59564023c1cdc544e02395

SHA256
e80accfd0994d3ac33f46c267cf1e2ba631b40eb529888d315a18685e87ae9f9

SHA512
40e92019648183a5203dacd879917e183435041a8a78f65138da41b9118bdfb4ba4b0679138f9d0ed97c36e12e6c109a09ab916a43412faa05faa9a279bf1403

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
710b4493be29ee061967285f9910f358

SHA1
1033102ba510d19b054f3019dbfc46b1a6cc8479

SHA256
e81bfdcbfc615160e9c54cb8a7733398a40c26fa904ab105ef5a393a04be63dc

SHA512
48e9d2481b5b66f5aa6b7ebf3ea624453ac0452b06da2f462da7e307783f699d8b1ab80ecd6d44dfb2817b050b200bd5c7e75fa7e7ae7daa2de5244320a81153

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
51c4426ed1576c1042d6899d87c2ea11

SHA1
1a9d464d7d7e450bd6744847ea846638e3c433aa

SHA256
2636f0499dba8afa0ce7c3112e71fa6c4aac58aa863aeebd409c4bb9769a7591

SHA512
3b1a9c2dd26e881f67b2f98ccbc747372f590eb986724333818d043d757cd653d3a4396bd25ec64364935c369979468108b9ea049dd121d7b918c6cb3226e838

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
88fc6c84135e1d23ec6bde4d79425105

SHA1
a3ecfc8d5c5d8cb58700f56a0a8b7d9c462514c1

SHA256
7d0af975f6e0c5680aa01d60978ccd377f515736c0c31d46f9ea26cf09c5bf1b

SHA512
91e267964914bcab9a3f9f8275d32c4b011750dea72c14c460db1e9dfcad88b43764f83cbb654751b3a975abed2e07f230ebf814fbb18c7a96dd00bd0a656faf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
d3b253f8bdb780d99ebb64aa3486dee0

SHA1
dea7fa7273c3c88bda2f75dbd5ec229e2ed639d3

SHA256
5feb70eaa08c0b0a2cac17598ef996ce02a043b888831c5ef42e79671cac6b29

SHA512
754ac7a11ffb61e047b42f14511d354bc1672879e9409fb687175d7d9c4cda2ed209bd49e4cf7406c3d90992a0be0ef19c2641ea6a1fcca6435ceea2601f8b4b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
dcceff16183f8183df0ea74427dacf47

SHA1
4f9f430ec5617cf5a290fe3ae0871f67e17eb2b7

SHA256
b3af675a9e4e34e46cef80ada7485c91d88dadbe8c3a7b2ab9f357a646fe894b

SHA512
859e24764e85dc4bf9011e8e3fa09743c31402ca6a4986d307fb86e14c65531295647e1fc94c761160c9a90cc833ebfe93cf6ffb2fd5ee1f57e0803973c2fe42

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
b054349d66989c151032de8e5f8d465a

SHA1
3a8fb9beaf12910d2720c46c8df13a5f0aecd785

SHA256
110e60dbb8f12bcf2bfb4665a1f0673e3e5ca955508d8c15eaa5d3dd55ee9b48

SHA512
301def1e4ffb153e4b5408647ce6c1b13c68467277defecbe799b769241f8fb869fef9885b8caa36c5660b50c52def767f410e354134a0a6131c3a3ff8edff0d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
b8786c863b30cf6253292377919a6fd4

SHA1
e321e40d797bd0181261b66040dffb678f939ae5

SHA256
4c41bc1c76c5abec6f89ad9ee9752f7b0efde3a638f311e734eb8457422b21cd

SHA512
9f8d63bf03d751e4bd0c69e1e0a1d21677d7da3bad3c5e6fbde0169f89b9fb10eac7bcf0c6f9b1c0af365642f8beaabc386b8ef44c935e264be449628a15fde7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
717baeaef12377a0c109faf899d61fde

SHA1
0381a6c59fb08d9dcaf2c6c6a4b27601f926c073

SHA256
03632f2150e7bb0d283e7f941daa75e0a6f79c849a2846c7996bc8f5f2194550

SHA512
b19e8019ae74a8f60fe8dbf6d0ce342c1190de7dacbd14f977bdf6142e21d62d75a2aa940f8ad4a65ffaa74bf899254956bb924eb77f6550b6e0015a5dd4d5b1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
bca8dcbc2f808c34dac98567ec294991

SHA1
87d80d54aae31b062f4bf7fad9052359265d6809

SHA256
23937ceb8c00d10ed53f14b0907d4308d1d2ab126b313f3732c87b068aa05719

SHA512
e265d42794086acabbc9d8aaf8e2c91abc3f844902b90bc834bf80481eb8dd9b7bea286f89894dc7336d79a6c79534f97c33cc089994883d8530248ee3039467

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
351ce121839ebc20d6780bcd499cfaa3

SHA1
153e1ead29c32e62968ad21f5ada33aa3bbda098

SHA256
5ec3cf1fdd514fcdbff9fe44e1b44372d66c176c07d65a93cbc68848aed0bdd7

SHA512
390216dcdbe09c59fce1606985c41bbf8b94531ba8731468fa543a0f0143395afd15a041d0e3560b7bbdea0716fe27804961e13b9040e085682b57607e502902

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
2fb408fa4e066829075e6dfb2619464f

SHA1
70c0f86d13275c907454c37bac1299f3034d7bd0

SHA256
18d2e0ca13e6b8d7ba690d203b3cd2fce231301b59388de6da59cf697c331450

SHA512
e95a3ba73a2a432e51364dd4dbac30f568ce8b39022c120012ae7fefb94e0a922a39897c8b7861b8cd5ebcb5274ddfaeb1d18ad9c67b7eed8721b28417388a04

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
3e3b2dac28d6860dc277a5479585599f

SHA1
91f37f61828356f3a81e6bc5dc6c9cd6fd19fb35

SHA256
d61911647dc7961adda2bd8a26f0f4e35923e774ec256a201749e1bb77f9f5fd

SHA512
81a3fd7cf44973dc56be871f01c297c23efb1a86532769ea31165e31eae59f64525d5231b9bbe84fb4ace7f493207e2b2541199dc36942b8955110a83365f363

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
0fba36638e03c07e41b3e3929b80b2b6

SHA1
c3bd63e1d1b56cb4b7f943f74d0f562dd725a7e0

SHA256
c47e8d182b68893a26a636bf0f7a86d0774c6d8277374427355fac83fa232ac0

SHA512
0a63c62976c745399f19ab77efe2fe80993f538b798081b4c103d865aa754dede93ecd4ae8424a68adfe9dc1a2ef60ab2752b1c61a829d96106f48b9844ff631

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
3dcb147bc6127c98716a8e66503ccae3

SHA1
21d49f19132d0b6c453012a2f9a634ddf2d25ebf

SHA256
597293ba47c0311df4df8b66ce8eba506cffb155f21ff84ef2d60caaef6376cc

SHA512
d493264620eff74fc55653b8ea87e2c2d56577bd6c42744a7a7a34366d5d0c703236913672e094e1032fa133a49f4477164fabc306e19411c8cee413d6848b05

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
9cdfca7b42a21f700a606304895ef8fb

SHA1
f621c22f14a4f7e5790254fa7c8134bb627674eb

SHA256
6f5ac12cc4dbc28aa7625d0ef795bafafccc1ec6da6d8b9e9530add721313b89

SHA512
27edc62a02238809418f6e01451fe7ac9dfb1c03c2972b24ed3a70bb79b5a58f175971e7b12937989376c3e377f0c5e849b507da29b14cdfd08f7fe3f4209132

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
51ba2be821e1f8117a9886349c971bc4

SHA1
d003ea8493cc0ba34b3bf26849d02bfc9ab3ca96

SHA256
047513358b8052c69666cc1e015df5caf1f2cdf4a13090dd1750667afc7e7c3f

SHA512
4d065d6c418cfcfc95e07efd9ccae8064b0d267086d78a034db21908d5dbd2559a48ef945e92619a0ef1718d6fd31316b75a6da90e0c337d902cb62801e60b4c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
611776034d6138a6e67fa011ab3e458b

SHA1
b35dc4b41fcbc6c6ae62d0c02c4c3b84045d9531

SHA256
6e3f6c6ac5bc078f6876a25ae8701580ccdf11bb60660ef3e8d2f78c62001a62

SHA512
b042cb33d715cf193fd5462218c1f0a205e28ddaa07b8341b99378084fc46161d507e33a10abcbb3c5cb77fc2d326e56344bca1d64ca8db5745b2011706b59ff

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
0b4c47800e53818eae9a2b334eb3fe02

SHA1
94f41d015f2ace37b65b16e991abe7a3abb42817

SHA256
2164902c551a4271226751254955479207048ee311324d66bb2281a70ba6475d

SHA512
3c2407507d7d114b80504250ae7fb428ba4a3f1ff57707da4ee456eb6aa763ed3e6f8e62b002a0324e601b8c9ef9260a37182cfd12ba66158f978d9f95be3724

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
dcd9c5f9b997d139248dd42e880481e3

SHA1
c8106de45db659ad38e7acee595ed19250d83cd5

SHA256
7125768b32983b5b3b2020fd4ba4f72e134f8fd2c8ae74eda66473e3f3a3f8c7

SHA512
fd60e93f6e7c563c3bdc98533e742e772d1282c4ca7d416b2443291cff1aade88311ed9edb0e8d2c906f4bfee1be6ef8f8a2470ab628a1fdd545cebaf629ca32

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
78b775e08814fd6639fe281a6d4948f6

SHA1
3544c4e6272c1347874b4901e5dfd7033b81f233

SHA256
4b7389ba71e6f38da8746d6dd4a9c64025471b882ec7daa3b6acbebf7ab768cc

SHA512
59f6aba5ea3e04f34a3b574a7e4631b1d8a49f0b91d13abb07260a01c09b2876db97835db57b5cf7ad42a5380339d82c1363f5feb65871bd92d7d2bc658f81ec

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
52b8b92d2b4a108b3c702cea136f6d7a

SHA1
cde25a5c0cf88f20efd227aeab1b44c701c2752c

SHA256
5977d91e68b44ef1fb06a8953229ef0083a660e6747be115bc53112c8c9f4f8b

SHA512
d7318e2ea0e53e220b49d47c3ea6becc7ee42206df9a77ae47a1f8f9aed86f5d21bad63929b50b22890e15203482fe573dd9025bc117ff5e7b2fe6e05317f08a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
70ebf86165bc67077a9222639642502d

SHA1
51e85607779ce7b6ad0e25bb61ec100fc3842299

SHA256
f5f94bdcaa5b47a55338067d29b521fd72cbe636f411c125cbbe6291215e2363

SHA512
5f3e26aac5700e177e26a56feea8b445387ad13012348afc41ddee258868fb0c16380abc5fb734003f102d37512b5941922149e3037b5985a580aa16d568a409

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
e09ce69f322e342f9cb354cf3c0c500d

SHA1
8440854e08a34af173386e7b595d0437da28faca

SHA256
1b79b2072c68f463979a9e928ba6e2426805e285ed05ef7b57c16529a626512d

SHA512
4272e5d34f0abbf42399cb04c486f3dc6260a1550a288fa00ad973e1971bf29d7dabd9b1b8cf633349e57f1b514065be89a30e3a138643a3de05e9a86d301646

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
22397c5139639cbd62a3a3ed656702c7

SHA1
7c707bf815787566277596046ca711936bb02891

SHA256
3e0c8c1d3658af4df6111a0161c70d8489a485d422bea58271d2431e17bac2c8

SHA512
c8225266186a902f57aa050b8f6ee4b1fe41976a9b174aeb65589fac61b012bdcacf4a9d3583ebe3d981c2ea179b2139d5f306ab31a8166b966a90cfe086d597

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
bb0a2f2ffe00b6689b56d18e5148c5ce

SHA1
1b4838a3c2f34a9a3de7a07bb81c1bd2a3b584dc

SHA256
d9202b66893ce9f0709346d21b9c165e922f0093c7b7b178c64e609e3b36213d

SHA512
ae73a463c3298fc5f6feac5894e4514db84b9e963d966d7924aee4cc5cb10b416d92388d83b4dad0c718e4a5554d0aa25b64fd64c2c2d69357081bbb4b978cfc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
bc0dad7e59741474ec0ad3e0f1bb1db7

SHA1
b8608c427375366de1ece0e0a11fb0f21a384965

SHA256
be80c8f446bd6151989b630b22acaddc5d58fbeb83d455e3ed460b40718de545

SHA512
d1f5a5e12d61e094a590add533ee9b21ca15f32aafabe9e143053ce75f9464dee8ac86354dd7fb73b73953d05783c4ed9f7a5fd0a6815000a4a2ae7d2760beae

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
aca0a1e0944ee379779fc82858051005

SHA1
646afa9741edc9c3862142c64f143bbe46125960

SHA256
338baf73eb9835971d184fb135865bb635a78259a2dfbf9590316926afc78520

SHA512
68566c57364ee9c4ba8ada22d37876a17934e6a1939d7b181c7bf6538672ebbedb5af03bd1c24d911705e3ca0dcf3169951c37827578acf5fbb3a8a428fd9cb0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
4d67f7e4c3a82ef40913fcf219a38975

SHA1
72ac13d3bc66a2da6c2919476432392cc1d93f37

SHA256
a1edd15c14a5bd4006da71f26ebe09aeef2b144dbfcf06fd9eaf8e2ea673263e

SHA512
a8850c6b35d2abd3e4bae465ce8af3c8b2d94d4ad8908744edff104d2837a7120cb21c099338dd19ff25a55eb1047592c59b2598f4204b9a380fc6579937cc54

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
f4b925e296c6a1aa623d20ac658a755f

SHA1
11bd124ea22966b59305e9372857792340f11f00

SHA256
c82e8af800f12570f53aa332c957c36d85aaaea81a5f4da7d30fdb6de1eeb348

SHA512
010bbc90a0b84e68e1c06c1df8ec90a1d17fad8fc6424fb2dfc904f609b39366f89c3fe85d94f95756fa0456c41be2385b1bf44187c10b4617c3c5c0b5596ac1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
e0ef1a5fccd9099139c586b74514c6e9

SHA1
8d13dddd4a122dc70b6facd140b9126c8ef872ba

SHA256
e0fb40e1361c2723bc88db322e1cc8bb8eb21e22ae5470da4d0a616bd0b130d6

SHA512
213d598ba80fac4d2f82e496b29934840d7e9026675d6c37d787ae90cb7837e0707dae4dbfa221a105ceddd0881d0dee229245ccb8179b3680b255c51fcb97ba

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
cde834a4c53da97560ac7d297e41f3b7

SHA1
633b3dae5d2c12e1b7eaaa173a6c2bfe44f7a5da

SHA256
661e38fb2d62a516b3c81c904b88c1bf37e62be222d8a877f0206c77c2594d62

SHA512
9620985de9ddc26aa0fb3e0f5a15660f7425aa0685b063db4fd16c4ea814646dd6838137825196e1f4302567a2b1883733bd7c84d2ab992d06a16a904c70e3d6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
2abaef6c396429e476b3e3c32d3d9e46

SHA1
1b599314895d6a60b4106de9f0172c46bca94055

SHA256
ffd4a56783e265111cd13f205c42260ee4f42103deedfcd42cbbe1375de66692

SHA512
aab687365d6556a6211033eff4f373ba0e172d775a6626fa05bf8034550db7a4203c45956434f5b0ff751594b223e204717a98583785c33f22d3f50844cef187

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
622228f1e68abeb5283e97f11af5c9d3

SHA1
6aaa8b59532f741d64b4a753bb1fdab6827813c1

SHA256
7ec4f69242416b729d49e41d243ff01d56a64db875072f654da69491dd87e0c4

SHA512
af394e877885369400949d03984926d516e71b8231caf5c276212b05565f63ee8bede063496618d08d1be8c51f60eed40b6999e320a8891ca54d180623931d2d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
3429e9c2cab7fea28103def1de2f025a

SHA1
ff28c3d0473294ec89894bf7e7992b2915e0308f

SHA256
5a037d1c219abb9d026d90325dea31a1f5b10b13316333317a6c1d09a94ed8e5

SHA512
8b1d8b925bce12db1893d3a18aff3ba018124250c45ac4563768ff2fc9aa7a981db5f65f535ac6bd9e2e44a126e57e6f74f6b8375fe573b28c49ef17a58d1267

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
6fe1cd8b25e50b8236f0825809d12a09

SHA1
16fbd865b7a404ada8603afdecd7dc3db548aab0

SHA256
591befd8bab41596ce3fdeb36ef63c433b5610066c625df5185e2e98bf1921e4

SHA512
d61adec0372d031b15a57ea507b6ea63462972b344ce2299aaf32615bc9489b03d5f4d06424eb7a795c4d9a79a180713e5269431302d062bd81a563d0a9bab7a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
07056607cf148240cb42c3aa6e304d86

SHA1
7073c6bebe68d3a602a0049e9940606caf2b5e7a

SHA256
df7bb5d9d9520d7798bdac8af0b732aaad31863bb0919c094b104eb16ad8b5b4

SHA512
00fbe615fe06239a7372c311992d43b0661528fd019e6dfe91b1d96c84d15d518eba16ec8f606ec7cd767a37ca33eb69248508b9376fb95acb1450e0580ecd14

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
14de704ace9ddeee2240ec266a71d9ec

SHA1
71c2f457caad843417c8bd69441176234ffdbb0d

SHA256
7b2e1b276a9d5d6a465aef707c05a4b66ae16c97671d52542125944eec9fa0cb

SHA512
4dfb4630249aa81a3e4afaed95533b9a7d57eab2a11969200f65bf90f751f4ae314d70e0b81f7749c366047fb2fae05f78f23015d07a5e90e8a8eeda92b6fced

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
c0f01c4f2917f9d210eb351d6f1af942

SHA1
2004346237986715369ce49b308e2ef61bbec9e0

SHA256
c40cfe05682d61254b0cf19d132dff54875369cce0b00ef31b7aa255ee203360

SHA512
f0e0c3e4f11b005c9243f24099886c7ba448882a8c340ab13bf07b6f1323326197c637a5f385c1fcc9e4d0b30d232a7f1e17e0223aed11d6a730b4e7b5251bbd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
598f58a690abe9adbff625c7dbe9f357

SHA1
d8671b4207ad77585605ba5f8a2d3b8928fd7375

SHA256
12c2854888e95e47e9f6864849f046161e63ffd8722a98fb3bde1c31696b9d89

SHA512
0407a9808ddcf29ba2269c84772f404a4658f49767963230cdc9c028284130cb7ad222cc6e07e3539fd6e2f40736c60d28e942456464b31d18096207418f99d8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
0d7454bdfabdcb79541c05d9afa49bef

SHA1
0ea249844339b1fcb481cc588c7bf9419ad7aec1

SHA256
7beb45ff8de2b97561b11f899ec7f4e3fe7acf042374791a38f9aef647722099

SHA512
c20477f0aa942cd88d42e6976e9e61c26412b841495a6b03e2d5a44f5e19bd8e0a83b9059c263b229a705a5b17d6afd26e1fc5c762880818bd7cd7a1c8deb915

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
108f8defac917e9582bb90c3fd8c5f66

SHA1
fbf39e923c408d2d5f2be82837c3be1a814f5647

SHA256
c9f5941335158f3132d0c4170baf9316ebad15c8d374a19ec69640293716f594

SHA512
e30618227c7e277e63acc875ce3195fa10f552d793a54d2649a90fa3fd6732c8ee5f1483bf7e1e8003023a966dd7aa40dd7bb9dc70b610eb34f11f7c220831e7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
2f8161caad9d0a8be7fee65472f264c1

SHA1
acfb191a09f791fbdf77c065026bac24f4db3c9f

SHA256
0cc2932b01a16bc146c1ffe1944860ae89d1e9c12b419657787728bc7bc9d321

SHA512
f142131787997ad80e03f3d22a583051a0c32cac352f49137233ef722b84c33c796f2f9a8a4e96eaac61b24d4b19cc028dcb49e8bd6fa6d8ccad4852b7d10136

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
5ae4076d5093146a9c84fb7e38dc6c5e

SHA1
7335a6d4ec3c1bfd69dd2427953b4ddb11285110

SHA256
a977b95a4e7ad72c6bb92f062aa1bde7ee03a6a355a4271943a4a8f779eae5f6

SHA512
70d5115459a9d1e41cb25fdf0e03185891f2676095b690a167de6a60f7defc6e1dfaa3c044104d3029d5f05ace570a1278ed5fd09c0a5981494c6ef8dbf395ec

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
d9ba4395f5283e84e8f0d5547603849d

SHA1
777327f5e1d8440c21cce4445664c02cb37b58c3

SHA256
a274b2c1b7d04a3fd31a4abfafa2fcbc11a0a15f44c0e0e1a5df7f36b047d7b6

SHA512
45c272e6d6ff1cd995ca1f6c5e20ce7e36c7f312adf4a46995cda2ca99bad5658f660b2c3c7e8b0d837f47c1aff0e5415800964f360932365e611022adb1ac4a

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
38a78e5a589bc116e5728b83575bb420

SHA1
1bc3c40cf31af2f6f2079cfe86b7b361c1ac9d19

SHA256
caade7ad035271e2cf3f4e6e1f511adab66dbb41d78a70013011b4d318af356e

SHA512
a756183cfbeda955a6d05c58f3d476e0b266fe5d3c9fc61181e9a38346a6e0e442126c251f43f84c4a38b9280004ec64bb37b43e55f15384aea5c29f8c0fa0b9

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
2fa6d2303e7e87294efdcc7fe19d5069

SHA1
a072f10796dcd689538d1668f8de23c9dcdb04fb

SHA256
255444424257d3c958010cc42bb48ed2adf6607c1ccfc5cdeb91d42fde9040cd

SHA512
6437202277b0c62492e389b3a496d580a2cd8e16bc97117045f785b166c9dfc4e54da7d6e148a44320edc6ade23d864ea4ce75e42bc0ee9340605da091823dde

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
d21aba801dad301d51b3dd70cab1e0f1

SHA1
f7cac1fab9f0c570bbfd072f76d313a351c7110a

SHA256
02b3875a4cc83cc534b6223b7f14d0bb4514dca75aa95828f6fafb8296131bd0

SHA512
371407ee078cc71d72b27e5e3d48449eacc570fc6874f6533a75c6ca29e82e7c951f6ca5ecf1e51c36e9a420934983976ca26aece4676554302874b3734633be

Download Submit
memory/2904-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2904-4023-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2904-3791-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2904-4340-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2904-3792-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2904-4361-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2904-4363-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download